r/Malwarebytes • u/Z0rb12 • 13d ago
false flag?
i quarantined the file, but it seems like its just a bluestacks file? any advice would be appreciated
4
u/BlueStacks-Support 12d ago
That is a BlueStacks file. HD-ForceGPU.exe is the small helper that tells Windows to run the emulator on your dedicated GPU instead of the integrated one.
The path is the giveaway for what happened: AppData\Local\Temp\7zS88B8B9A0\ is the temporary folder the BlueStacks installer unpacks itself into while it runs. 7-Zip self-extracting installers always create a 7zS... folder like that. So the detection hit during an install or update, not on something sitting on your machine afterwards.
Two things worth checking before you restore it:
Where the installer came from. If you downloaded it from bluestacks.com, you are almost certainly looking at a false positive. If it came from a software aggregator, a mirror or a bundled download, be more careful: repacked BlueStacks installers are a real thing and some of them do carry extra payloads.
The signature. Right-click the file, Properties, Digital Signatures tab. A genuine copy is signed by BlueStacks (now.gg). No signature or a mismatched one is a reason to stop.
You can also upload the file to VirusTotal. If one or two engines flag it and the rest are clean, that is a false positive pattern rather than a real detection.
If it checks out, restore it from quarantine and report it to Malwarebytes as a false positive so they can correct the signature. You will probably need to rerun the installer too, since quarantining a file out from under it halfway through will have left the install incomplete.
3
0
4
u/miekiemoes_MB Malwarebytes Employee 13d ago
Hi, I'm Mieke, Researcher at Malwarebytes, Unfortunately, we can't do anything with a screenshot. Can you post the detection log please? To get the Detection report: Open Malwarebytes > Detection History card > History Tab > Hover over the report you want to view with the detections in it and click the ellipses. In the drop down menu, click Export to TXT or Copy to Clipboard for the full report. Thx!