Re: COMODO Anti-Malware Database may reach 3 Million this Weekend

[Melih]

@andyman35 post:14

In that case it must be just a coincidence that all the FPs I’ve come across have been in the unclassified malware category (none so far with 3.9 it should be said).

A signature created for a specific malware which is unnamed (aka Unclassified Malware) could be causing an FP. If you pls report these then we fix them asap.

yes majority of the issues with the FPs were fixed with 3.9.

thanks
Melih

[AeoniAn]

@Sliso post:11

…
RejZoR is right. I can’t see how Keygens and cracks can be classified as malware unless they actually act maliciously. Just the fact that they happen to be that type of software doesn’t mean that they are bad.
If you give antivirus alerts for harmless programs, when who is to say the user will not ignore the alerts for actual harmful ones?

+1

I have something else to say:

Since, and IF you have D+ and FW with restricted rules you can “ignore” those alerts. D+ and FW gives you more protection than any AV against this type of files. I’m not the only one saying this.

In my case, since both popular BlockList Manager and X-Setup were rated “as something not so understandable to me” (both reported as FP and they said: “harm application” or something like this - in “computish-short-language”, I just can’t care so much to the advices anymore… D+ and FW are here well tuned, and I feel safe. ;D In doubt, virustotal, SAS, MBAM or google. Included those little, very much popular and well known magic-executables…

What my grandma will think and do is another story… No worries, she doesn’t know how to play with these stuff anyway…

relax…

:comodo110:

[Jaki]

@RejZoR post:10

Wtf? What ese should i say too you? Paint the whole thing in MS Paint?!?!?!

My Dearest Educated RejZoR

WTF is not an expression of an educated person, don’t you think? >:( I have asked you politely, twice I might add, to define “harmless” and “stuff” within the context of computer security and still you have not answered. My only conclusion is that you don’t know what you are talking about; you just shoot with your mouth aimlessly. The mirage of savoir faire that you are trying to project is futile with me. When face with facts illusion and deceit always crumble under the weight of reality, if you know what I mean ;D.

Like I told you before you keep your harmless stuff a.k.a keygens and cracks and I’ll keep them away from my own computer. Fair, isn’t it?

Peace. >:-D

[HeffeD]

@Sliso post:11

RejZoR is right. I can’t see how Keygens and cracks can be classified as malware unless they actually act maliciously. Just the fact that they happen to be that type of software doesn’t mean that they are bad.
If you give antivirus alerts for harmless programs, when who is to say the user will not ignore the alerts for actual harmful ones?

Yep. I tried to get a macro recorder in the Scite editor for AutoIt added to the whitelist because it’s completely benign, but because it is ‘suspicious’ they won’t add it. Yes, it’s a keylogger… How else is it supposed to record your keypresses for the macro you are creating? It’s completely harmless (OK, I guess I could write a macro to steal my passwords… 88) ) but due to it’s behavior, it’s suspicious… :-TD

[Melih]

@HeffeD post:18

Yep. I tried to get a macro recorder in the Scite editor for AutoIt added to the whitelist because it’s completely benign, but because it is ‘suspicious’ they won’t add it. Yes, it’s a keylogger… How else is it supposed to record your keypresses for the macro you are creating? It’s completely harmless (OK, I guess I could write a macro to steal my passwords… 88) ) but due to it’s behavior, it’s suspicious… :-TD

suspicious is different than the signatures as its generated by the heuristic engine.

Melih

[OmeletGuy]

@Melih post:181

Unclassified Malware is NOT unknown files.
these are found to be malware either through automatic analysis or by analysts themselves.

We just haven’t named them, thats all.

All these Unclassified Malware are actually Malware!

If you have an FP being reported as Unclassified Malware then its just that, an FP. Please report it to us so that we can fix it.

Otherwise Unclassified Malware will continue protecting users from Malware (Verified malware).

Melih

Why don’t you just change it to Unnamed Malware or Uncategorized Malware? ;D :ilovecomodo: (V)

[rejzor]

@Tesk post:7

Avira detects builder for Remote Administration Tools (RAT, backdoors) too. They are harmless too. They are only used to create a trojan, not a trojan. If you are unhappy with Comodo’s efforts and classification of malware I do not know why you stick around on the Comodo forum.

One thing is when such tools are detected as such with a describing name (so you knw it’s a RAT tool) and another when they are detected as “Unclassified Malware”.
So to Jaki, if you have problems understanding what “i shoot from my mouth”, maybe you should start actually understanding what i write instead shooting nonsense from your mouth.

