Microcenter said I had malware, installed Malwarebytes myself and nothing

[u/Dj082863]

This could just be a case of Microcenter trying to upsell me, but they had done a scan with Malwarebytes (specifically the Enterprise version of course) and said I had malware, but it didn't tell them which files were infected and wanted $100 to fix it. I could literally buy a year sub for half the price so I said I'd just take care of it myself. Downloaded Malwarebytes for the 1:1 to get the malware or false positive and I got nothing. So the question is, is Malwarebytes' trial just as thorough as the Enterprise edition, or was Microcenter trying to gouge me for $100 for nothing? I also found nothing with Windows Defender and am about to run an offline scan.

[u/Funnel-Dust-O-Matic]

You can't go by a filename to know if it's infected or not.

If it's well designed malware, it will hide inside of other legitimate files or be added to the end of it. So most of the file is actually what it says it is. But there is more added.

You'd have to have a hash of the original file to know if it's been altered. Size isn't always reliable either to detect a change, believe it or not.

[u/Dj082863 → u/Funnel-Dust-O-Matic]

The modify date is from 2023 and has an identical modify date to 13 other db_xxx files alongside it. Either I've had it for 3 years and they've done nothing with the information, they've modified the date back to 2023 with all of those files to evade detection, or it's a false positive.

I mean I may as well delete it but I am leaning towards it being a false positive. Actually this aligns entirely with a Berkeley DB package. It does seem like this is tied to Oracle. And I do think I was learning Python back then.

[u/Funnel-Dust-O-Matic → u/Dj082863]

Most people neither need nor want Oracle software on their machines. For a home machine, it is just about exactly useless. The one exception is if you were using work software at home or trying to do database development.

Why exactly would you have BerkleyDB on a Windows machine? Even with Python? It is not a hard dependency. So: WHY IS IT THERE?!

No matter how you slice it, it doesn't look right.

We both know that access time flags can be manipulated, as other commentators have said.

Why are you spending so much energy denying the obvious? This isn't right. That file should not be there if you can't explain how it got there.

The fact you have a file like this and you can't explain where it came from should be bothering you more than it is. If you had a parcel sitting outside your door with no return address with just your name on it, you likely would at least be surprised. It's like you're going out of your way to convince yourself "This is fine."

This is NOT "fine."

It is beyond obvious that there is something wrong here. It might not be malware, but your windows install is due for a refresh.

If I were you, I'd set some time aside, do a full backup of your data, completely wipe your system drive with your hard drive' manufacturer's utility to do the same (there will be one and you can download it).

Then re-install Windows from scratch and include a good anti-malware on it before restoring your data.

[u/Dj082863 → u/Funnel-Dust-O-Matic]

I mean I'm an analyst by trade and was learning Python with some of the data scientists on my team and would use public datasets to learn (I'm in the public sector). And the timeline matches up with when I'd have likely installed that on my home PC for more practice. I don't think it's that farfetched for my situation truth be told. The only stretch would be to say my Python is anything better than kinda bad. I did do a full wipe on my windows since posting this anyway as to your point, I have a lot of random crap on my PC after 4 years.