FP - uTorrent Temp Files

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
#1

After updating uTorrent to the latest stable release (uTorrent 3.3.1.29932), I’m getting FP on the temp files created.

Heur.Packed.Unknown@4294967295

C:\Users\xxxxxxx\AppData\Local\Temp\utt58F1.tmp

C:\Users\xxxxxxx\AppData\Local\Temp\utt957A.tmp.new

I can’t send the file. They change randomly when uTorrent is opened. I’ve attached my log file.

[attachment deleted by admin]

#2

I had this same FP, are your heuristics set to medium or high?

#3

Hi,

Thank you for reporting this.
We’ll check it and get back to you.

Kind Regards,
Erik M.

#4

Please check this with CIS 6 on medium or high heuristics as it seems to be detected at higher heuristics.

#5

Yes. I have mine set to High. Funny, I haven’t been bothered by it the past few hours.

#6

The issue still seems to be there when you open utorrent. I’m not sure if they can fix this though :frowning:

#7

They have been able to fix it in the past. I’m sure they’ll work it out.

#8

Hi,

This is to inform you that false-positive with
(SHA1: )
has been fixed.
You can update to AV database Version <16592> of Comodo Internet Security Version<6.2.282872.2847> and confirm it.

Kind Regards,
Chunli.chen

#9

Hello Chunli.chen,

The FP is not fixed.
DB: 16596

I’ve attached my log file.

Griz

[attachment deleted by admin]

#10

Hi L.A.R. Grizzly,

Can you please submit the detected files (not the report) here Comodo Antivirus Database | Submit Files for Malware Analysis ? Also, add to comments section the link to this topic.

Thanks and regards,
Ionel

#11

I managed to capture a few of the temp files and submitted them at the link you supplied. Thanks!

#12
Hi,

This is to inform you that false-positive with
uTorrent Temp.zip (SHA:89ef0df3876e9b54852d9980f66e901e27db7838) was fixed.You can update to AV database Version <16605> of Comodo Internet Security <6.2.282872.2847> and confirm it.

Regards,
Priyadharsini.G
Comodo AntiVirus Lab

Hello Priyadharsini.G,

The FP appears to be fixed with DB 16606. I’ll report back if I encounter any further problems. Thanks!

Griz

#13

I am also experiencing the same issue with uTorrent, I’m running latest beta of utorrent, and it was happening before I upgraded to this beta version too. CIS version is 6.2.285401.2860 and database version is 16731.