TrojWare.Win32.Genome.~AO@14566584 detected in netman.dll (XP SP3)

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
#1

As the title says… I think it’s a false positive because Clamwin and Adaware didn’t find anything, don’t know exactly where to see my current version of the signatures database but it’s the latest one when I write this post.

#2

I have the same problem on my desktop and my girlfriend laptop. We do not frequent the same website and i’ll be suprised if we download and install the same file the same day. My virus database has been update on saturday april 11 2009.

#3

Hi，llama and allenkey44 ，

pls upload the sample to the forum,so that we would take a look at it.

Thanks

#4

The issue is also mentioned here: Virustotal

I attached the file, packed in a zip (since dll is not allowed).

[attachment deleted by admin]

#5

Hi,herojoker

We are going to have a look at it and will get back to you after investigation.

Thanks

#6

Same issue here. Comodo takes no action; no file is deleted, nor quarantined. This happens only at startup, a successive scan shows no alerts.

Davide

#7

I also get the popup in my computer today. My Virus Signature Database Version is 1110.

I am so supprise. Then I send the NETMAN.DLL to VirusTotal, then I get the results:

Antivirus Version Last Update Result a-squared 4.0.0.101 2009.04.12 - AhnLab-V3 5.0.0.2 2009.04.11 - AntiVir 7.9.0.138 2009.04.11 - Antiy-AVL 2.0.3.1 2009.04.12 - Authentium 5.1.2.4 2009.04.11 - Avast 4.8.1335.0 2009.04.11 - AVG 8.5.0.285 2009.04.11 - BitDefender 7.2 2009.04.12 - CAT-QuickHeal 10.00 2009.04.10 - ClamAV 0.94.1 2009.04.10 - Comodo 1110 2009.04.11 TrojWare.Win32.Genome.~AO DrWeb 4.44.0.09170 2009.04.11 - eSafe 7.0.17.0 2009.04.07 - eTrust-Vet 31.6.6450 2009.04.11 - F-Prot 4.4.4.56 2009.04.11 - F-Secure 8.0.14470.0 2009.04.11 - Fortinet 3.117.0.0 2009.04.11 - GData 19 2009.04.12 - Ikarus T3.1.1.49.0 2009.04.12 - K7AntiVirus 7.10.700 2009.04.11 - Kaspersky 7.0.0.125 2009.04.12 - McAfee 5581 2009.04.11 - McAfee+Artemis 5581 2009.04.11 - McAfee-GW-Edition 6.7.6 2009.04.11 - Microsoft 1.4502 2009.04.11 - NOD32 4002 2009.04.11 - Norman 6.00.06 2009.04.09 - nProtect 2009.1.8.0 2009.04.12 - Panda 10.0.0.14 2009.04.11 - PCTools 4.4.2.0 2009.04.08 - Prevx1 V2 2009.04.12 - Rising 21.24.60.00 2009.04.12 - Sophos 4.40.0 2009.04.12 - Sunbelt 3.2.1858.2 2009.04.11 - Symantec 1.4.4.12 2009.04.12 - TheHacker 6.3.4.0.305 2009.04.11 - TrendMicro 8.700.0.1004 2009.04.10 - VBA32 3.12.10.2 2009.04.12 - ViRobot 2009.4.10.1688 2009.04.10 - VirusBuster 4.6.5.0 2009.04.11 -

I think that would be FP. Please correct it.

Thank you!

#8

Same here for file created in 2004. Chose quarantine but file still in system32.

#9

Hi Guys.

This has been fixed in Database v1111.

(Non Comodo Employee).

#10

Thanks, no problem after fix