False positive in signature update? 11th of September [CLOSED]

Feedback/Comments/Announcements/News
21

Confirmed with both CIS 3.5 BETA & CFP 3 here.

Josh

22

Same for me with XP SP3.

Has been removed but nothing in quarantine.

[attachment deleted by admin]

23

And I repeat my initial question:

Is anyone from Comodo aware of this problem and working to solve it?

A new update with a corrected signature file would be appreciated.

24

I believe this has been resolved now: tried a new scan, with today’s signatures, and nothing was found.

Please confirm guys!

LA

25

The false positive has been fixed. Please let us know if anyone is still facing any problems.

Regards,
Baskar.

26

I just checked my Av events and found more. I think it must have run a scheduled scan as a balloon message appeared.

I have now removed auto removal from the scheduled scan settings, so hopefully it will ask next time before deleting anything. It would have been better if the default was for quarantine surely?

[attachment deleted by admin]

27

Just ran another scan with today’s updated signature and all seems back to normal.

No false positives this time.

(:CLP)

28

If someone removed suspicious tzchange.exe (like me :D) then here is the correct Windows Upadate patch KB951072.
You must choose proper language version, the same in which is your Windows XP.
To reinstall this update you have to remove the old one ( KB951072 ) from your system through Add or Remove programs in Control Panel (‘Show updates’ must be checked).

29

I removed the old one with add or remove, then used windows update to restore it.

The file is now back in my system 32.

30

I don’t recognize “AV Events”. Are you sure this is from CFP and not CIS? If so I’ll end this thread since the false positives for CFP have been fixed and this is the CFP board.

31

I just did a scan tonight and the the trojan / virus does not show up in my computers any more. Comodo must have updated their definitions today as there are no more false positives. Most of the other board members are reporting back the same results. So for now, everything looks good. All of the different tzchange.exe file versions threw me off as to a possible problem or trojan infection.

Just to clarify, tzchange.exe version 5.1.2600.5640 is the newest correct file that should be in the C:\Windows\System32\ folder.

:BNC

32

Okay, I am now going to close this thread, The issue is resolved on my PC as well.

For future Reference, All False Positives are to be posted here. Read the stickies before posting.

Thanks
Josh