# False Positive: Malwarebytes and Virustotal Report AI Malware in 3.26
**URL:** https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907
**Category:** Support
**Created:** [June 1, 2024, 7:02am UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907 "2024-06-01T07:02:10Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@daveo76](https://community.mp3tag.de/u/daveo76)
#### Post date: [June 1, 2024, 7:02am UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/1 "2024-06-01T07:02:11Z")
Malwarebytes and virustotal had discovered AI malware in 3.26. I tried it afterwrds with 3.25 and no malware discovered. Using Malwarebytes Pro 5.1.5.116
> **[VirusTotal](https://www.virustotal.com/gui/file/ae1ba0d8b3f73c53a0f12886590e2d6d6159769c1bc99579c3c3cc0e46f07972)**
>
> VirusTotal
> **[Malware.AI | Malwarebytes Labs](https://www.malwarebytes.com/blog/detections/malware-ai)**
>
> Malware.AI.(id-nr) are detection names produced by the Artificial Intelligence module in Malwarebytes 4 and Malwarebytes business products.
---
### Author:  [@ohrenkino](https://community.mp3tag.de/u/ohrenkino)
#### Post date: [June 1, 2024, 8:06am UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/2 "2024-06-01T08:06:15Z")
I just checked the 64-bit setup of 3.26 in [virustotal.com](http://virustotal.com) and got this result:
Which looks to me like: no problems.
Did you get the file from the official MP3tag download site?
> **[Mp3tag - Download](https://www.mp3tag.de/en/download.html)**
>
> Download Mp3tag, a powerful and easy-to-use tool to edit metadata of audio files
---
### Author:  [@Florian](https://community.mp3tag.de/u/Florian)
#### Post date: [June 1, 2024, 8:09am UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/3 "2024-06-01T08:09:51Z")
@ohrenkino the report is referring to the 32-bit version.
I've reported this as a potential false positive to Malwarebytes and hope they'll check and fix soon:
> **[mp3tagv326setup.exe detected as Malware.AI.4263474803](https://forums.malwarebytes.com/topic/312890-mp3tagv326setupexe-detected-as-malwareai4263474803/)**
>
> Hi, I'm Florian, developer of the Freeware tag editor Mp3tag. I'm getting reports from users that current Malwarebytes Pro 5.1.5.116 and current VirusTotal detect the 32-bit version of Mp3tag as Malware.AI.4263474803. The 64-bit version is not...
@daveo76 Thanks for reporting! It's most likely a false positive.
---
### Author:  [@LyricsLover](https://community.mp3tag.de/u/LyricsLover)
#### Post date: [June 1, 2024, 8:10am UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/4 "2024-06-01T08:10:51Z")
The chance/risk that a software is infected if only 1 (one!) of 73 antivirus checker detect "something" is extremely low:
It would be interesting what kind of AI this should be for Mp3tag 32bit?
---
### Author:  [@LyricsLover](https://community.mp3tag.de/u/LyricsLover)
#### Post date: [June 1, 2024, 9:12am UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/5 "2024-06-01T09:12:46Z")
The funny thing:
[Malwarebytes itself](https://www.malwarebytes.com/blog/detections/malware-ai) is using AI to (wrongly) detect AI in other software:
> **Malware.AI.(id-nr)** are detection names produced by the **A** rtificial **I** ntelligence module in Malwarebytes 4 and Malwarebytes business products. These generic malware detections are due to our new automated signature system called BytesTotal and DDS engine that are **based on Machine Learning technology with 100% autonomous learning which don’t require any human interaction to correctly identify malware**.
They should add a big red note that no AI is error free and this kind of detection can lead to even more unwanted false positives.
**Addendum:**
For those interested how the "MachineLearning" technology at Malwarebytes works:
> **[MachineLearning/Anomalous Detections and Explanation](https://forums.malwarebytes.com/topic/238670-machinelearninganomalous-detections-and-explanation/)**
>
> The post below gives some more insight into our MachineLearning detection. If the background info doesn't interest you and you (developer) want to know how to avoid FPs, please read the last section: False Positives Machine Learning Demystified:...