[Jaki]

@RejZoR post:21

One thing is when such tools are detected as such with a describing name (so you knw it’s a RAT tool) and another when they are detected as “Unclassified Malware”.
So to Jaki, if you have problems understanding what “i shoot from my mouth”, maybe you should start actually understanding what i write instead shooting nonsense from your mouth.

Well then call my bluff, explain to me in layman terms what did you mean by “harmless” and “stuff”. Come on, I’m waiting. Prove me wrong, even if you used MS Paint like you put it ;D. I don’t care.

Peace. >:-D

[MuziekMeester]

!ot!

@Jaki post:22

Well then call my bluff, explain to me in layman terms what did you mean by “harmless” and “stuff”. Come on, I’m waiting.

Guys, you’re kind of wasting your time. In layman terms, “harmless” is a completely relative term if you consider the multitude of network environments and the vast difference of user experience out there.
As an example, on my computer, I store a copy of sysinternals blue screen screen saver. No big deal so far, until CAV started to complain that it was some kid of nagging device (i forgot the exact wording as i put it on my exclude list). Well, to me it is harmless little stuff, if you like to call it that way. But nevertheless, I can imagine people who’ll get a heart attack (or contact a lawyer for whatever reason :P) if someone installs that screen saver without their knowledge and it surprisingly pops in with tons of open documents while they were getting a coffee.
It’s the same with other programs like key-generators or similar things. While on you’re private computer (or in your private network that is run under your responsibility) you’ll probably have them there for a reason, in a corporate network, things may look completely different.

Well, and “stuff” is just “stuff”. Like, in…well, “stuff”, you know?

So, if you’re annoyed that CIS flags things that you actually don’t consider dangerous, put them on your safe file list. They may be in the 3 million + signatures (have to get back to topic somehow… ) for reasons beyond our imagination. 8)

[andyman35]

False positives might be just a minor inconvenience to technical users able to differentiate the bad from just what is flagged up as bad,but to an inexperienced or average user that tends to be cautious and block everything,they represent a major headache.

[Melih]

@andyman35 post:24

False positives might be just a minor inconvenience to technical users able to differentiate the bad from just what is flagged up as bad,but to an inexperienced or average user that tends to be cautious and block everything,they represent a major headache.

very much so. Hence why we worked very hard to mitigate all these FPs in ver 3.9.

thanks
Melih

[rejzor]

Of course. But you also refused to fix a false positive(s) even though it was clearly a false detection.
It was a loader for some game so it can be used offline. It was not even a correct detection.
Unclassified Malware. So if you refuse to fix something, then tag it appropriately.
Like Application.Loader.Somegame, not Unclassifed Malware 88)

[JoWa]

I wonder what Joke is. 88) This time (in 1121) it’s something called Joke.Win32.BadJoke.Renos.~Q.

[jeremysbost]

@JoWa post:27

I wonder what Joke is. 88) This time (in 1121) it’s something called Joke.Win32.BadJoke.Renos.~Q.

It is a late April Fools day joke, of course. 88)

[Petit]

Did it’s a harmful jokes in Comodo database ?

Because some jokes are just kidding the user (:LGH).

[JoWa]

@LaserWraith post:28

It is a late April Fools day joke, of course. 88)

Thanks. I’ve seen early April Fools day jokes… and they have all been bad jokes. 88)

[Jaki]

@RejZoR post:26

Of course. But you also refused to fix a false positive(s) even though it was clearly a false detection.
It was a loader for some game so it can be used offline. It was not even a correct detection.
Unclassified Malware. So if you refuse to fix something, then tag it appropriately.
Like Application.Loader.Somegame, not Unclassifed Malware 88)

I wonder, really, whether or not you have eyes to see and read. Melih clearly said that they worked very hard to mitigate all these false positives in version 3.9; and yet you still state that they refuse to correct a false positive(s) in the singular and plural. To me you are just an unknown specie, never seen or heard of before. Unbelievable.

Peace. >:-D

[system]

Hi Jaki, don’t walk the thin line in the forums on RejZoRs’ behalf, he really isn’t worth it IMHO he may have contributed constructively at times but not consistently in really attempting to be helpful in a mannered & respectful way so just steer clear and ignore any hindrance on his behalf, I know I have…
Xman 8)

[jeremysbost]

@Jaki post:31

I wonder, really, whether or not you have eyes to see and read. Melih clearly said that they worked very hard to mitigate all these false positives in version 3.9; and yet you still state that they refuse to correct a false positive(s) in the singular and plural. To me you are just an unknown specie, never seen or heard of before. Unbelievable.

Peace. >:-D

You aren’t acting like you want peace. ;D

[rejzor]

And he’s also acting like he knows everything, yet i see he knows nothing.
FP’s have nothing to do with program version so 3.8 or 3.9, makes no difference.
It’s a signature based false positive.