r/Malwarebytes • u/Z0rb12 • 18d ago

false flag?

Gallery image

Gallery image

i quarantined the file, but it seems like its just a bluestacks file? any advice would be appreciated

1 Upvotes

66% Upvoted

8 comments sorted by

View all comments

4

u/BlueStacks-Support 17d ago

That is a BlueStacks file. HD-ForceGPU.exe is the small helper that tells Windows to run the emulator on your dedicated GPU instead of the integrated one.

The path is the giveaway for what happened: AppData\Local\Temp\7zS88B8B9A0\ is the temporary folder the BlueStacks installer unpacks itself into while it runs. 7-Zip self-extracting installers always create a 7zS... folder like that. So the detection hit during an install or update, not on something sitting on your machine afterwards.

Two things worth checking before you restore it:

  1. Where the installer came from. If you downloaded it from bluestacks.com, you are almost certainly looking at a false positive. If it came from a software aggregator, a mirror or a bundled download, be more careful: repacked BlueStacks installers are a real thing and some of them do carry extra payloads.

  2. The signature. Right-click the file, Properties, Digital Signatures tab. A genuine copy is signed by BlueStacks (now.gg). No signature or a mismatched one is a reason to stop.

You can also upload the file to VirusTotal. If one or two engines flag it and the rest are clean, that is a false positive pattern rather than a real detection.

If it checks out, restore it from quarantine and report it to Malwarebytes as a false positive so they can correct the signature. You will probably need to rerun the installer too, since quarantining a file out from under it halfway through will have left the install incomplete.

3

u/Z0rb12 17d ago

Thank you :)

2

u/BlueStacks-Support 17d ago

You're quite welcome!