UnclassifiedMalware@162432846 cannot submit

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
1

Hello,

I’ve installed the comodo anti-virus today (vista 64 home) and during the first full scan I got this:
C:\Users\Aloyse\AppData\Roaming\ASP.Net Cache Module\Windows Local Host.exe UnclassifiedMalware@162432846

So I quarantined the file and hit submit, got back the message ‘File to large’. The file is 13.693 kB. So I restored the file and I tried to zip it with 7zip, this fails with the message ‘Access refused’. I’m also unable to see the file properties, I cannot take ownership of this file and the owner is not shown.

Any suggestions on how to proceed with this?

2

Hello Aloyse,

We checked this file and concluded that it is not a False Positive.

Best regards,
FlorinG

3

Thank you for the quick reply. Any idea what sort of malware it is?

Best regards,

Aloyse

4

Hey and warm welcome to comodo forums Aloyse!

deleting it (by pressing clean) or quarantine it.

Regards,
Valentin N

5

It’s already quarantined, I was wondering if you had any information what it could have done?

Best regards,

Aloyse

6

try to submit it to virustotal that should give you an idea of what it is or submit it to
CIMA http://camas.comodo.com/ to show you what it does.

7

Perhaps you can copy the file and then upload that copy to VirusTotal. That sometimes works.

8

Thank you for the suggestions, unfortunately I cannot copy or upload the file, even when logged in as administrator, I have not he necessary rights to do anything with that file.

9

You could try to copy and then past it on your desktop.if it’s too big encrypt it and then upload it.

Regards,
Valentin N

10

I have tried copying it to an other folder, but I cannot copy it because I do not have the necessary rights, even logged on as administrator. Any actions (copy, move, zip, view properties, access with CFF-Explorer) that I try on that file get blocked by the message that I do not have the right to access that file.

11

last resort is to use a bootable cd to access it and send it to virustotal.

12

Thanks, languy99, that did the trick. According to virustotal it’s a trojan, after the latest update comodo av called it a trojan dropper.