MBSetup download shows BScope.Trojan.DllHacker detected by VBA32

[C-King]

I just downloaded Malwarebytes ( MBSetup-119967.119967-consumer.exe) and posted to VirusTotal.  One of the scans from VBA32 shows detection of BScope.Trojan.DllHijacker. I am guessing this is a false positive for the Malwarebytes install program

[AdvancedSetup]

What link did you use?

What is the VT link?

These are our two official download links

 

MB4 Online Installer
https://downloads.malwarebytes.com/file/mb-windows

MB4 Offline Installer
https://downloads.malwarebytes.com/file/mb4_offline

 

 

[AdvancedSetup]

The online installer downloads this name:  MBSetup.exe

The offline installer downloads this name: mb4-setup-consumer-4.4.10.144-1.0.1499-1.0.46786.exe

Neither of them download the name you provided: MBSetup-119967.119967-consumer.exe

[Porthos]

8 minutes ago, AdvancedSetup said:

Neither of them download the name you provided: MBSetup-119967.119967-consumer.exe

From the main site it does with this link. https://www.malwarebytes.com/mwb-download/thankyou

https://www.virustotal.com/gui/file/7176cb7fae5a66d9d823e63a6629e1b6e4acc8fbcfb78f6150bd32952aa0c8a0?nocache=1

Edited November 5, 2021 by Porthos

[AdvancedSetup]

Thank you @Porthos

I'll check it out and provide feedback

 

[AdvancedSetup]

The detection on VT is a False Positive. Thank you for reporting @C-King  and thank you @Porthos for assisting on the naming concern.

 

MB4 Online Installer
https://downloads.malwarebytes.com/file/mb-windows

MB4 Offline Installer
https://downloads.malwarebytes.com/file/mb4_offline

MB4 Main website Installer
https://www.malwarebytes.com/mwb-download/thankyou

The online installer downloads this name:  MBSetup.exe

The offline installer downloads this name: mb4-setup-consumer-4.4.10.144-1.0.1499-1.0.46786.exe

The Main website Installer downloads this name: MBSetup-119967.119967-consumer.exe

MBSetup-119967.119967-consumer.exe is the exact identical file named MBSetup.exe
The both share this hash file:  7176cb7fae5a66d9d823e63a6629e1b6e4acc8fbcfb78f6150bd32952aa0c8a0

https://www.virustotal.com/gui/file/7176cb7fae5a66d9d823e63a6629e1b6e4acc8fbcfb78f6150bd32952aa0c8a0?nocache=1

 

The offline file: mb4-setup-consumer-4.4.10.144-1.0.1499-1.0.46786.exe
Has the following hash: cff5a7f9143d9df37c7a9aeb7775d48a81db242c925466d4b688d13aec2c2f67

https://www.virustotal.com/gui/file/cff5a7f9143d9df37c7a9aeb7775d48a81db242c925466d4b688d13aec2c2f67?nocache=1

 

 

 

[C-King]

The URL that I downloaded from is https://www.malwarebytes.com/mwb-download

 

[C-King]

I tried both links provided (https://downloads.malwarebytes.com/file/mb-windows and https://downloads.malwarebytes.com/file/mb4_offline). I submitted both downloaded files to Virustotal and they still show up with 1 detection. See https://www.virustotal.com/gui/file/7176cb7fae5a66d9d823e63a6629e1b6e4acc8fbcfb78f6150bd32952aa0c8a0/details  for details

[C-King]

with only 1 detection out of the entire virustotal list, I think we can assume that this is a false positive detection from VBA32  

[David H. Lipman]

Yes...   It is a False Positive on a Malwarebytes' Digitally signed file.

One can send a False Positive Report to VirusBlokAda via the following Email URI;  feedback@anti-virus.by?Subject=False%20Positive%20Submission

I have submitted the 2MB online installer.

Edited November 5, 2021 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[David H. Lipman]

8 hours ago, David H. Lipman said:

I have submitted the 2MB online installer.

Result...

Quote

Hello,
File is clean. False positive will be removed in the next update.
Thank you for informing us.

 

-- 
Best Regards, Alexey Gerasimenko,
mailto:feedback@anti-virus.by
VirusBlokAda Ltd., Minsk, Belarus