help with detection of files

Comodo Internet Security - CIS AntiVirus Help - CIS
#1

i left my computer copying tonight 200gb of data from one hard drive to another
in the morning errors from my copy program apeared

antivirus bloked some of my files ( safe files)

how do i restore all the files at once ???

i go to quarantine items , its none item in there

i go to logs and appears all but i cant recover the files from there

help please :cry:

#2

You can try the freeware recover tool Recuva from the makers of CCleaner to see if you still can recover them.

#3

i has luck because i had still the files on the original disk but not in the other HDD that i was triyng to make a copy :frowning:

i have disabled the antivirus meh :-\

#4

Do you think you can reproduce the scenario? (As in may be we found a bugā€¦)

#5

yes both

i think is a bug because appears in the log but not in quarantine :frowning:

o only know that failed because the copying program alerted that all not files was copied

sorry for bad english

tomorrow i will assist you :wink:

#6

What copy program do you use? Teracopy? Does the error also happen when you copy without the copy program?

#7

yes is teracopy :slight_smile:

i dont know but when the antivirus detects on the fly when the program is copying i think is normal giving that error right? :slight_smile:

#8

do you need some help to correct the bug?

#9

Can you try the same copy action again and see what happens. When the error occurs again show a screenshot of the Defense + logs. The logs can be found under Defense + ā†’ Common Tasks ā†’ View Defense + alerts.

#10

ok i will try to remenber doing that tomorrow :stuck_out_tongue:

#11

I believe Teracopy not only tells you what could not be copied,
It also has a Cleanup button that removes all entries of what has been copied,
and then you can try again - and if you disable the A.V. for the next attempt it should ā€œfill in the gapsā€.

If a file is a threat, I would NOT expect it to be ignored when scanned on your system drive.

If a file became transmuted into a threat as it was copied, perhaps it was blocked because Comodo would not allow it to be written, and therefore it was never on the destination HDD and so could not be quarantined.

Is it possible that Teracopy did something that Comodo considered suspicous ?

Alan

#12

Hi all,

Iā€™m using Windows XP Pro & CIS Free version. I already have 2 times restored a complete backup of my C: disk. Later I found 2 files in the C:\WINDOWS\system32 map:
C:\WINDOWS\system32\net.exe and
C:\WINDOWS\system32\net1.exe

  1. Itā€™s possible to delete these 2 files but a few seconds later they are created again
  2. You find in the registry indications to these 2 files

What I have done:

  1. I placed these files in the DEFENCE+ ā€œMy Blocked Filesā€
  2. Renamed in the registry the file NET.exe to noNET.exe & net1.exe to nonet1.exe

My opinion is: these files are creating a worm effect because when the PC boots, there are no icons on the desktop. The processor gets active 100% for sure! If you have the same problem, try to find out if these files are active and running in PCā€™s memory by pressing CTRL+Alt+Del, then choose Process Management. If you seen them, try to kill one of them; you will seen that the other one also kılls himself automaticallyā€¦ CIS does not detect these 2 files as virusses!
O0

#13

Another way of working is to go the Active Processes List in D+ ā†’ right click on both files and choose ā€œTerminate and blockā€. T

hen add the two registry keys to the my protected registry keys so they cannot be changed anymore by programs without permission of the user. Then delete the registry keys.