FP - Dashlane

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
#1

I’ve seen posts about this, but not any real solution, so here it is again.

I have alert notifications coming from HIPS about Dashlaneplugin EACH time I launch chrome about some c_cmd.exe_<…>.bat requiring some attention.

This .bat is generated by Comodo, I have no way to know exactly from what it is generated.

When I look inside, it says :
C:\Users\Tristan\AppData\Roaming\Dashlane\DashlanePlugin.exe" chrome-extension://fdjamakpfbbddfjaooikfcpapjohcfmg/ --parent-window=0 < \.\pipe\chrome.nativeMessaging.in.130322d2ae73aea9 > \.\pipe\chrome.nativeMessaging.out.130322d2ae73aea9

So I added C:\Users\Tristan\AppData\Roaming\Dashlane\DashlanePlugin.exe in code injection exclusions (it’s already an authorized program) but it doesn’t change anything, the alert will still appear each time I launch chrome. I also tried to add C:\Users\Tristan\AppData\Roaming\Dashlane* to exclusion, but no success.

So far I can only consider the “code injection detection” is broken and totally disable it in "settings > HIPS settings > uncheck “code injection detection” (which works).

#2

Hi Tristan107,

Thanks for reporting.
Could you please submit the detected file at
Comodo Firewall | Get Best Personal Firewall Software for $29.99 A Year.

Regards
Pavithran G

#3

Ok, it’s done.

Also, I have to say when I add “C:\Program Files (x86)\Google\Chrome\Application*” to code injection exceptions, it works, I have no more notifications, but it defeats the purpose of code injection detection to exclude the whole “chrome.exe”, doesn’t it ?

#4

Well, you gave me really bad advice, Comodo Firewall | Get Best Personal Firewall Software for $29.99 A Year is not about code injection, it’s only about virus/malware, and they conclude : False Positive not confirmed:<C_cmd.exe_FB85203C3E3CDDCB8FDBC2B8B43825A5C60AFF39.bat> (SHA1:fb85203c3e3cddcb8fdbc2b8b43825a5c60aff39)