Please post your screenshots of KillSwitch

wasgij6 · January 5, 2011, 10:00pm

no uknown processes

good work comodo

[attachment deleted by admin]

Melih · January 5, 2011, 10:01pm

Nice…No alerts for you sir

Melih

steiner.de · January 7, 2011, 11:36pm

This is a tool to unlock the office 2010.

[attachment deleted by admin]

miloszcz · January 8, 2011, 12:08am

So, illegal?
Keygens, cracks etc. are also detected as malwares.

twizzz · January 8, 2011, 4:40am

Some Keygens will exploit your machine tricking software into thinking its a activated copy… So yeah it would be a unsafe app.

rhgtyink · January 8, 2011, 5:43pm

I don’t think it’s running under srvany for the fun of it

twizzz · January 9, 2011, 3:47pm

HaHa… agreed! :-TU

fake5 · January 16, 2011, 11:27am

hope that there will be chinese simplified version……

[attachment deleted by admin]

Jacob · January 17, 2011, 12:16am

Clean as a whistle

Jake

[attachment deleted by admin]

Tech · January 25, 2011, 12:48pm

There are still false positives…
What’s the reason of submitting them to Comodo if they’re not solved…
Another frustrating answer from the virus analysts…

[attachment deleted by admin]

rhgtyink · January 25, 2011, 1:25pm

Hi Tech, you are talking about “these” false-positives?

I only see FLS unknown, I don’t think that’s an FP.
A DACS result from an other vendor, don’t think Comodo can fix that.

And a UnclassifiedMalware that does look like a FP, can you post a shot from the verdict tab to see which part flagged it malware (probably CIMA). and preferably also the SHA1 hash of the file.

Tech · January 26, 2011, 9:15pm

What is FLS then?

I see. It’s a ClamAV detection…

Verdict screenshot. I’m absolutely sure that it is a false positive. It’s a local application (paid).
http://www.virustotal.com/file-scan/report.html?id=fbf44719bed4537a7e5601913d04703df1cb59014427bf441fbef4bbce95fa56-1296076344

MD5: 7de40a52b993b21a7c2dfba1371a8057
SHA1: dbb78096d48288846a251498a59d808c130bec2b
SHA256: fbf44719bed4537a7e5601913d04703df1cb59014427bf441fbef4bbce95fa56

[attachment deleted by admin]

rhgtyink · January 27, 2011, 4:32pm

Hi Tech,

FLS = File Lookup Service.
CIS/CCE/KS send out the HASH of the file to the FLS, if the HASH is found malicious it’s marked.
If the HASH is not in the database it returns “FLS.Unknown”.

Did you report the FP here? Normally they respond within a day with a “fix” so it shouldn’t take to long to fix.
I think forum FP’s are faster processed then the one’s submitted trough the web submission form, but that’s just a feeling.

Tech · January 27, 2011, 7:09pm

No, I didn’t know I should do it there. I’ve done there.
https://forums.comodo.com/av-false-positivenegative-detection-reporting/false-positive-of-killswitch-t68658.0.html;new#new

marko_bg · January 28, 2011, 9:52pm

Hello everyone, here’s my screenshot.
Btw. I reported mcshield last year for trusted application
http://forums.Comodo.com/news-announcements-feedback-cis/submit-applications-you-want-to-be-made-trusted-here-t46391.0.html;msg451583#msg451583

[attachment deleted by admin]

Chiron494 · January 28, 2011, 10:34pm

Resubmitted

If you like you can follow the thread until it is whitelisted (if appropriate).

marko_bg · January 28, 2011, 10:42pm

Ok, thanks.

JoWa · January 28, 2011, 10:46pm

Would be interesting to see Properties > Verdict for MCShieldRTM.exe.

marko_bg · January 28, 2011, 11:43pm

Here is it!
It’s not rogue/fake program, it’s really excellent program for protecting from infected usb storages!

[attachment deleted by admin]

JoWa · January 28, 2011, 11:57pm

Thanks. Detected by ClamAV.