---
### Author:  [@Doug\_Mackie](https://community.mp3tag.de/u/Doug_Mackie)
#### Post date: [June 1, 2024, 3:10pm UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/6 "2024-06-01T15:10:57Z")
> [@daveo76](#):
>
> Malwarebytes and virustotal had discovered AI malware in 3.26.
False alarms from anti-virus software are extremely common. So a much better and more accurate title for your post might have been something like:
"Malwarebytes and Virustotal Report AI Malware in 3.26"
That would make it clear that this is only a report and **NOT** a confirmed fact. There is no need to alarm users of this forum unnecessarily.
---
### Author:  [@Florian](https://community.mp3tag.de/u/Florian)
#### Post date: [June 1, 2024, 5:04pm UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/8 "2024-06-01T17:04:07Z")
It's fixed now, confirmed to be a false positive, and I've adjusted the topic title accordingly (much in line with what @Doug_Mackie suggested),
Thanks all for patience and understanding.
---
### Author:  [@daveo76](https://community.mp3tag.de/u/daveo76)
#### Post date: [June 1, 2024, 9:13pm UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/9 "2024-06-01T21:13:26Z")
Sorry about the title I put up
---
### Author:  [@J6067](https://community.mp3tag.de/u/J6067)
#### Post date: [January 22, 2025, 12:43am UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/10 "2025-01-22T00:43:48Z")
It's back again, just got this on a Malwarebytes scan:
Malwarebytes
> **[Official Site | Malwarebytes: Antivirus, Anti-Malware & Privacy](https://www.malwarebytes.com)**
>
> Malwarebytes offers real-time antivirus, advanced anti-malware and privacy protection for all your devices. Launched in 2004 as a free virus scan, we still offer a free basic version 20 years later. Learn more.
-Log Details-
Scan Date: 1/22/2025
Scan Time: 9:33 AM
Log File: b551a269-d847-11ef-9b21-382c4abd2e03.json
-Software Information-
Version: 5.2.4.157
Components Version: 1.0.5116
Update Package Version: 1.0.94792
License: Premium
-System Information-
OS: Windows 10 (Build 19045.5371)
CPU: x64
File System: NTFS
User: System
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Scheduler
Result: Completed
Objects Scanned: 233149
Threats Detected: 1
Threats Quarantined: 0
Time Elapsed: 2 min, 27 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
File system: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
File: 1
Malware.AI.4294736855, C:\USERS\\DOWNLOADS\MP3TAGV322BSETUP.EXE, No Action By User, 1000000, -230441, 1.0.94792, E728B020F89CD123FFFC7BD7, dds, 03186484, EB6EF3268AEB3E34FA5AE147BC6C9542, C9480C892433A286B593E682A2D93A4E592A9A2C7F9FADA42C31E5A7D49719D3
---
### Author:  [@LyricsLover](https://community.mp3tag.de/u/LyricsLover)
#### Post date: [January 22, 2025, 7:03am UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/11 "2025-01-22T07:03:06Z")
> [@J6067](#):
>
> MP3TAGV322BSETUP.EXE
Did you really check the version MP3TAGV **322B** SETUP.EXE? This version was from 2023-08-24.
The current version of Mp3tag is [v3.2 **8** a](https://community.mp3tag.de/t/mp3tag-development-build-status/455)
---
### Author:  [@J6067](https://community.mp3tag.de/u/J6067)
#### Post date: [January 22, 2025, 8:02pm UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/12 "2025-01-22T20:02:36Z")
Thanks, I didn't check that, but that file has been sitting in the Downloads folder since I started using Mp3tag, Malwarebytes has never complained about it before.
I scanned it again today and Malwarebytes didn't detect it. Must have been a transient false positive.
---
### Author:  [@Florian](https://community.mp3tag.de/u/Florian)
#### Post date: [January 23, 2025, 8:35am UTC](https://community.mp3tag.de/t/false-positive-malwarebytes-and-virustotal-report-ai-malware-in-3-26/64907/13 "2025-01-23T08:35:12Z")