False postive

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
#1

Hey i have just done a scan with comodo antivirus which was fully updated and it came back with 25 infections, am just wondering if you guys could help me by telling me if these are real infections or false positives thx

BTW i did have the scanner on medium heuristics.

Unclassified Malware[at]5394671 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP113\A0013288.sys

Heur.Packed.Unknown C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP126\A0015112.exe

Heur.Packed.Unknown C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP126\A0015111.exe

Backdoor.Win32.Rbot.~LR[at]1477421 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP126\A0015147.dll

ApplicUnsaf.Win32.Hide.~AB[at]5325787 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP131\A0015461.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP147\A0016369.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP148\A0016605.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP150\A0016638.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP150\A0016702.exe

ApplicUnsaf.Win32.HackTool.Agent.~BADT[at]5236843 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP152\A0016887.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP179\A0019561.exe

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP179\A0019562.exe

Unclassified Malware[at]5394671 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP180\A0019637.sys

Unclassified Malware[at]5394671 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP180\A0019645.sys

Unclassified Malware[at]5394671 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP180\A0020645.sys

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022049.exe

Teststring.Eicar[at]5218661 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022048.com

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022050.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022051.exe

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP189\A0022052.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP193\A0022240.exe

ApplicUnwnt.Win32.Leaktest.AKLT.25[at]565200 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP193\A0022239.exe

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP193\A0022241.exe

Application.Win32.LeakTest.~TS[at]149925 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP194\A0022508.exe

Application.Win32.LeakTest.~TS2[at]91644 C:\System Volume Information_restore{7A593D9E-3562-4AC0-B437-017E5A9605B5}\RP194\A0022509.exe

[attachment deleted by admin]

#2

Welcome. :slight_smile:
I see in your attachment that some are named “Leaktest”. Have you run any leaktests lately? It’s impossible to tell if they are real or not becuase they are all located in System Volume Information (window’s system resyore points) which are inaccessible.

My advice is to just disable system restore (which will clear all your existing restore points) and then enable system restore again afterwards, so windows will start making new restore points again.

This will show you how to disable/enable SR:

#3

Thanks a lot most appreciated i will do that now :slight_smile: