34 Malware.Heuristic false positives. (1001, 1003, 1008)

[DarthVitrial]

Log attached. Every one of these is a false positive - amazon games app, lego mata nui online game, gigabyte installer, Morrowind, Kara no Shoujou, and other games.

 

Please tell me I don't have to manually upload all 34 of these files, my internet is 400kbps.

 

 

also its kind of weird it detected these since I remember turning expert algorithms off...maybe an update turned it back on?

false.txt

Edited November 6, 2021 by DarthVitrial

[Porthos]

1 hour ago, DarthVitrial said:

also its kind of weird it detected these since I remember turning expert algorithms off...maybe an update turned it back on?

No it is still off by default. It has not been enabled by an update.

[blender]

Hi @DarthVitrial, I managed to download several of the files from another source.
MBAM on my machine is not picking these up even with A.I. turned on. Can you check again please?

If any still being detected, please upload a new log.

Thanks!

[blender]

Hello again @DarthVitrial, 

Can I get you to upload some additional logs for me?
Go here: C:\ProgramData\Malwarebytes\MBAMService\logs
Hilight the recent MBAMSERVICE.LOG.* (.LOG, .LOG.bk1, .bk2)>> sendto>> compressed zipped folder. (It will complain about making a zip in that folder and offer to save to desktop.)
Upload it here. (It will be called MBAMSERVICE.zip)
Yes, the logs are large but txt type files compress nicely so it'll only be a mb or so if that. 3 logs should be enough.

Thanks!

[DarthVitrial]

9 hours ago, blender said:

Hello again @DarthVitrial, 

Can I get you to upload some additional logs for me?
Go here: C:\ProgramData\Malwarebytes\MBAMService\logs
Hilight the recent MBAMSERVICE.LOG.* (.LOG, .LOG.bk1, .bk2)>> sendto>> compressed zipped folder. (It will complain about making a zip in that folder and offer to save to desktop.)
Upload it here. (It will be called MBAMSERVICE.zip)
Yes, the logs are large but txt type files compress nicely so it'll only be a mb or so if that. 3 logs should be enough.

Thanks!

It's been a day, should I rerun the scan and get updated logs?

[DarthVitrial]

logs.7zHere, logs from the last few days

[blender]

Thanks for the logs. Looking now.

[blender]

Hello,

It looks like the "Expert algorithms" were enabled during this scan.

Posting a screenshot of the setting Porthos is talking about (mine is off). It is super aggressive so not advised it be enabled under normal conditions.

Can you disable that as shown and try re-scan?

 

[DarthVitrial]

Yes, they seem to be false positives caused by expert algorithms. I've disabled that now, but they should probably be whitelisted so the algorithm can learn not to flag them.