Report recurring Heuristic (Heur.Suspicious) detections here - 2022

[meldan]

Hi windstorm,

This is to inform you that false-positive has been fixed.
You can update to AV database Version <27002> of  Comodo Internet Security Version<10.0.1.6209> and confirm it.

Kind Regards,
Erik M.

[cocalaur]

Database version: 27619

File info:

Path: C:\Windows\system32\SearchIndexer.exe
Detection:     Heur.Gen.Lama[at]117022151

File hashes:

SearchIndexer.exe   
fd74badbcf30f3f6c9d6e3d6b3e42fa5   - MD5
bce4ebbf6aa5b2d0df8f4a152f8e76b2b4b567b0   - SHA1
0ac3130b   - CRC32
9970bd6cff1cd0d60906bf171773ddf7bd317f13b1850149f97886f5cf0d94d6 - SHA256

This can happen with Heuristics set on Medium.

Please run a manual scan/ realtime scan with medium heuristics to see if FP occurs

[Aravindhraj J]

Hi cocalaur,

This is to inform you that false-positive has been fixed.
You can update to AV database Version <27653> of  Comodo Internet Security Version <10.0.1.6223> and confirm it.

Kind Regards,
Aravindhraj J.

[patrice58]

Defraggler https://www.piriform.com/defraggler downloading it opens CIS with the option of cleaning the file via sending it to the sandbox or running it without. ApplicUnwnt[at]#290od3alopvy2 Database version 28059.

[Qiuhui.Wang]

Hi patrice58,

This is to inform you that the reported file is not a false positive<PUA>.
If you intent to use it further,you can add it to exclusion list.

SHA1：40cdd1188cfc0b474b66a22ce8ddb280a38eadfd *dfsetup221.exe

Best regards
Qiuhui.Wang

[qmarius]

Name: Heur.Packed.Unknown[at]4294967295
SHA1: 34ec4c94714d4ea1ba34a556088d9034cb790973

"product.cab|file_VBoxDD2RC.rc",
"product.cab|file_VBoxDDRC.rc".


mirror: https://www63.zippyshare.com/v/Sq0bA1en/file.html

[andrei.savin]

Hello Marius!

Thanks for your submission, we'll check the files and get back to you.

Best regards,
Andrei Savin

[andrei.savin]

Hi!

This is to inform you that the false-positive you have submitted has been fixed.
Please update your AV database to version <28856> and confirm.

Best regards,
Andrei Savin

[qmarius]

f93668004978646cf875ac8fe9af76bb377bd27c

[andrei.savin]

Hi Marius!
Thanks for the submission, we'll check it and get back to you.

Best regards,
Andrei Savin

[abinaya]

Hi qmarius,

This is to inform you that the false-positive you have submitted have been fixed.
Please update your Comodo security product virus database to version 29228.
SHA1:f93668004978646cf875ac8fe9af76bb377bd27c

Regards,
Abinaya R

[danyb]

    Name of the tool >>>
    The Heur.Suspicious code   >>>>Heur.Corrupt.PE[at]4294967295
    Official website/link where to download the tool
    If possible contact information of it's developer(s)


In attachment a copy of what Comodo shows me
I have also tried sending them (advanced tasks) It succeeded with  of the Dell update msi
As for the Windows\Installer items : I do not find the map Installer in C:\Windows - and yes - hidden maps are showing

[danyb]

I cannot find my original post but think I forgot the attachments.
Here they are

[Ionel]

Hi danyb,

In order to fix the reported false-positives we need the files that are detected, as it's a heuristic detection and we cannot identify the files based only on detection name. Please add the files to a password-protected archive using "infected" as password and send said archive to us at falsepositive[at]avlab.comodo.com.

Thanks and regards,
Ionel

[danyb]

Hi Ionel,

I already sent 3 of the Dell update files using Comodo's advanced tasks.
They still show up in new scans.
I will try to send the Dell update file that gives the error.

BUT: I have told you that I cannot find the files in C:\Windows\Installer - so how can I send them???