Welcome, Guest. Please login or register.
November 27, 2009, 07:44:18 AM

Login with username, password and session length

338039 Posts
37412 Topics
84871 Members

Latest Member: Glentop

Search:     Advanced search | Tag Cloud
+  Welcome to the Comodo Forum
|-+  Desktop Security Products
| |-+  Comodo Internet Security - CIS
| | |-+  Bug Report - CIS
| | | |-+  False Positive/Negative reporting - (Is this a malware that CIS has/not detected?)
| | | | |-+  UTDCv21.dll
« previous next »
Pages: [1] Go Down Print
Author Topic: UTDCv21.dll  (Read 243 times)
goldstriker
Newbie
*
Offline Offline

Posts: 8


« on: November 14, 2009, 11:59:11 AM »

CIS Full
Virus Signature Database Version: 2955

Program:
UnrealTournament.exe (Unreal Tournament GOTY Edition, also known as UT99)

File or cause:
UTDCv21.dll
and/or
UTDCv21.u

Explanation:
On certain UT game servers you need to download a file that checks your computer for possible cheats. It goes like this:
  • You enter the server. The server sees you don't have the file installed. You automatically disconnect and a pop-up tells you to install UTDC. You press "install", the game closes and it's installed.

    You restart the game, enter the server again and then Comodo activates (see the screenshot below).

  • Next thing I did is check the box for "skip this application in the future" and press the "skip" button. I hear my harddrive working hard for a couple seconds and then it stops. After that it's all okay. (funny that the pop-up uses the word 'overflow', as it seems my harddisk seems to be very very busy during those few seconds)
So, my question is, is this a false positive? I doubt that it even falls in the 'virus'-category, as it's not an executable.


Comodo Instant Malware Analysis says that the 'process: failed'.
UTDCv21.dll:
http://camas.comodo.com/cgi-bin/submit?file=88a4e8cf48ae59ed6314f1f439340347ee2a6fbee0d864da6b37394d17d5067f

UTDCv21.u
http://camas.comodo.com/cgi-bin/submit?file=e061a0daf83457164a9bde87dadad11d118206c2d6f8676308433bf472c2c045
« Last Edit: November 14, 2009, 12:01:08 PM by goldstriker » Logged
meidan
Malware Research Group
Comodo Family Member
*****
Offline Offline

Posts: 94



« Reply #1 on: November 14, 2009, 12:01:56 PM »

CIS Full
Virus Signature Database Version: 2955

Program:
UnrealTournament.exe (Unreal Tournament GOTY Edition, also known as UT99)

File or cause:
UTDCv21.dll
and/or
UTDCv21.u

Explanation:
On certain UT game servers you need to download a file that checks your computer for possible cheats. It goes like this:
  • You enter the server. The server sees you don't have the file installed. You automatically disconnect and a pop-up tells you to install UTDC. You press "install", the game closes and it's installed.

    You restart the game, enter the server again and then Comodo activates (see the screenshot below).

  • Next thing I did is check the box for "skip this application in the future" and press the "skip" button. I hear my harddrive working hard for a couple seconds and then it stops. After that it's all okay. (funny that the pop-up uses the word 'overflow', as it seems my harddisk seems to be very very busy during those few seconds)
So, my question is, is this a false positive? I doubt that it even falls in the 'virus'-category, as it's not an executable.


Comodo Instant Malware Analysis says that the 'process: failed'.
UTDCv21.dll:
http://camas.comodo.com/cgi-bin/submit?file=88a4e8cf48ae59ed6314f1f439340347ee2a6fbee0d864da6b37394d17d5067f

UTDCv21.u
http://camas.comodo.com/cgi-bin/submit?file=e061a0daf83457164a9bde87dadad11d118206c2d6f8676308433bf472c2c045

Hi,

We will check if what you reported is malware or just false positive.

Thanks,
Erik M.
Logged
goldstriker
Newbie
*
Offline Offline

Posts: 8


« Reply #2 on: November 14, 2009, 12:03:36 PM »

Do I need to upload the files somewhere? Or can you get the from the camas.comodo.com link?
Logged
meidan
Malware Research Group
Comodo Family Member
*****
Offline Offline

Posts: 94



« Reply #3 on: November 14, 2009, 12:51:01 PM »

Do I need to upload the files somewhere? Or can you get the from the camas.comodo.com link?
Thanks. Files are in process already. So you don't need to upload it.

Thanks again.
Logged
meidan
Malware Research Group
Comodo Family Member
*****
Offline Offline

Posts: 94



« Reply #4 on: November 14, 2009, 03:02:03 PM »

Hi,
This is to inform you that we have scanned files with latest antivirus database version of Comodo Internet Security and have not found this file being detected.
Please check again.

Thanks
Comodo AntiVirus Lab
Logged
Tags:
Pages: [1] Go Up Print 
« previous next »
Jump to:  

SSL Certificate Free Virus Removal Firewall
Page created in 0.035 seconds with 18 queries.
Powered by SMF 1.1.10 | SMF © 2006, Simple Machines LLC
Seo4Smf v0.2 © Webmaster's Talks
Design by 7dana.com