?? False positive with Fortnite anticheat

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
1

Having just updated the game FORTNITE, alarmingly when I start up game the Easy cheat splash screen pops up with a launch error stating ‘ERROR VALIDATING EASYCHEAT CODE SIGNING CERTIFICATE’ with the only option is to exit. Immediately when this happens COMODO antivirus detects and quarantines the following temp file:

C:\Users\J\AppData\Local\Temp\2a550496-1265-08c5-07d0-1098f8b3eeff Virus.Win32.Virut.CE@86480074

What I’m hoping to hear is that this is a false positive, can anyone shed any light on this please? Incidentally I was was running this game perfectly fine prior to the update

2

Hello Jm1,

Please share the sample so we can check it. Thank you!

Best regards,
FlorinG

3

I’ve tried to locate the file in quarantine but the entry indicates it had failed to quarantine it. Also if I remember correctly, during one instance I was able to submit it but cis response was that it was already submitted. Please let me know if there is anything else I can provide

4

We’ll need the sample or at least its SHA1 to check if this is a False Positive or not.

5

According to the comodo file details the SHA-1 is: 663FE3BFB638A67922F57C2964CD44851AC3B24A does this help?

6

Unfortunately we don’t have this sample in our database. If this detection will occur again please share the sample with us.

7

I would love to provide a sample however dispite comodo blocking the file it fails at quarantining the file. I have attempted to search for the file without finding it, it seems as soon as it is detected it disappears. I have watched the folder and used Everything explorer to see if this file is actually being generated when the comodo alerts - without luck. The work around I’m using is that I disable the antivirus then load the game, then enable the antivirus.

Also, another observation is that the name of the file is always different (numbers and letters) each time I start up the game.

Please could be give me advice as to how I can ‘trap’ this file so I can send it to you.

8

Does anyone have any ideas about a solution to this problem?

9

Have you tried adding EasyCheat to the trusted vendor list? You could always add it as an exclusion. If you have HIPS enabled, tried disabling that temporarily. There’s a number of things you could try.

Eric

10

I have tried added easy cheat to trusted vendors which does not solve the issue. As mentioned already the work around is disabling the antivirus before starting game and once game is running to re-enable it - surely having to perform this action highly indicates a false positive? If this was a genuine detection then wouldn’t comodo detect the virus once renabled? Either way I look forward to any other suggestions on how this can get solved…

11

Try enabling the anti-virus setting of do not show alerts quarantine threats, then check if file is quarantine successfully. What I think is happening is the file is a .dll that gets downloaded from the AC server then loads the dll into the game process, then deletes the on disk copy after the dll is loaded. So the file is already gone by the time you can select clean from the AV alert. Hopefully it can get quarantined faster with the do not show alerts option.

12

Hi Future, my settings are already on this - the quarantine just fails without providing a file. Are there any other ideas? I’m finding this increasing frustrating as this was never a problem for me before and now it is…