Web Based AV Scanner from Comodo

[Guest]

[leey]

To Liron Jan,
hello, could you give me some details about system environment, etc. thanks,
mybox:leey[at]comodo.com

[Star Shadow]

Okay, to be fair, I only scanned C:\ instead of all drives or choosing a single folder, but at least you will be happy to know that scanning C:\ works flawlessly on Vista x64. Though, I think some people may need to run IE in an elevated state for it to work right. That is what I did. The plugin installed perfectly that way with no hassles and the scanning had full access to the system since it was elevated.

Another great product. Now we can wet our whistles for CAVS3 until it is released. Then the full offline version gets installed on my PC and my girlfriend's.

[Japo]

Though, I think some people may need to run IE in an elevated state for it to work right. That is what I did.

You need of course admin rights to install the scanner in your computer during the first use. After that you can scan with limited rights.

I've just checked and it also needs admin rights to update, it must store the virus definitions outside a limited user's reach.

[Urbane.Tiger]

Scanned all drives, same trojan in 2 files, both setup files, one for Avira AntiVir the other for Microsoft .NET 3.5 Enhancements Training Package.

Scanned with AntiVir, AVG, AdAware, SAS, MB's AM and Defender - none had anything to say about either file.

Can't give name of parasite because I inadvertantly shut down IE8.  Cannot do another scan. "Start FREE Virus Scan" does not operate (box is ticked), deleted IE's cookies, history, cache etc, also tried IE7 mode.  Suggest option to save results to text file.

Anyway whatever it was I think it was a false positive - can send files of you're interested, just tell me where to send.

IE problem was hidden instances running.  Not sure if Comodo stuff did that or IE8 misbehave.  Anyway parasite reported as being in those two file was. TrojWare, Win32, Trojan Dropper.Agent.WAB.  am still assumimng false positive

[RealLife]

Three problems:

• It doesn't work with Firefox.  This is huge, since the very reason many of us are using Comodo products in the first place is that we do NOT trust Micro$oft products.  Thus, we also use Firefox, Opera, Safari, et al.  Please do not pander to the uneducated masses: make the web-based scanner work with platforms that the users will trust.
• Actually, judging from the link, etc., it would appear that the web-based scanner is no different from the scanner that is built into the Comodo Firewall.  If that is the case, please say it is, so we may know just to scan from CFP rather than having to run Internet Explorer needlessly.
  
• The page doesn't have the "trustlogo" that is on all the other Comodo pages, making it seem one has been redirected to a fake site.

Thanks!

[Liron Jan]

Hello Melih or Leey.
I re-scaned my computer to see if there are news with the FPs. Only Win RAR is now FP (or it's really a virus  ).
The scanner still stucks in some files, now, it's a doc file as you can see in the screenshot.

[JamesFrance]

Hello Melih or Leey.
I re-scaned my computer to see if there are news with the FPs.

I did the same, yesterday my wextract.exe was still shown but it has now gone.

[Star Shadow]

Hello Melih or Leey.
I re-scaned my computer to see if there are news with the FPs. Only Win RAR is now FP (or it's really a virus  ).
The scanner still stucks in some files, now, it's a doc file as you can see in the screenshot.

just to be on the safe side, download the trial version from the rar labs website (direct link: http://www.rarlab.com/rar/wrar371.exe ). Then right-click on that .exe and extract the files, do not install! Next point the online scanner to that directory and see if shows the same results. If not, then your copy has got infected.

[Japo]

It also hit a presumably false positive in the default.sfx of my WinRAR. It wasn't the only false positive.

1. It doesn't work with Firefox.  This is huge, since the very reason many of us are using Comodo products in the first place is that we do NOT trust Micro$oft products.  Thus, we also use Firefox, Opera, Safari, et al.  Please do not pander to the uneducated masses: make the web-based scanner work with platforms that the users will trust.

Come on it's not that huge. Most Comodo products are for Windows, you trust the OS with your whole computer,  but not the browser? I'm an Opera user but you won't get anything icky only from using IE in this site. ActiveX makes life easier for developers.
 

3. The page doesn't have the "trustlogo" that is on all the other Comodo pages, making it seem one has been redirected to a fake site.

This is a very good point.

[Liron Jan]

just to be on the safe side, download the trial version from the rar labs website (direct link: http://www.rarlab.com/rar/wrar371.exe ). Then right-click on that .exe and extract the files, do not install! Next point the online scanner to that directory and see if shows the same results. If not, then your copy has got infected.

Hi Star Shadow. The same result has been appeared.
I have still the problem that the scanner stuck in different files (each time - other file).

Thanks, Liron Jan.

[xiuhcoatl]

Tried to run it three times. Each time it caused IE to crash.  Here is the dump it tried to send Microsoft. I did not look for any other dump file
 also here Some basic security sofware that runs resident
I suspect symantec I know it caused problems with CFP, early on
Window XP Spanish Edition
IE 7 (Fox fire is also installed but the scan was run under IE)
Symantec Corp AV 10.0 (tamper protection disabled)
CFP(3.0.24.368)
CMF (2.0.4.20)
Spy-Bot SD (1.5.20)

Note added: It was run in an administrator account, I normally use a Limited User account.

OD

[Liron Jan]

Tried to run it three times. Each time it caused IE to crash.  Here is the dump it tried to send Microsoft. I did not look for any other dump file
 also here Some basic security sofware that runs resident
I suspect symantec I know it caused problems with CFP, early on
Window XP Spanish Edition
IE 7 (Fox fire is also installed but the scan was run under IE)
Symantec Corp AV 10.0 (tamper protection disabled)
CFP(3.0.24.368)
CMF (2.0.4.20)
Spy-Bot SD (1.5.20)

Note added: It was run in an administrator account, I normally use a Limited User account.

OD

It's happened to me too until I disabled my anti-virus and re-start my computer. Did you try it?

[Eric Cryptid]

It might be that Spybot's Immunization and IE Helper is causing and issue. Have you tried un immunizing it?

[SA Jack]

Downloaded and ran it yesterday.  Just a couple of observations.

1.  The window was not able to display the full content of the interface.  I run at 1024 x 768 with 120 DPI.  Looks like about 10-20% of the right portion of  the window is unviewable.  The window can't be adjusted to fix the issue.

2.  Program seemed  to run OK, somewhat slower than Avira 8 which I now use as my AV.  It only detected one file within the Avira folder structure as possible malware.

3.  To run subsequent scans,  I didn't find anything (shortcut, link, etc.) to get right back in and run another scan.   Is it necessary to go to the original  web-page  and  accept the agreement again before starting a scan?   I tried to run another scan without checking the agreement since I had done that already, however, I was notified that I had to check the  agreement again.  I thought that with the Active X control showing up in IE7, a command button would be available to activate the scan.

I  have several folders on my C:\ that I would like to  "exclude" in the scan.  Does this on line scan accommodate such things? 

Thanks.  -SA Jack

[Frosty Port]

It might be that Spybot's Immunization and IE Helper is causing and issue. Have you tried un immunizing it?

i found that spyware blaster was stopping the active X from installing and crashing the browser i had to disable it before i could get it to run.
after i got it up and running every thing went great took 50min to scan my HDD. 

[Tags:]