2 false neg's caught by MBAM, nasty VT reports...

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
#1

I ran a MBAM scan last night - it turned up several items, but two of them look pretty bad, and CIS doesn’t flag them. Plus the name MBAM gives them (spyware.passwords.XGen) is a big horrifying, although none of the other VT detections give a name that sounds so specifically bad.

I’ve submitted both to Comodo (did it through the software instead of the web interface - is it preferable to use the web?).

They are “test.exe” inside an online poker application folder (which I, strangely enough, think of as being reasonably trustworthy), and 1818543287[1].exe inside the directory:

…\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GHNNA8G

Neither exact file had been seen by VT before, but it analyzed them and gave beck a lot of badness:

[url=http://www.virustotal.com/file-scan/report.html?id=7a3387341f27e11611df0d7a108ff388953d8db7acd58d20d7a6eab9e0f20b30-1292094950]
http://www.virustotal.com/file-scan/report.html?id=7a3387341f27e11611df0d7a108ff388953d8db7acd58d20d7a6eab9e0f20b30-1292094950[/url]

[url=http://www.virustotal.com/file-scan/report.html?id=7a3387341f27e11611df0d7a108ff388953d8db7acd58d20d7a6eab9e0f20b30-1292093797]
http://www.virustotal.com/file-scan/report.html?id=7a3387341f27e11611df0d7a108ff388953d8db7acd58d20d7a6eab9e0f20b30-1292093797[/url]

#2

Hello huge1,

Thank you for your submission. We’ll check this and get back to you soon.

Kind Regards,
Erik M.

#3

Hi,
This is to inform you that the submitted file is not a false positive. The file is detected because it’s a malware application.
Thanks.

Kind Regards,
Erik M.
Comodo AntiVirus Lab

#4

Erik - Thanks for the reply, but I submitted these because I think they’re false NEGatives (abbreviated in the post title). MBAM and VT are clearly flagging them, but CIS is not giving me a warning on scanning them. Are you saying that on your system CIS is flagging them as malware?

#5

Hi huge1,

Please, post this both files here archived and passworded, or via WebInterface
Thanks.

Kindest Regards,
Erik M.

#6

I submitted both of them already, through the CIS software. And then I nuked them both, since they seemed pretty clearly to be bad news, and I figured you guys had them already. I also previously submitted them both to VT.

So I’m afraid I don’t have copies anymore. Do you have access to the files I submitted through the software? Is it better somehow for us to submit files through the web interface?

#7

Ahh, but wait … they’re still in MBAM quarantine … I’ll submit them via web and then re-quarantine them.