False postive

[Guest]

[mastermine2009]

Hey i have just done a scan with comodo antivirus which was fully updated and it came back with 25 infections, am just wondering if you guys could help me by telling me if these are real infections or false positives thx

BTW i did have the scanner on medium heuristics. 

Unclassified Malware[at]5394671 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP113\A0013288.sys

Heur.Packed.Unknown C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP126\A0015112.exe

Heur.Packed.Unknown C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP126\A0015111.exe

Backdoor.Win32.Rbot.~LR[at]1477421 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP126\A0015147.dll

ApplicUnsaf.Win32.Hide.~AB[at]5325787 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP131\A0015461.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP147\A0016369.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP148\A0016605.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP150\A0016638.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP150\A0016702.exe

ApplicUnsaf.Win32.HackTool.Agent.~BADT[at]5236843 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP152\A0016887.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP179\A0019561.exe

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP179\A0019562.exe

Unclassified Malware[at]5394671 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP180\A0019637.sys

Unclassified Malware[at]5394671 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP180\A0019645.sys

Unclassified Malware[at]5394671 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP180\A0020645.sys

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022049.exe

Teststring.Eicar[at]5218661 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022048.com

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022050.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022051.exe

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022052.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP193\A0022240.exe

ApplicUnwnt.Win32.Leaktest.AKLT.25[at]565200 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP193\A0022239.exe

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP193\A0022241.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP194\A0022508.exe

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information\_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP194\A0022509.exe

[.FaZio93.]

Welcome.
I see in your attachment that some are named "Leaktest". Have you run any leaktests lately? It's impossible to tell if they are real or not becuase they are all located in System Volume Information (window's system resyore points) which are inaccessible.

My advice is to just disable system restore (which will clear all your existing restore points) and then enable system restore again afterwards, so windows will start making new restore points again.

This will show you how to disable/enable SR:

http://www.bleepingcomputer.com/tutorials/tutorial56.html

[mastermine2009]

Thanks a lot most appreciated i will do that now :-)

[Tags:]