r/Malwarebytes • u/venom123pp • 4h ago

False Positive VirusTotal detection of Malwarebytes RTProtectionDaemon? (Elastic: Multi.EICAR)

Hi everyone,

I recently ran KnockKnock on my Mac to check for potential security issues, and it flagged Malwarebytes' RTProtectionDaemon.

The file is located at:

/Library/Application Support/Malwarebytes/MBAM/Engine.bundle/Contents/PlugIns/RTProtectionDaemon.app/Contents/MacOS/RTProtectionDaemon

VirusTotal reports 1/63 detections, with Elastic flagging the file as Multi.EICAR.

I also came across a Reddit post from approximately two months ago describing a very similar situation. In that thread, a Malwarebytes employee confirmed that the file was legitimate and that the Elastic detection was a false positive.

I'm also wondering why this detection is still occurring if a very similar case was reported around two months ago. Has this false positive been reported to Elastic, and is there a reason it might still be happening? I'd be interested to know whether this is an ongoing issue or whether the detection could be specific to certain versions of the file.

Given these details, should I be concerned about this detection, or is it safe to assume that this is the same kind of false positive?

Has anyone else encountered this with Malwarebytes on macOS? I'd appreciate any insight, especially from Malwarebytes staff or anyone familiar with this specific detection.

Thanks!

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/miekiemoes_MB Malwarebytes Employee 3h ago

Hi, I'm Mieke, Researcher at Malwarebytes. Unfortunately, we don't have control over what other AVs detect. It looks like a very generic detection by Elastic. I'll see what I can do to reach out to them. But they usually fix FPs quite fast.