New entry update MPVS HOSTS FILE reported as FP 0.0.0.0

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
1

http://msmvps.com/blogs/hostsnews/archive/2013/12/06/1872125.aspx
I updated my host file yesterday, now they changed to new 0.0.0.0 instead of 127.0.0.1 and this is detected as Trojan Win32 malware by Comodo AV upon quick scan. This in fact is FALSE POSITIVE to me. I quarantined manually my host file ans this was it, I then reinstalled it as it was. Waiting for corrections in next virus update. Thanks… ;D

2

Hi, gdiloren

Thank you for your submission.
We’ll check this.

Best regards
Chunli.chen

3

This is still not fixed. It is detected as TrojWare. Win32.QGhost-14S9@116242354 with subgroup 0.0.0.0 (clearly my newly updated host file). This is not detected by AVAST on my laptop Win 8.1 computer so I guess it’s a Comodo AV false positive! Can you tell me if it’s really malware???

4

They will reply when the fix is ready.

5

Please notice the two day limit. We have a special topic for unfixed f/p’s: Post here your unfixed FP’s (only after 2 days).

6

Thanks, replied here:https://forums.comodo.com/av-false-positivenegative-detection-reporting/post-here-your-unfixed-fps-only-after-2-days-t36306.210.html :slight_smile:

7

I’ve submitted this as FP 6 days ago, now with database 17440 it is still detected as malware. What should I conclude? Comodo doesn’t seem to accept modifying at all the Host file the way Spybot Search & destroy or MPVS do and there is nothing to do with it! Even Killswitch was detecting the modified MPVS Host file 127.0.0.1 entries with earlier update versions. I point out no other AV (Antivir or Avast) detects this as malware. So what is your final word on this modified Host file…?

8

Please don’t crosspost. Please try to work it out in the other topic. I am responding there.