Possible false positive TrijWare.Win32... in comodo updaters

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
1

In my most recent scan the anti-virus scanner picked up TrojWare.Win32.Trojan.Agent.~AADE@1842905 in comodo’s EmgManUpd.exe, EmgAutoUpd.exe and in a System Volume Information_restore file That seems a little odd, and since I’ve seen some posts about false-positive trojans I figured I’d check if this was one as well.

Thanks,

Eric Anderson

2

Hi,
We are looking into it and will get back to you soon.

Thanks
-umesh

3

Thanks for False Positives to Comodo.
We will deal with it as soon as possible.
comodo china

4

This very thing happened to me and I panicked and clicked DELETE, so I think EmgManUPS.exe is gone, do I need this?? The restore file ones I opted to quarantine. Did I ■■■■■ up? What should have I done? and most important What do I do Now???

I’m confused now I don’t know if a trojan is running rampant in my laptop or I just ■■■■■■■ up my system? I heard some people lost their internet connection due to a problem with comodo, I hadn’t have a problem since installed until now, I’m afraid to turn off my laptop, lol.

PLEASE HALP!!

5

Put back the files in the restore point and try system restore.

6

Hi,
EmgManUpd.exe is used by CAV2(BETA), which is no longer supported.

Just wondering how come you are using both CIS and CAV2(BETA) ?

Thanks
-umesh

7

I was running stand alone Commodo AV & Firewall previously, but I believe CAV was removed when the I updated to CIS about 3 weeks ago. From looking at the timestamp on the directory the files were in it appears that they were updated about 11/23/2008 - about the time I updated to CIS.

8

Hi,
CIS Updates do not update CAV2(BETA) but CFP alone. You must uninstall that if you have CIS running.

Thanks
-umesh

9

I’ve got this problem too. :frowning: But I don’t understand - is this a real virus? And if so, what should I do?

10

Hi lumik,
If EmgManUpd.exe is being flagged as malware, it’s false-positive, don’t have to worry about it.

Thanks
-umesh

11

ОК, but how can switch off the pop-up alert window?

12

permanent ignore?

13

Yes, you can select permanent ignore.

Thanks
-umesh

14

Thanx Umesh :slight_smile:

15

np lumik,
Btw this FP has been fixed in virus signature version 760 onwards.

Thanks
-umesh

16

I was NOT using both, I uninstalled CAV2 first (yes I closed the program and tray icon before doing so), restarted computer and then installed CIS. I have no idea why EmgManUpd.exe was doing there then if the installer was suppossed to deleted it? yes, no?

My question is, should I NOT worry because I clicked delete to that file, should I? if so, would system restore bring it back?

Sorry if the questions are dumb I’m not too computer savvy, I try the best I can heh

Thanks for the help

17

Hi miskatonic44,
You should not worry about EmgManUpd.exe file. It is part of CAV2(BETA) which informs users to upgrade to CIS.

But this EmgManUpd.exe can run only if CAV2(BETA) is installed and it’s updater running. So i think even though you uninstalled CAV2(BETA), it’s updater was running somehow.

Thanks
-umesh

18

Ok, thanks much for replying, I’m a lil’ dense with this stuff haha (:TNG), now I can rest(art) in peace.