Report recurring Heuristic (Heur.Suspicious) detections here - 2022

[Citizen K]

Do you find you have to report some tools that get flagged over and over after every updated version that get's released?
Then this is the topic to report them. Only report Heur.Suspicious@<number> detections here please.
If it's detected but in your view falsely classified use a normal FP report asking to reclassify the tool.

Please provide the following details in your report;

• Name of the tool
• The Heur.Suspicious code
• Official website/link where to download the tool
• If possible contact information of it's developer(s)

Previous thread

[disPPlay]

Hi i have reported some days ago in this topic that a virtualbox installer file was being flagged wrong

https://forums.comodo.com/av-false-positivenegative-detection-reporting/fp-heurpackedunknown4294967295-t117927.0.html

The file is again begining to be flagged as malware, please take a look at it



https://www.virustotal.com/pt/file/a34c6235c1d26492ff32319aa72f12ac64c0837057a0411321bdb97c2ed0b3cf/analysis/1485538081/

[andrei.savin]

Hello,

Based on the info you have provided it appears that we do not detect this file. Are you sure you updated Comodo Internet Security to the latest version?

Best regards
Andrei Savin

[disPPlay]

Yes I'm sure updating was made before full scan.
Here goes a screenshot of CIS log

[andrei.savin]

Hi,
AV Lab is currently investigating this issue and we'll solve it as soon as possible.

Best regards
Andrei Savin

[disPPlay]

thanks andrei.savin

[blade120]

AIMP
https://www.aimp.ru/

Backup folder is detect as malware

Heur.Packed.Unknown[at]4294967295

[andrei.savin]

Hi,
Thank you for submitting this. We'll investigate it.

Best regards,
Andrei Savin

[blade120]

Thank you.

[andrei.savin]

Hello blade120,
Could you please enlarge the window and see the exact file that is causing the detection and submit it to us? We're unable to get a hold of the file. You can attach the file here directly.

Best regards,
Andrei Savin

[blade120]

Of course
SHA1: 624C68DA13974D52B44EE39828A7A6E22D6805B1
File is here
http://uploadfile.pl/pokaz/1062677---qwpl.html

[Qiuhui.Wang]

Hi blade120,

This is to inform you that false-positive has been fixed.
You can update to AV database Version <26868> of  Comodo Internet Security Version<10.0.1.6209> and confirm it.

Best regards
Qiuhui.Wang

[blade120]

Hi
All is ok. Thank you very much.

[qmarius]

Name: Suspicious[at]#2w4bqiynoo42h
SHA1: 09022101aad2c53f4b141a3b92a6bcb01f6cbaff


link: https://drive.google.com/open?id=0B6th7MAiPk2EazVRYTdPVnBQbzQ
password: infected

[pavithran]

Hi,
Thank you for submitting this. We'll investigate it.

Best regards,
Pavithran G