false positive or malware? small setup.lid file

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
1

Suddenly today I come back to my PC and Comodo AV shows it found a virus in what appears to be some old small setup.lid file from year 2000 in one of my archive directories. Apparently, Comodo was doing a background scan and ran across that file at that point (see 3rd image in attachments).

However, when I then scan it manually, via right-click Windows Explorer menu item, Comodo says it’s fine?! (See second image in attachments)

I try to upload it to virustotal.com and upload hangs for a while because Comodo it trying to block access to the file and after I tell it to “Ignore once” a whole bunch of times (see 1st image in my attachments), it finally lets me proceed to upload the file to virustotal.com. Virustotal.com then shows all scans coming up clean, INCLUDING Comodo engine.

Any ideas?

Virustotal.com page: VirusTotal

Attached are screenshots with Comodo dialogs showing both detected malware AND showing it clean…

Any ideas?

I went ahead an opened this file properties and it shows it’s only 49 bytes. (See images 4 and 5 in attachements)

Finally, after all of the above and some prayer, I opened this file in Notepad and it shows these contents:

[Languages]
key0=0009
Default=0009
count=1

I am attaching the file itself in the setup.zip file with password of “virus”.

P.S. Comodo version 10.2.0.6526, Database version 28975

2

Hi,justin_smith

This is to inform you that false-positive with (SHA1: <1ddefee04dc9e9b2576dc34eebcfa3de4aa82af9>)has been fixed.
You can update to AV database Version <28947> of Comodo Internet Security Version<10.2.0.6526> and confirm it.

Regards,
Chunli.chen
Comodo Antivirus lab

3

Thanks, what would explain manual scan showing clean status while background process thought it’s a malware?

4

Possibly different scan options for the full scan and manual scan profiles?