FP - uTorrent 3.3.1.30017 Temp Files

Heur.Packed.Unknown@4294967295

Updated uTorrent 3.3.1.30017 and I’m getting a FP on the temp files created when launching uTorrent. I’ve attached two of the 0 byte temp files (the filename changes randomly) and the other temp file can’t be copied or quarantined. I’ve included a screenshot of the alert and the directory containing the temp files.

[attachment deleted by admin]

Hello L.A.R. Grizzly,

Thank you for reporting this. We’ll check it. Usually using only one way of submitting the False Positive should be enough, please don’t use both webinterface and forum submission unless you haven’t receive a response within 24 hours.

Best regards,
FlorinG

Hello L.A.R. Grizzly,

I was not able to replicate this detection using Comodo Internet Security Version 6.2.285401.2860 with 16835 database and the 30017 built for uTorrent 3.3.1. We need you to submit the detected files, if needed try restoring them from Quarantine (you might need to disable the AV in order to be able to send the files to us). Don’t submit zero size files since they won’t help. Thank you!

Best regards,
FlorinG

OK, from now on, I will only report in one area. Sorry.

With Heuristics set on High in the Realtime Scanner, when I launch uTorrent, the program creates 2 temp files which are flagged. These files can’t be quarantined or copied. They vanish as soon as uTorrent opens. I can’t add them to my exclusion list because every launch of uTorrent has a different file name for the temp files. That’s why I was only able to send the zero byte file.

–Edit-- I don’t know if this will help, but it’s the same problem I reported here:

https://forums.comodo.com/av-false-positivenegative-detection-reporting/fp-utorrent-temp-files-t96780.0.html

[attachment deleted by admin]

This issue has been confirmed fixed. Thanks Comodo Team!

Reference: https://forums.comodo.com/av-false-positivenegative-detection-reporting/heurpackedunknownat4294967295-t97825.0.html