Malwarebytes flagged & quarantined an Excalibur file (Windows)

nicklear

Description

Malwarebytes flagged & quarantined a file as per report below.

Protection Event Date: 30/03/2021
Protection Event Time: 13:21
Log File: 1c7b400a-914a-11eb-ba13-000000000000.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1217
Update Package Version: 1.0.38892
Licence: Premium

-System Information-
OS: Windows 10 (Build 19042.867)
CPU: x64
File System: NTFS
User: System

-Blocked Malware Details-
File: 1
Generic.Malware/Suspicious, C:\Users\Nick\AppData\Roaming\Adobe\CEP\extensions\knights_of_the_editing_table.excalibur\client\lib\exec\spellcast_win.exe, Quarantined, 0, 392686, 1.0.38892, , shuriken, , 6E010F88AD0871319C19C150CF8B815F, 13ECA8253882CDC5B9B2A581DC684294CA823F8DC5B111BAE8F1C03894A1B761

Possible Fix

I restored the file and restarted Premiere. This fixed it. I am ASSUMING this is a false positive and not an infected file.

Steps to Reproduce

Unlikely you can easily reproduce.

Your Environment

Windows 10. Prem 14.9. Exc 1.1.0

nicklear

I have now found this is documented in the help

https://manuscript.knightsoftheeditingtable.com/extensions/excalibur/compatibility/windows-antivirus

Though the filename there is different from the one I need to whitelist

Help file

C:/Users/*username*/AppData/Roaming/Adobe/CEP/Extensions/Spellbook/client/lib/spell_win.exe

My file

C:\Users\Nick\AppData\Roaming\Adobe\CEP\extensions\knights_of_the_editing_table.excalibur\client\lib\exec\spellcast_win.exe

I did also find this file on my PC

C:\Users\Nick\AppData\Roaming\Adobe\CEP\extensions\knights_of_the_editing_table.spellbook\client\lib\spell_win.exe

For now I will whitelist them both

Sir_Ivan

nicklear Oh spellcast_win.exe now also considered a malware?
To clarify:

spell_win is responsible for detecting shortcut press. It is essential for calling up search bar and executing any command that has shortcut assigned.
spellcast_win is responsible for simulating shortcut press. This one needed for "Keyboard Shortcut", "Apply Transition", "Timecode" commands.

They are perfectly safe.
I'll update manuscript. Thank you!

hellvice

I got bitdefender flagging it hard with a trojan infection.
I'm not comfortable with this infection.
What's up with that ?

Sir_Ivan

hellvice
You need to ignore antivirus warning. I know that doesn’t sound reassuring, but here is an explanation:
Antivirus will think of an installer file as a malware, because it has instructions to install files in your user directory, specifically to CEP/extensions folder, which is considered not good in its opinion. This is where all extensions for Adobe software reside.
I don’t know yet how to defend my installer files on Windows from a malware curse mark (same comes to executables used by Excalibur itself).
Installer file is needed to make installation process simple for a user. If you don’t feel safe using it, I can send you unpacked extension and you will put it manually to proper directory.