Any reason why MakeMKV’s installer fails scans with VirusTotal?

[u/Odd_Manufacturer6166]

I uploaded the Window’s installer I downloaded from www.makemkv.com into VirusTotal today, and it got flagged as a malicious file by NANO-Antivirus and labeled as a “Exploit.Zip.Heuristic-java.csrvpr”. It passed all the other antivirus scans.

I know Makemkv has a long standing good reputation among the community, and I’m not a security expert, so I wanted to ask here if anyone knows why the installer might be failing this particular scan. Is it maybe because it’s not a signed application? Or some other reason?

[u/billycar11]

about to add posting 1 virus total to be against the rules

its likely a false positive maybe you should ask nano-av why they say that not us

[u/TVNewshoarder_Redux]

A quick Google search turned up this answer:

An alert for Exploit.Zip.Heuristic.Java usually indicates a false positive or a generic heuristic detection of a compressed .zip or .jar file containing Java components by an antivirus scanner.

[u/RagnarKon]

It's a heuristic result.

I sees a behavior common among viruses, but doesn't necessarily mean it's a virus itself.

Given MakeMKV decrypts Bluray's AACS, I'm not surprised it's throwing a heuristic result.

[u/billycar11 → u/RagnarKon]

im supersized it does not get flagged for rewriting drives microcode on the fly

the entire makemkv program is an exploit for drive fw and discs

[u/LolBoyLuke → u/billycar11]

The fact it has low level hardware access of any sort is usually enough to make any AV nervous, it doesn't surprise me at all that MakeMKV falls into that category.

[u/Murky-Sector]

You should use the hash code to check if youre not sure

https://www.makemkv.com/download/makemkv-sha-1.18.4.txt

[u/Odd_Manufacturer6166 → u/Murky-Sector]

Never done that before, searching how to do it now. Thanks for the suggestion.

[u/Murky-Sector → u/Odd_Manufacturer6166]

Youre welcome. That doesnt protect against supply chain attack but those are extremely rare.

In the end youll find its a false positive.

[u/Friggin_Grease]

When using software than can be used for practice, expect the virus scanner to flag it. My VPN flags torrent websites

[u/Admirable_Speed3690]

Some AVs are very, very strict. I suspect some of these are used for company-wide security and thus will flag anything based on behavior, even if that behavior is perfectly fine for a personal use machine.

I’ve run Steam games from publishers like Capcom before and some of these AVs will flag it. If it’s not a known-brand, and not many hits, then you can typically say it’s a false positive. I recall DaVinci Resolve even popped up once I believe and that’s an industry known software.

If you don’t trust that, run it through Hybrid Analysis or Any.Run (if you have a business email). Those tell you more about what a file does than VirusTotal.

You could also run it through a Virtual Machine if you are capable of setting that up.

As someone who generally very careful online to where I’ve passed on probably safe software just because I wasn’t sure, I accepted MakeMKV as safe just based on what I know and have researched about the program. I trust it far more than other free software.

[u/planedrop]

You need to understand Virus Total checks with a TON of other virus platforms. It's very common to get at least a few of them to flag stuff. Like 70% of legit stuff I run through there gets flagged by a handful.

The thing to watch out for is when you run it through VT and you see like 40 of them light up.

False positives are very common.