How safe is ePSXe?

Question

For the last few weeks, my roommate dove back into his childhood by playing his old PS1 games with an emulator I set up for him : ePSXe 2.0.5 for Windows.

A few days ago, he came back to me saying that the software "disappeared". I checked and noticed that the antivirus on his laptop (Avast) raised an alert and quarantined the main .exe.

As the software is quite popular and I don't know what my roommate does with his laptop, I bet on 2 options :

• False-positive
• Corruption from an actual malware

I then did the following :

1. Checked online if there was any information about this. Turned out that some other people had a similar issue on previous versions, but it mostly led to heated debates with no useful information.
2. Temporarily removed the exe from quarantine, and re-scanned it with Avast : no threat detected.
3. Scanned it with Virustotal (first time I use it) : 2 antiviruses out of 66 detect a (different) threat. In the comments, a user notices that "sub exe" are detected as malicious, but I don't really know what that means (in the Relationship tab, it more likely seems that malicious packages can contain this exe but I'm no specialist).
4. Deleted the whole ePSXe folder and redownloaded it from the official website (as I did the first time) : http://www.epsxe.com/download.php
5. Re-scanned it with Avast : no threat detected.
6. Re-scanned it with Virustotal : 2 antiviruses out of 66 detect a (different) threat. (same as before)

Which leads to my question :

Regarding these information, can the official release of ePSXe 2.0.5 be regarded as safe or malicious, and why ?

And any thought on this additional question will be appreciated :

What is the most reliable way to ensure that a software is safe or malicious ?

Thank you for your help !

Answer 1

It's almost certainly a false positive. I would suspect that the false positive occurred because the ePSXe engine works by JIT transpiling the MIPS R3000 instructions into x86 instructions, and many "realtime protection" heuristics involve looking for common shellcode patterns being injected into writeable and executable memory. All it takes is an unfortunate sequence of instructions to trip a heuristic.

On a more anecdotal level, ePSXe has been around for nearly two decades. I remember using it way back in the days when desktops had under a gigabyte of RAM. Unless there has been some sort of corporate buyout (which I can't see any evidence of) I'd say that it's as trustworthy as it ever was.