Report trusted and whitelisted malwares here! [Don't attach Live Malware !!]

[Guest]

[salaficall]

Hello everybody

There is no doubt that Comodo's whitelist is superior and it makes CIS more user friendly.

But some malwares could sometimes get a trusted signed certificate! or accidentally get whitelisted!.

We must fight that by all means!.

So I thought it will be useful to open a new topic and report these trusted! malwares in it.

If you find files that are whitelisted, but seem suspicious (for whatever reason) please report it here asap.

just upload the malware to camas.Comodo.com and virustotal.com , and post both result links here. , the name of the trusted vendor or any other info could be useful too.

Please Don't attach or link for a live Malware !!

regards

[Luc[y]]

Wrong section imo.

[salaficall]

crash_icons[1].exe

it's a trojan in the wihtelist


http://camas.comodo.com/cgi-bin/submit?file=a02df23e81d3e708a511020c01a62fc8457c4738df77cabddf92f42c6e1b8df9


http://www.virustotal.com/file-scan/report.html?id=a02df23e81d3e708a511020c01a62fc8457c4738df77cabddf92f42c6e1b8df9-1293744488

[Siketa]

Guys, can you check this one?

http://camas.comodo.com/cgi-bin/submit?file=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30

http://www.virustotal.com/file-scan/report.html?id=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30-1293752665

The file is signed by Shanghai Emoney Software Technology Company Ltd.

[salaficall]

and this one is suspicious by CAMAS and whitelisted by CIS 5 !

http://camas.Comodo.com/cgi-bin/submit?file=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30


http://www.virustotal.com/file-scan/report.html?id=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30-1293754039

[HeffeD]

What's wrong with the normal method of reporting?

AV False Positive/Negative Detection Reporting

[salaficall]

What's wrong with the normal method of reporting?

AV False Positive/Negative Detection Reporting

As you wish , but I thought that this is not a normal negative detection , as they are trusted signed or whitelisted malwares and they can easily and completely bypass comodo security layers. Not like the unknown malwares.

Anyway , I hope that these bypasses get fixed asap.

thanks

[salaficall]

Guys, can you check this one?

http://camas.Comodo.com/cgi-bin/submit?file=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30

http://www.virustotal.com/file-scan/report.html?id=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30-1293752665

The file is signed by Shanghai Emoney Software Technology Company Ltd.

Hello siketa

this one is the same that I reported after your post ! , but it's not signed at my end , it's only wihtelisted.

[mengze.lin]

crash_icons[1].exe

it's a trojan in the wihtelist


http://camas.Comodo.com/cgi-bin/submit?file=a02df23e81d3e708a511020c01a62fc8457c4738df77cabddf92f42c6e1b8df9


http://www.virustotal.com/file-scan/report.html?id=a02df23e81d3e708a511020c01a62fc8457c4738df77cabddf92f42c6e1b8df9-1293744488

Hi salaficall,
We are going to have a look at it and will get back to you after investigation.
Thanks and Regards,
Lin mengze

[mengze.lin]

and this one is suspicious by CAMAS and whitelisted by CIS 5 !

http://camas.Comodo.com/cgi-bin/submit?file=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30


http://www.virustotal.com/file-scan/report.html?id=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30-1293754039

Hi salaficall,
We are going to have a look at it and will get back to you after investigation.
Thanks and Regards,
Lin mengze

[mengze.lin]

Guys, can you check this one?

http://camas.Comodo.com/cgi-bin/submit?file=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30

http://www.virustotal.com/file-scan/report.html?id=89f776398451f81f9859384c4a65a1a82875c855faf9ac7b2e2fd4bbda7f3b30-1293752665

The file is signed by Shanghai Emoney Software Technology Company Ltd.

Hi siketa,
We are going to have a look at it and will get back to you after investigation.
Thanks and Regards,
Lin mengze

[mengze.lin]

crash_icons[1].exe

it's a trojan in the wihtelist


http://camas.Comodo.com/cgi-bin/submit?file=a02df23e81d3e708a511020c01a62fc8457c4738df77cabddf92f42c6e1b8df9


http://www.virustotal.com/file-scan/report.html?id=a02df23e81d3e708a511020c01a62fc8457c4738df77cabddf92f42c6e1b8df9-1293744488

Hi salaficall
This file is not malware.

Thanks and Regards,
Lin mengze

[salaficall]

Hi salaficall
This file is not malware.

Thanks and Regards,
Lin mengze

Hi mengze.lin

So is it a False positive from 7 Av's results ?

[Luc[y]]

[at] salaficall -> http://forums.comodo.com/empty-t65308.0.html

[salaficall]

Hi salaficall
This file is not malware.

Thanks and Regards,
Lin mengze

It's an adware , and It creates a malicious service Application Updater!.

Name: Adware.Win32.3D Crash Icons

Risklevel: Low Risk

Company: 3D Desktop, Ltd - http://3d-icons.com/

Description:

3D Crash Icons is an adware that uses aggressive, deceptive advertising. It shows deceptive and/or false messages. It may be installed without adequate notice and consent, often though exploits.

and check these links please

http://www.emsisoft.com/en/malware/Adware.Win32.3D_Crash_Icons-remove.aspx

http://comprolive.com/remove/unwanted/app/dealio-toolbar

http://www.spywareterminator.com/item/3347/3D-Crash-Icons.html

http://www.threatexpert.com/report.aspx?md5=2c87ce8e67fedbad1d422290ed7f3df5

regards

[Tags:]