Comodo alerted for Universal Extrctor: Is it a FP ?

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
1

Hi!

This is the one i am talking about:

http://www.lupopensuite.com/db/universalextractor.htm

And here is the virustotal scan result:

http://www.virustotal.com/hu/analisis/0745bc205553eff37feb7018453c00b48f0dd3bd20043d41169faa8fc25b25e5-1269913877

Comodo claimed it a worm.

2

Moving over to FP Board.

3

Hi Vino,

Thanks for reporting.We will check that and get back to you

Regards,
Haja

4

Hi Vino,

Reported FP has been fixed in DB 4437.Please update and confirm it.If you still experience any problem,please let us know.

Regards,
Haja

5

I have checked it again, and i was wrong, because not the uniextract.exe was reported by comodo itself, but the temp file of the avast! active guard, what belongs to the uniextract scanning. And there are two versions of uniextract on my comp, it was a previous version that was reported first, and the virustotal scan is different for that file, you can see that it is claimed to be a dropper here, not a worm:

http://www.virustotal.com/hu/analisis/ff6457a2183e738d88b74baaff89dccccfca901d35255fe272e14b3f21719ede-1269955436

So the first alert came in connection of this, when i wanted to use it and entered the containing folder, and i guess avasts active guard scanned the files in that folder or i dont know why that file was reported.

3/30/2010 3:34:04 AM C:\Windows\Temp_avast5_\unp234874252.tmp Worm.Win32.AutoIt.~NS@87254559 Detect Success
3/30/2010 3:34:04 AM C:\Windows\Temp_avast5_\unp234874252.tmp Worm.Win32.AutoIt.~NS@87254559 Ask Success
3/30/2010 3:34:14 AM C:\Windows\Temp_avast5_\unp234874252.tmp Worm.Win32.AutoIt.~NS@87254559 Remove Success
3/30/2010 3:34:19 AM C:\Windows\Temp_avast5_\unp213716460.tmp Worm.Win32.AutoIt.~NS@87254559 Detect Success
3/30/2010 3:34:19 AM C:\Windows\Temp_avast5_\unp213716460.tmp Worm.Win32.AutoIt.~NS@87254559 Ask Success
3/30/2010 3:34:22 AM C:\Windows\Temp_avast5_\unp213716460.tmp Worm.Win32.AutoIt.~NS@87254559 Remove Success
3/30/2010 3:42:41 AM C:\Windows\Temp_avast5_\unp101538543.tmp Worm.Win32.AutoIt.~NS@87254559 Detect Success
3/30/2010 3:42:41 AM C:\Windows\Temp_avast5_\unp101538543.tmp Worm.Win32.AutoIt.~NS@87254559 Ask Success
3/30/2010 3:42:45 AM C:\Windows\Temp_avast5_\unp101538543.tmp Worm.Win32.AutoIt.~NS@87254559 Remove Success
3/30/2010 3:50:31 AM C:\Windows\Temp_avast5_\unp253149937.tmp Worm.Win32.AutoIt.~NS@87254559 Detect Success
3/30/2010 3:50:31 AM C:\Windows\Temp_avast5_\unp253149937.tmp Worm.Win32.AutoIt.~NS@87254559 Ask Success
3/30/2010 3:50:35 AM C:\Windows\Temp_avast5_\unp253149937.tmp Worm.Win32.AutoIt.~NS@87254559 Remove Success
3/30/2010 3:10:29 PM C:\Windows\Temp_avast5_\unp188296683.tmp Worm.Win32.AutoIt.~NS@87254559 Detect Success
3/30/2010 3:10:29 PM C:\Windows\Temp_avast5_\unp188296683.tmp Worm.Win32.AutoIt.~NS@87254559 Ask Success
End of The Report

And then i downloaded the newer version of uniextract, and it was aleted too, and i uploaded the newest version then to virustotal.

Previously i had NOD32 running besides Comodo, and recently i have been using Avast instead, because NOD gave me almost no alerts, no detections when i let he scanner run, and i have avira on the other OS( Xp ) and of course i scan with Comodo too, and these detected significantly more infiltrations so i thought NOD32 wasnt the best choice for Win7. I have never had Avast using a relatively long time, i just let it scan my comp sometimes, but when i used its detection rate was quite good, so i decided to give it a shot this time. But if its incompatible with Comodo, then i have to replace it with another anti virus.

6

Hi Vino,

Please submit the files at Comodo Antivirus Database | Submit Files for Malware Analysis and we will verify this issue.

Thanks,
Ionel

7

Hi Ionel !

I did it. How can i get some info about the result ?

8

They will send you an email with the results.