Naming folder "False Positive" makes Malwarebytes ignore malicious files

[Lerain]

Greetings,

Just found this on random. Don't know if it's a bug or intended.

Basically I've modified one of my EXE files for a game in order to get the proper title on Playnite (with tools like Resource Tuner 2.20 or Resource Hacker 5.1.8 where you can edit the ProductName metadata).

On that particular one, Malwarebytes doesn't like the change and starts to show up like that :




And this is the scan on Virtus Total : https://www.virustotal.com/gui/file/96779fcc37c3f211889548215c3679b138fb88697aa24e6188c0627ea977d977?nocache=1

However, I've put the game inside a folder called "False Positive" and suddenly Malwarebytes stops noticing it.

My "Allow List" is completely empty :

 

I've also tested this on another computer with brand new installation of Malwarebytes and as soon as the EXE is inside a folder called "False Positive" - it wont detect anything.

Is that supposed to happens ? What will prevent someone from creating the same naming for a folder ("False Positive") and put all kind of malicious things there, since MB will ignore them ?

[Lerain]

Found out something else from another topic

Basically those files that I've modified are only shown as malicious when the expert system algorithms thing is active.

If i deactivate it - none of my modified files are triggered as malicious (or at least the ones with a type Heuristic)

The thing with the "False Positive" folder is still unclear.

I have several modified files that are Machine Learning / Anomalous 97% (first attachment)

They are also ignored if i put them inside a "False Positive" folder :D (second)

[Porthos]

2 hours ago, Lerain said:

Basically those files that I've modified are only shown as malicious when the expert system algorithms thing is active.

If i deactivate it - none of my modified files are triggered as malicious (or at least the ones with a type Heuristic)

This is off by default and should not be turned on.

[claudiubo]

16 hours ago, Porthos said:

This is off by default and should not be turned on.

Why is the present in the options if "should not be turned on" ????

Sure, from a marketing point of view " Use expert system algorithms...." sounds terrific, but is that fair?????

[Lerain]

13 minutes ago, claudiubo said:

Why is the present in the options if "should not be turned on" ????

Sure, from a marketing point of view " Use expert system algorithms...." sounds terrific, but is that fair?????

My point exactly..

But either way (with this feature on or off) putting EXEs inside a folder names "False Positive" - will not trigger any detection or at least - will not trigger any detection that is related to "Machine Learning" and "AI" as a type.

So what about that ? :D

I plan to find an actual virus and hide it inside such folder just to see if MB will recognize it after that. Time to go to some shady sites, i reckon. (O.o)

[Lerain]

Found one from this website : https://www.eicar.org/?page_id=3950

Scanning the "eicar.com" will lead to :



And if i put that inside a "False Positive" folder = same detection. So MB wont care about the folder if its a specific type of virus (like "EICAR-AV-Test" in this example).

BUT

I've also tested the "Zemana Simulation Test Programs" from here (Number 5) : https://www.raymond.cc/blog/test-the-effectiveness-of-your-antivirus-firewall-and-hips-software/

That one is labeled "Malware.AI.##########"

And if i put that one inside a "False Positive" - take a look



So at this point we can say for sure that Malwarebytes AI scanning thing (for the lack of a better name) ignores everything that is inside a folder named "False Positive".

This is only for virus types that the AI predicts it might be harmful but not really sure. Just a guess, I dont know how this thing works.

It was not documented anywhere so i reckon it might be bug, but at this point i think it's more of a feature that was not explained publicly.

I rest my case tho - as the others "real type" viruses will be detected no mater the folder name and so on.

[David H. Lipman]

Because it is a Heuristic.  They are not static detections.

[claudiubo]

36 minutes ago, David H. Lipman said:

Because it is a Heuristic.  They are not static detections.

Heuristic or not, point is a malicious file inside a folder named "False Positive" it is not detected by Malwarebytes.

[David H. Lipman]

Again, they are not static detections.

"If it walks like a duck, and it squawks like a duck, then it must be a duck."

But if Mickey Mouse walks like a duck, and Mickey Mouse squawks like a duck, it does not make Mickey Mouse a duck.

At the same time if Donald Duck squeaks like Mickey Mouse, it doesn't make him a mouse.

But if you get the DNA or Fingerprints of Donald Duck you can say he's a duck.  The DNA or Fingerprints would be a static detection.

If one alters the characteristics of a file and its location without changing the physical file, it will change the Heuristic detections or lack thereof of a file.

This would all change if there was a static detection such as Trojan.IcedID

** If you have a Windows based malware sample that is not detected then please submit it in;  Newest Malware Threats following the below guidance...

• Malware Hunters group
• Purpose of this forum

 

Edited January 29, 2022 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[Porthos]

3 hours ago, Lerain said:

putting EXEs inside a folder names "False Positive" - will not trigger any detection

Depending on the location of the folder. The default scan does not scan every folder and file on the computer. It is not designed to. It only scans locations where malware is known to hide.

[Lerain]

8 minutes ago, Porthos said:

Depending on the location of the folder. The default scan does not scan every folder and file on the computer. It is not designed to. It only scans locations where malware is known to hide.

I don't use the default scan options. Why waste time and resource when I can target only a specific exe.
I thought this is clear from my pictures above showing only 1 files was scanned and not detected.

[Porthos]

The AI detection's are registered automatically and if a actual FP it is automatically whitelisted.

 

[Porthos]

@Lerain

I ran your "false positive" folder test with actual malware. and it was detected.

 

Edited January 29, 2022 by Porthos

[Lerain]

1 minute ago, Porthos said:

@Lerain

I ran your "false positive" folder test with actual malware. and it was detected.

 

Yes, but if you put one of those AI and Heuristic things - they wont be.

Example : https://www.raymond.cc/blog/test-the-effectiveness-of-your-antivirus-firewall-and-hips-software/

Option 5 - Zemana Simulation Test Programs

Scan the tree EXEs directly from the Zemana Simulation Test Programs - you will get the Maware.AI detection.

Then the put the on a "Fasle Positive" folder and everything will be fine.

Then get them out of there and scan again - Maware.AI detection.

[Lerain]

1 minute ago, Lerain said:

Then the put the on a "Fasle Positive" folder and everything will be fine.

Then put them on a "False Positive" folder and everything will be fine. Nothing will be detected.

I don't know how you edit posts here - it seems impossible for me.

[Porthos]

54 minutes ago, Lerain said:

I don't know how you edit posts here - it seems impossible for me.

You cant for a while.

Best we wait for a staff member to chime in on your findings with the scanning.

@miekiemoes

Edited January 29, 2022 by Porthos

[TwinHeadedEagle]

Hi,

This unintentional whitelist will be fixed in the next database update. Thank you for your effort to report this!

[claudiubo]

1 hour ago, TwinHeadedEagle said:

Hi,

This unintentional whitelist ...

The "unintentional whitelist" is in fact a MAJOR FLAW in Malwarebytes software and Lerain deserves more than a "Thank you" for discovering this.....

[shadowwar]

It was not a flaw in the software but a test whitelist definition that got promoted to public. It is removed now from definitions. 

Edited January 30, 2022 by shadowwar

[shadowwar]

It was never meant to go public thus no announcement. It was a mistake. Also this was only for machine heuristics for that folder. Normal mbam defs would of picked up malicious files there. 

Edited January 30, 2022 by shadowwar