submitting suspicious files

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
1

Good morning,

I submitted two Java files this morning with the ‘Submit’ option after a Comodo scan flagged them as suspicious.

Once submitted a window popped up saying they were successfully submited.

My question is how do I know if they were false positives or if they were malware?

Thanks and regards,

2harts4ever

2

If you still have the files you can upload them to www.virustotal.com to see what other AV’s think of it.
It’s not a guarantee but it at least gives an impression of how many detect it or not.

You can also try to upload it to Valkyrie here http://valkyrie.comodo.com/ but I’m not sure if it will analyze .jar files…

Maybe Dr.Web can analyze them http://www.drweb-online.com/en/online_check.asp

3

Hi Ronny,

I appreciate your fast response and the possible helpful links. I will check them out.

I take from your answer that Comodo doesn’t let me know one way or the other if the file is malware?

Also, after putting files in Quarantine I notice I also have the option there to submit a file to Comodo too. After doing this I get a window pop-up saying the file was already submitted and it has a ‘Green’ checkmark next to it. Does this mean the file is no longer suspicious or just that it has already been submitted?

Thanks and regards,

2harts4ever

4

Correct from this submission there is no way to link back to you so there is also no way for Comodo to contact you with the findings. What the normal process would be that the files are checked and if they are found to be clean some AV database update will no longer flag them.

Also, after putting files in Quarantine I notice I also have the option there to submit a file to Comodo too. After doing this I get a window pop-up saying the file was already submitted and it has a 'Green' checkmark next to it. Does this mean the file is no longer suspicious or just that it has already been submitted?
It means that it's been submitted, but it hasn't been analyzed yet so it could still be good or bad.

If you wish feedback on your submissions you can use the following webpage;

On this page you can upload the files and leave your email address so they can give you feedback on the findings.

If your sure that they are FP’s (False-Positive) then you can post them here Comodo Forum in a separate post with the required details.

Please try not to post malware on the public boards, if you find malware files please use the web submission form.

5

Hi Ronny,

Your additional information is appreciated.

While waiting for your answer I submitted the files to both ‘Jotti’ and ‘virustotal’ and both gave the files a clean bill of health.

Thanks for all your help and easy to understand explanations. :slight_smile:

2harts4ever