Google Chrome: False Positive. Adding to excluded does NOT help.

Discontinued Products Comodo BOClean Anti-Malware
1

BOClean v427
last update 2009-03-18 10:40am

03/18/2009 15:58:05: MSITSJACK VARIANT STOPPED BY BOCLEAN!
Trojan horse was found in memory.
C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE contained the trojan.
Active trojan horse WAS shut down. System safe.

GoogleChrome version 2.0.169.1

Second time this happens.
Chrome is not conterminated though!
NO page was opened: Chrome was just started without any page.

btw… after the first alert I removed the application and reinstalled it again.
Used it many times since without any problem - and all of the sudden BOCLEANS pops up.
No change in CHROME (no update) and the only change in Boclean: auto-update malwarelist.

So why it pops up now and then and all other times not … beats me.

I also put the exe in BOCLEANS Program Excluders list - so why does it still get mis-judged when excluded?

Second time (now) I just restarted Chrome and no problemos… even no Boclean message popping up.

[attachment deleted by admin]

2

I don’t see how/why it’s in C:\Program Files.…
It should be in your “C:\Users\USER NAME HERE\AppData\Local\Google\Chrome”
Then Try Adding This To The Excluder

Did this help?

  • Jacob
3

No… it depends on how you install Chrome.
If you install it seperately, it will be installed in the users path.
When installed via Google Updater, it will be installed in the program files.

The first alert I got on chrome by Boclean was when it was installed as standalone so in the users path.
I uninstalled and installed it via google’s software updater pack - which installed in the programs folder.
Then I once again removed and added chrome.exe from its location into excluder.

Thus remains… why does boclean intercept chrome on a very random delay as containing malware - and why does the added entry in the excluder not function… :slight_smile:

4

Hi HansB :slight_smile:

This is a little bit confusing for me :-\ Normaly the excluder should work if you have excluded the right .exe file. That said, you could do us a favour by reporting this as a false positive :

https://forums.comodo.com/comodo_boclean_antimalware/what_to_do_with_false_positives-t27286.0.html

The best way to do it for BOClean is by email. Thnx m8 :slight_smile:

Greetz, Red.

5

Hi Red

Thanx for your reply.
The email will be sent out this weekend :slight_smile:
The false-positive report on here … uhm… wasn’t this topic I created just that - or what info do you miss?

6

Hi HansB :slight_smile:

You did well, that is not the problem :slight_smile: But the Comodo guys don’t look look here all the time for false positives. That is why I asked you to email them :wink:

Greetz, Red.

7

:slight_smile: great to hear

Maybe I did find the cause - that is: if BOClean detects changes in filesize as being attacked?
Chrome did have some minor under-the-hood-updates which caused the filesize to change while running.
If BOClean detects this - even with the app in it’s ‘exlude’ list it makes sense that it alerts.

could this be the cause?

8

Yep, if an excluded file changes, BOClean will alert it ( again ).

Greetz, Red.

9

and thanks again for your reply :slight_smile:

for me this item can be closed then - I assume the message it showed (MSITSJACK VARIANT) is a general description for changes in filesizes so the alert was correct though somewhat confusing.

Thanks again,
cheers
Hans