Jump to content
Kaspersky Support Forum

False positive regarding MAME exe, please fix this.

voorhees_13

By voorhees_13
in Kaspersky Total Security

 Share

Recommended Posts

voorhees_13

voorhees_13

Posted
  • Author
Posted

Kaspersky, please fix this. No other AV on virustotal is detecting this file as a virus. MAME has been a trusted arcade emulator for 20 years. The site (mamedev.org) is secure and has never had a malware problem. Please fix.

Flood and Flood's wife

Flood and Flood's wife

Posted
Posted

Hello @voorhees_13, 

Welcome back!

  • Check the detected object using Kaspersky Open Threat portal, and select the Submit to reanalyze option, add your email address & comments to send to Kaspersky experts for further analysis.
  • Log a case with Kaspersky Technical Support, fill in the template as in our image; zip the .exe file, name the zip archive malware, or infected & protect the zip archive with a password, add the zip archive to the request; add the password to the request; in the problem description provide a detailed history, images & or video: if they help explain the problem & the URL/link to this Community topic: Support may request Logs & or other system data, they will guide you if necessary:

 

 

  • After submitting the case, you’ll receive an automated email with an INC+12digits reference number, then, normally, within 5 business days, a Kaspersky Technical Support human will be in touch, also by email, you may continue to engage with the Kaspersky Technical Team via email or by updating the INC in their MyKaspersky account.
  • Please share the outcome with the Community when it’s available? 

 

Thank you🙏

Flood🐳+🐋

voorhees_13

voorhees_13

Posted
  • Author
Posted

Hello @voorhees_13, 

Welcome back!

  • Check the detected object using Kaspersky Open Threat portal, and select the Submit to reanalyze option, add your email address & comments to send to Kaspersky experts for further analysis.
  • Log a case with Kaspersky Technical Support, fill in the template as in our image; zip the .exe file, name the zip archive malware, or infected & protect the zip archive with a password, add the zip archive to the request; add the password to the request; in the problem description provide a detailed history, images & or video: if they help explain the problem & the URL/link to this Community topic: Support may request Logs & or other system data, they will guide you if necessary:

 

 

  • After submitting the case, you’ll receive an automated email with an INC+12digits reference number, then, normally, within 5 business days, a Kaspersky Technical Support human will be in touch, also by email, you may continue to engage with the Kaspersky Technical Team via email or by updating the INC in their MyKaspersky account.
  • Please share the outcome with the Community when it’s available? 

 

Thank you🙏

Flood🐳+🐋

 

I had already just deleted everything in the folder off my pc, is it possible to still go ahead with the case? Kaspersky will just auto quarantine the .exe and I won’t be able to upload it.

Flood and Flood's wife

Flood and Flood's wife

Posted
Posted

Hello @voorhees_13, 

Thank you for posting back👌

The Kaspersky Virus Analysts need the exe to determine the issue. 

You may need to pause KTS while you collect & submit the data. 

Thank you🙏

Flood🐳+🐋

voorhees_13

voorhees_13

Posted
  • Author
Posted

Hello @voorhees_13, 

Thank you for posting back👌

The Kaspersky Virus Analysts need the exe to determine the issue. 

You may need to pause KTS while you collect & submit the data. 

Thank you🙏

Flood🐳+🐋

 

How would I go about pausing KTS?

Flood and Flood's wife

Flood and Flood's wife

Posted
Posted

Hello @voorhees_13, 

Thank you for posting back👌

On the Windows Taskbar, rightclick the Kaspersky icon, select Pause protection

 

 

Thank you🙏

Flood🐳+🐋

voorhees_13

voorhees_13

Posted
  • Author
Posted

Hello @voorhees_13, 

Thank you for posting back👌

On the Windows Taskbar, rightclick the Kaspersky icon, select Pause protection

 

 

Thank you🙏

Flood🐳+🐋

 

The file was too large to be uploaded normally, and it detected as malware even through the .rar I uploaded it as, and every time I tried to send the object for re-validation, it throws me an error.

Flood and Flood's wife

Flood and Flood's wife

Posted
Posted

Hello @voorhees_13, 

Thank you for posting back👌

Ok, upload the file to any cloud service, for example, Google Drive, One Drive, Mega Drive, Ice drive, create a share link, add the share link to your incident request. 

