False Positive - Team Fortress 2 - Motion Mapper.exe

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
#1

Comodo picks up C:\Program Files (x86)\Steam\steamapps\common\Team Fortress 2\bin\motionmapper.exe as a Trojan with the signature of TrojWare.Win32.Scar.Lsa

The File as well as the game was updated fairly recently and a detection only occured today and no other Anti-Virus program detects it as such

I have submitted the file also for analysis

Screenshot:

1477×81 21.5 KB

#2

Hi TechPriest,

Please submit the detected sample to us so we can check them.

Regards,
Karthikeyan

#3

I have now submitted the file as you have asked, via the method you posted.

#4

Hi TechPriest,

Thank you for reporting this.
We’ll check it and get back to you soon.

Regards,
Karthik R

#5

No news yet ?

#6

Nope not heard anything back yet, ive brought it to the attention of the staff though

#7

I’m not sure what’s going on with Comodo recently.
They don’t fix FPs, submitted files aren’t added, camas.comodo.com doesn’t work correctly, files aren’t whitelisted… Is there some issue?

#8

…and it seems like all files submitted via the program are all “already sent”

#9

I contacted the staff…let’s see

#10

I thought this was fixed already in a previous post.
I haven’t had a problem with Motionmapper.exe after I installed the newest comodo internet security.
https://forums.comodo.com/av-false-positivenegative-detection-reporting/fp-of-motionmapperexe-located-in-teamfortress2-t111236.0.html
In this thread, chunli said it was fixed as of av database version 22246

#11

My version of comodo was up to date as it could be as of the original post, and it still got detected again

#12

Can you upload the detected file (FP) by using the web form ?

It should get fixed faster.

#13

Yeah i already have, that was how i submitted it in the first place

#14

Huh, that is actually quite strange. I guess we will have to see when a staff member replies.

#15

Nevermind! Today comodo randomly prompted me with a malware alert, and it was this file.
I guess it is a false positive even on the newest database

#16

Hi,TechPriest

This is to inform you that false-positive has been fixed.
You can update to AV database Version <22443> of Comodo Internet Security Version<8.0.0.4142> and confirm it.

Best regards
Chunli.chen

#17

I can confirm (at least on my end) that the detection no longer occurs