Notepad++ 7.4 - FP

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
#1

Notepad++ 7.4 is detected as a malware in antivirus events.

Product site: https://notepad-plus-plus.org/download/v7.4.html
Download link: https://notepad-plus-plus.org/repository/7.x/7.4/npp.7.4.Installer.exe
Name of detection: Application.Win32.Firseria.GH@333624848
CIS Database: 27097
CIS version: 10.0.1.6223
Temporary action taken: Added to Exclusions

#2

Hi NeM, thank you for reporting this case. We’ll analyze and correct fp if necessary. I’ll inform about changes.

#3

Hi NeM,
May you please share snapshot of that event from interface?

Thanks
-umesh

#4

See attached screenshot.

#5

Thanks NeM,
Notepad++ is digitally signed and signer is in Trusted Vendor List.

Did you make any changes in default CIS configuration?

Thanks
-umesh

#6

The specific file is updater\GUP.exe within the installer. If you extract GUP.exe and scan then it comes up clean so its the way it is stored in the installer that triggers the detection. This was a manual scan of the installer.

#7

Ok, thank you :-TU

This a non-issue - as pointed out by Umesh, it turns out Notepad++ was not in my Trusted Vendors list. After adding and re-scanning, the results was clean.

#8

Hi futuretech,
Can you please try to re-scan same setup ensuring you have AV database v27099 or above?

Thanks
-umesh

#9

Seems fixed.

#10

Hi futuretech,
When you observed detection earlier, did you have Notepad++ in trusted vendor list?

Thanks
-umesh

#11

Yes it is listed in trusted vendors list.