False positive on self-written .NET 4.5 WinApp with C# and Visual Studio

[emmeffe]

Hello,

I'm writing an application for my personal use (and, possibly, sharing it via github when it's complete) that analyzes the filesystem searching for duplicate files, reorganize files with presets, know which files are using more space, merge folders without dupes, etc.

Among the features it has, it performs heavy file-related tasks as

• File listing and enumeration (via https://github.com/VladPVS/FastSearchLibrary)
• File checksumming (via custom MD5 algo)
• File copy / move / delete (via native System.IO.* calls)
• Persistent file enumeration storage into SQlite DB for performance reasons

Problem is, as soon as I've implemented the automated functionality that "removes duplicates" from a folder/drive, MBAM immediately treated the compiled application as a Ransomware.

The application is giving feedback to the User, via a LogWindow and a MessageBox asking if he really wants to delete these duplicates.

I'm sharing the application .exe, and all log files.

Kind regards,
Maurizio

rfeo.zip

[miekiemoes]

Hi,

It's a behavioral detection here. I will whitelist this one. For now, please create a temporary exclusion for the file/location on your end.

Thanks for reporting!