False Positive: Malwarebytes and Virustotal Report AI Malware in 3.26

Support
1

Malwarebytes and virustotal had discovered AI malware in 3.26. I tried it afterwrds with 3.25 and no malware discovered. Using Malwarebytes Pro 5.1.5.116

2

I just checked the 64-bit setup of 3.26 in virustotal.com and got this result:

grafik
grafik1280×911 86.5 KB

Which looks to me like: no problems.
Did you get the file from the official MP3tag download site?

3

@ohrenkino the report is referring to the 32-bit version.

I've reported this as a potential false positive to Malwarebytes and hope they'll check and fix soon:

@daveo76 Thanks for reporting! It's most likely a false positive.

4

The chance/risk that a software is infected if only 1 (one!) of 73 antivirus checker detect "something" is extremely low:

image
image950×301 25.5 KB

It would be interesting what kind of AI this should be for Mp3tag 32bit?

image

5

The funny thing:

Malwarebytes itself is using AI to (wrongly) detect AI in other software:

Malware.AI.(id-nr) are detection names produced by the Artificial Intelligence module in Malwarebytes 4 and Malwarebytes business products. These generic malware detections are due to our new automated signature system called BytesTotal and DDS engine that are based on Machine Learning technology with 100% autonomous learning which don’t require any human interaction to correctly identify malware.

They should add a big red note that no AI is error free and this kind of detection can lead to even more unwanted false positives.

Addendum:
For those interested how the "MachineLearning" technology at Malwarebytes works:

6

False alarms from anti-virus software are extremely common. So a much better and more accurate title for your post might have been something like:

"Malwarebytes and Virustotal Report AI Malware in 3.26"

That would make it clear that this is only a report and NOT a confirmed fact. There is no need to alarm users of this forum unnecessarily.

8

It's fixed now, confirmed to be a false positive, and I've adjusted the topic title accordingly (much in line with what @Doug_Mackie suggested),

Thanks all for patience and understanding.

9

Sorry about the title I put up

10

It's back again, just got this on a Malwarebytes scan:

Malwarebytes

-Log Details-
Scan Date: 1/22/2025
Scan Time: 9:33 AM
Log File: b551a269-d847-11ef-9b21-382c4abd2e03.json

-Software Information-
Version: 5.2.4.157
Components Version: 1.0.5116
Update Package Version: 1.0.94792
License: Premium

-System Information-
OS: Windows 10 (Build 19045.5371)
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Scheduler
Result: Completed
Objects Scanned: 233149
Threats Detected: 1
Threats Quarantined: 0
Time Elapsed: 2 min, 27 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
File system: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

File: 1
Malware.AI.4294736855, C:\USERS<user>\DOWNLOADS\MP3TAGV322BSETUP.EXE, No Action By User, 1000000, -230441, 1.0.94792, E728B020F89CD123FFFC7BD7, dds, 03186484, EB6EF3268AEB3E34FA5AE147BC6C9542, C9480C892433A286B593E682A2D93A4E592A9A2C7F9FADA42C31E5A7D49719D3

11

Did you really check the version MP3TAGV322BSETUP.EXE? This version was from 2023-08-24.
The current version of Mp3tag is v3.28a

12

Thanks, I didn't check that, but that file has been sitting in the Downloads folder since I started using Mp3tag, Malwarebytes has never complained about it before.
I scanned it again today and Malwarebytes didn't detect it. Must have been a transient false positive.