Post here your unfixed FP's (only after 2 days)

[Guest]

[monkeytails]

Hi monkeytails,

Thanks for reporting,
FYI : evidence.boc is a backup file ,which BOClean takes before removing the file on detection.

That might not be a FP.

Thanks and Regards,
Suresh.

Checked BOClean logs and shows a detection of leaktest.exe.

If this a backup that BOClean creates (Am I understanding you correctly?), then the AV of CIS will always detect the backup file.  Again correct me if im wrong.

So should I delete this file or permanently exclude it or the folder from scaning...

regards

monkeytails

Edit:  have answered my question by looking at the BOClean on line help...will delete from computer.

Thanks for your help.

[wrapper]

HI,

I am posting this at the request of Experience.  My initial False Positive report is below, along with the message from Suresh that the problem was fixed.

On the morning of 03/17/09 I had to restore a backup to my laptop, and took the opportunity to install the latest CIS (3.8.65951.477, data base 1062) and BOClean 4.27.  Almost immediately, CIS showed 1 threat found, and it was the same ALCXSENS.SYS driver mentioned in my initial post, again as a Heur.Pck.tElock .  What was very strange was that after an hour or so, the summary screen shows no threats found, (down from 1 earlier) yet the Antivirus events log still shows the detection.

I don't know that it matters, but I am running XP Home SP3 on a Gateway laptop with an AMD Athlon 64 3400+ with 1 GB memory, and the CIS settings are all default.

Wrapper

Hi,

I had a problem with an earlier version of CIS saying "the virus database is not updated" and/or "the AV engine is not started," so I updated to the latest version 3.8.65951.477 db version 1039, heuristic scan set to "low," and started to scan the main drive and the "restoral" drive setup by Gateway yesterday, 3/09/09.  The Heur.Pck.tElock popped up several times, with different files, all of which had been on the PC for months to even years without incident.  I submitted the files to Virustotal, and they were all OK. What was very strange to me was that on the analysis of the alcxsens.sys driver (a Sensaura WDM 3D Audio Driver) showed that Comodo had no problem with the file, yet my installation flags it as an error.

I'll email this report as well.

Wrapper

Topic Summary
Posted on: March 10, 2009, 08:56:24 AMPosted by: sureshk 
Insert Quote
Hi wrapper,

FP has fixed.Please confirm with our latest Updated base.

Thanks for Reporting.

Thanks and Regards,
Suresh.
 

[Sriram P]

Hello,


Suspect False Positive
File Name: HP_Demo.exe
Identified as: Heur.Pck.MoleBox
Reported: March 3,2009 by EMAIL
Present  database version 1090

Ralph
   

Hi oldCoCo3user,
Can you please send the suspected file to us. Please visit this link on https://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/how_to_report_false_positivessuspicious_files_how_to_submit_them-t36051.0.html
to know more on submission of files.

Regards,
Sriram.P

[Sriram P]

Hi oldCoCo3user,
Can you please send the suspected file to us. Please visit this link on https://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/how_to_report_false_positivessuspicious_files_how_to_submit_them-t36051.0.html
to know more on submission of files.

Regards,
Sriram.P

Hi oldCoCo3user,

Thank you for submitting the file. The reported False Positive has been fixed.

Regards,
Sriram.P

[rabrown]

I reported archlp.dll as an FP during the weekend.  It is part of Arcsoft's Total Media Theater installation.  Copy of the file was submitted through CIS RC 2.  Not yet fixed in ver 1154.    Identified as unclassified malware[at]14955904.

Richard

[Sriram P]

I reported archlp.dll as an FP during the weekend.  It is part of Arcsoft's Total Media Theater installation.  Copy of the file was submitted through CIS RC 2.  Not yet fixed in ver 1154.    Identified as unclassified malware[at]14955904.

Richard

Hi rabrown,

The reported FP has been fixed. Please update your AV to base v1157 and check on it.

Thanks and Regards,
Sriram.P

[rabrown]

Hi Sriram.P,

Thanks.  It is no longer being identified as malware.

Richard

[Lasse88]

These are still not fixed.

C:\WINDOWS\system32\nmfast50.bpl 
C:\WINDOWS\system32\vcldbx50.bpl

https://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/11_false_positives-t39265.0.html;msg284699#msg284699

Database: 1172

please write here, or in my post when it's fixed, or been read.

[gmohan]

Hi Lasse88,

These are still not fixed.

C:\WINDOWS\system32\nmfast50.bpl 
C:\WINDOWS\system32\vcldbx50.bpl

https://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/11_false_positives-t39265.0.html;msg284699#msg284699

Database: 1172

please write here, or in my post when it's fixed, or been read.

The mentioned FP will be fixed in subsequent updates.

Regards
-Chandra Mohan

[Sriram P]

These are still not fixed.

C:\WINDOWS\system32\nmfast50.bpl 
C:\WINDOWS\system32\vcldbx50.bpl

https://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/11_false_positives-t39265.0.html;msg284699#msg284699

Database: 1172

please write here, or in my post when it's fixed, or been read.

Hi Lasse88,

The reported False positives were identified and Fixed. Please update your Antivirus to 1174 and confirm the fix.

Thanks and Regards,
Sriram.P

[disPPlay]

http://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/fp_unclassified_malwareat17324961-t39594.0.html

it's yet unfixed

[Lasse88]

Hi Lasse88,

The reported False positives were identified and Fixed. Please update your Antivirus to 1174 and confirm the fix.

Thanks and Regards,
Sriram.P

confirmed 

[gmohan]

Hi DiSP,

http://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/fp_unclassified_malwareat17324961-t39594.0.html

it's yet unfixed

Mentioned FP will be fixed in next updates

Regards,
-Chandra Mohan

[Sriram P]

http://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/fp_unclassified_malwareat17324961-t39594.0.html

it's yet unfixed

Hi DiSP,

We have fixed the reported false positive. Please refer to your post for more information on the fix.

Thanks and regards,
Sriram.P

[patrice58]

Heur.Suspicious[at]19750095 location X:\Downloads\H\WD_Windows_Tools\Google\Desktop\ESN\setup.exe.downloading

Tested with database 1203

Original forum post https://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/maybe_a_fp-t40073.0.html

[Tags:]