t0adphr0g Posted August 19, 2011 Share Posted August 19, 2011 I woke up this morning to see a popup message from Malwarebyte's Anti Malware.the log:07:36:17 t0adphr0g DETECTION E:\GameEx\Mame Mapping Magician.exe Trojan.Backdoorthe scan pic:Should I be worried, or is this a false positive? Link to comment Share on other sites More sharing options...
Draco1962 Posted August 19, 2011 Share Posted August 19, 2011 Good morning! I would not be concerned about it and would ignore the warning. Mame Mapping Magician.exe is a compiled script that comes as part of the GameEx package. It is not uncommon for programs such as these to throw a "false positive" with anti-malware/anti-virus programs. Link to comment Share on other sites More sharing options...
headkaze Posted August 19, 2011 Share Posted August 19, 2011 It's detecting a signature of an AHK script. You can view the source code for it in the GameEx folder (Mame Mapping Magician 1.0.ahk). False alarm. Link to comment Share on other sites More sharing options...
Adultery Posted August 19, 2011 Share Posted August 19, 2011 Wonder why my MBAM doesn't pick it up? Link to comment Share on other sites More sharing options...
mesk Posted August 19, 2011 Share Posted August 19, 2011 Wonder why my MBAM doesn't pick it up?He could have the detection levels set higher then you Link to comment Share on other sites More sharing options...
Tom Speirs Posted August 19, 2011 Share Posted August 19, 2011 Its almost certainly a false positive. Im surprised anything picks such things up as a virus these days. I know sometimes exes packed with UPX are sometimes falsely detected but I thought I had recompiled it without UPX because of that. Could be wrong though. Link to comment Share on other sites More sharing options...
Adultery Posted August 19, 2011 Share Posted August 19, 2011 Actually there are a couple false positives I get on my machine that my AV software blocks. Most notably certain Future Pinball tables and iRotate. You can set them to 'ignore' though. Not a big deal so long as you trust the source. Link to comment Share on other sites More sharing options...
simbamame Posted August 20, 2011 Share Posted August 20, 2011 Actually there are a couple false positives I get on my machine that my AV software blocks. Most notably certain Future Pinball tables and iRotate. You can set them to 'ignore' though. Not a big deal so long as you trust the source.Same here for FP Tables but mine is also set to ignor, as you say if you trust the source and for GameEx stuff i do Link to comment Share on other sites More sharing options...
headkaze Posted August 20, 2011 Share Posted August 20, 2011 Its almost certainly a false positive. Im surprised anything picks such things up as a virus these days. I know sometimes exes packed with UPX are sometimes falsely detected but I thought I had recompiled it without UPX because of that. Could be wrong though.I forgot that compiling an AutoHotkey script will UPX it. I checked the Mame Mapping Magician 1.0.exe and it's still UPX'ed (you can tell in the first 100 bytes or so in a Hex editor looking for "UPX"). Anyway you might want to decrypt it for the next release. Link to comment Share on other sites More sharing options...
Recommended Posts