Thank you🙏

Flood🐳+🐋

  • 3 months later...
Wesly.Zhang

Wesly.Zhang

Posted
Posted

Hello,

Could you please search the detection information in File-AV, System Wather_report, upload a screenshot to those informaion, which is better to know the issue.

Regards.

Wesly.Zhang

Wesly.Zhang

Posted
Posted

Hello @ICEknight 

In my test, There is no any detection event has been found in mame. Could you check this issue has gone in your side or there is a special step which could trigger detection. such as load a game package or other information. Please let us know.

Regards.

ICEknight

ICEknight

Posted
Posted

@Wesly.Zhang @Flood and Flood's wife 

I got that false positive today (with the exe getting automatically quarantined after just opening the folder it was in), with the “mame230_32bit.7z” build which can be downloaded from here:  https://drive.google.com/drive/folders/1eiNztWEpk0C7CiiZXz0SMDM_eJOmb0FO

It seems to have been randomly happening with certain builds for some time now, as can be read in this discussion from January, which also gives some hints on its possible reasons: https://forums.bannister.org/ubbthreads.php?ubb=showflat&Number=118317

 

Wesly.Zhang

Wesly.Zhang

Posted
Posted

@Wesly.Zhang @Flood and Flood's wife 

I got that false positive today (with the exe automatically quarantined after just opening the folder it was in), with the “mame230_32bit.7z” build which can be downloaded from here:  https://drive.google.com/drive/folders/1eiNztWEpk0C7CiiZXz0SMDM_eJOmb0FO

It seems to have been randomly happening with certain builds for some time now, as can be read in this discussion from January, which also gives some hints on its possible reasons: https://forums.bannister.org/ubbthreads.php?ubb=showflat&Number=118317

 


Hello，

Do you use a x86 OS？

Regards.

Flood and Flood's wife

Flood and Flood's wife

Posted
Posted

@Flood and Flood's wife

MAME’s latest official builds are always posted here: https://www.mamedev.org/release.html

Though this false positive also affects any alternate builds made by others, using the publicly available source (being an open-source project).

Hello @ICEknight, 

Apologies, we had no idea, from your original post, you were also affected by the issue😥
Thank you🙏

Flood🐳+🐋

ICEknight

ICEknight

Posted
Posted

 

Do you use a x86 OS？

 

Yes, though I don’t think the others who reported this do.

Wesly.Zhang

Wesly.Zhang

Posted
Posted

 

Do you use a x86 OS？

 

Yes, though I don’t think the others who reported this do.


Hello,

Could you give me a offical download source? I see the offical website, but I can not find a x86 build.

You have a x86 OS, maybe you can download a x86 version. Please give me the download url for 32 bit build. I cannot access google cloud because of national policy. Sorry

Regards.

ICEknight

ICEknight

Posted
Posted

 

Could you give me a offical download source? I see the offical website, but I can not find a x86 build.

You have a x86 OS, maybe you can download a x86 version. Please give me the download url for 32 bit build. I cannot access google cloud because of national policy. Sorry

 

There’s no official 32 bit builds anymore. I’ve reuploaded it here: https://file.io/xLdLyXjKerAp

Wesly.Zhang

Wesly.Zhang

Posted
Posted

@Wesly.Zhang

You have all previous official releases in this link, including 64 and (old) 32 bit binaries: https://www.mamedev.org/oldrel.html


Hello,

I have received the sample you provided to me. As I think (maybe I may not have looked at all the assembly code, because this file is really big. ), this is a false positive. But This point needs to be confirmed by the KL virus lab. The relevant file has been submitted and are waiting for their confirmation. (INC000012750277)

If they reply any information, I will post here.

Regards.

ICEknight

ICEknight

Posted
Posted

Hello,

A new information : KL confirm it is a false positive. It will be fixed related to https://file.io/xLdLyXjKerAp sample.

Regards.

 

Thanks, any word if they’ll fix it so that the false positive won’t happen with previous and newer (monthly) versions?

Wesly.Zhang

Wesly.Zhang

Posted
Posted

Hello,

A new information : KL confirm it is a false positive. It will be fixed related to https://file.io/xLdLyXjKerAp sample.

Regards.

 

Thanks, any word if they’ll fix it so that the false positive won’t happen with previous and newer (monthly) versions?


Hello,

I am not sure. If the newer version occur again, Please sent the detected object to KL support or sent a e-mail to china-support@kaspersky.com.

Regards.

Guest
This topic is now closed to further replies.
 Share
Go to topic listing


×
×
  • Create New...