Report recurring Heuristic (Heur.Suspicious) detections here

[Guest]

[wasgij6]

TDSSKiller

[Chunli]

Hi,wasgij6 

Thank you for your submission.
We'll check this.

Best regards
Chunli.chen

[EddyM]

Hi there,

After recent virus scans I get this come up :

Heur.Gen.Lama[at]117023117

C:\WINDOWS\system\wuauclt.exe

I dont know where it came from but every time I try and clean it with both CIS and CCE it comes back again.

Any help would be greatfully recieved.

[FlorinG]

Hello EddyM,

Please submit the detected file as False Positive using the following link:

http://www.comodo.com/home/internet-security/submit.php

Thank you!

Best regards,
FlorinG

[ekerazha]

Yesterday I submitted a false positive (an Acer BIOS updater) using this page: http://www.comodo.com/home/internet-security/submit.php

It was a 1.10 BIOS updater for my laptop.

Hi,

This is to inform you that false-positive with <P4LJ0110.exe> (SHA1: <c714c977497729f1f6fcccda9c49c5d7d2003523>)
has been fixed.
You can update to AV database Version <12365> of  Comodo Internet Security
Version<5.10.228257.2253> and confirm it.

Thanks.

The false positive has been fixed.

However, I had the same issue with previous BIOS updater versions (the last one was version 1.07). That false positive was fixed too.

So today I've tried to download the 1.08 version of the BIOS updater (that I never downloaded before) and... false positive.

Would it be possible to fix this issue permanently instead of having to whitelist every single new executable everytime?

This is the false positive of the 1.08 version of the Acer BIOS updater for my laptop model: https://valkyrie.comodo.com/Result.html?sha1=38634e6d172c450d355dc041a48156a7fa09d0cf&&query=0&&filename=P4LJ0108.exe

It is detected as Suspicious[at]#3rskatay839t9

You can whitelist another Acer BIOS updater (so many other updaters will be erroneously detected) or try to understand why Acer BIOS updaters are always detected as malware. Acer download page: http://us.acer.com/ac/en/US/content/drivers

 

[Ravikant]

Hi ekerazha,



Thanks for reporting. We'll Check this.



Regards,
Ravikant

[meidan]

Hi ekerazha,

This is to inform you that reported false-positive has been fixed.
You can update to AV database Version <12367> of  Comodo Internet Security
Version<5.10.228257.2253> and confirm it.
Thanks.

Kind Regards,
Erik M.

[ekerazha]

The last false positive that I reported has been fixed too, BUT I've tried to randomly download another Acer BIOS updater and... false positive.

Please stop whitelisting every single BIOS updater executable and fix the problem at the root.

[Siketa]

RogueKiller
Suspicious[at]#2gl17rirpx45

http://tigzy.geekstogo.com/roguekiller.php

https://www.virustotal.com/file/b24eb2ff5854fd60549ac2ac2bb6e572c1db7bf955e0a05f651246499d2b9918/analysis/

[Srinivasan.G]

Hi Siketa,

Thanks for reporting. We'll Check this.


Regards,
Srinivasan.G

[FlorinG]

Hello Siketa,

This False Positive has been fixed. You can update to AV database Version 13977 of Comodo Internet Security Version 5.10.228257.2253 and confirm it.

Best regards,
FlorinG

[RejZoR]

I keep on getting Heur.Packed.Unknown[at]4294967295 on CounterStrike:Global Offensive game when it receives an update through Steam (during the Completing setup phase). The "trick" is that i only get it when i have heuristics set on Medium or High. I don't get any warnings with Low setting. However since heuristics seem to be much more refined now and i haven't got any false positives on any other files i'd like to keep on using High setting, but i still want to get it fixed for this specific game.

Can't submit the file since you can't extract a file from Quarantine to any location, but i have submitted it through quarantine to Comodo labs (filename and path C:\Windows\Temp\~757D.tmp). Hope this helps.

I'm using CIS 6.0.252829.2560, one of mods recommended i submit the report even though i'm using CIS 6 BETA...

[yosi501r]

vistart
2lwhfzphbv8hm
http://lee-soft.com/vistart/

[Chunli]

Hi,yosi501r

Thank you for reporting this.
We'll check it and get back to you soon.

Best regards
Chunli.chen

[Srinivasan.G]

Hi yosi501r ,

This is to inform you that false-positive has been fixed.
You can update to AV database Version <14252> of  Comodo Internet Security Version<5.12.256249.2599> and confirm it.

Regards,
Srinivasan.G

[Tags:]