What to do with False Positives ?

When you encounter a False Positive (=FP) please follow these 2 ways so it can be resolved as quickly as possible.

1st way - on the forums (False positives only !)

False Positive

  1. Make a new topic.
  2. Write in the title the program/file that is detected
  3. Provide the name of the FP, for example : Heur.Packed.Unknown
  4. Provide a link to the site of the program
  5. Provide the number of your CIS database
    example =

[u][b] 2nd way - over e-mail[/b][/u]

Reporting a False Positive

  1. Please zip up (using a archive tool like winzip,winrar etc) the file that you believe is wrongly detected and password it with password ‘infected’ without the quotes and email it to malwaresubmit[at]avlab.comodo.com (Look here if you don’t know how to rar files)

  2. Please make sure to mention “FALSE POSITIVE” on the subject line of the mail. Also include the the name and ID (for example, BACKDOOR.WIN32.XXXXX.XX (ID = XXXXXX) under which the file in question is getting detected. Attaching a screen shot would be very helpful.

[b]It is recommended that you report False Positives both ways ! [/b]