Winlogon false positive [resolved]

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
1

Hi,

I’m wondering why nobody mentioned winlogon.exe reported as false positive. CIS beta 1 crashed my Windows because of this (beta 2 at least asks before it deletes anything). I|m running Windows XP SP2 with Czech localization. I’m absolutely sure the file is clean because it is a clean and new Windows instalation (I had to do a clean Windows install after the crash). This is a long standing problem, it has been reported several moth ago already, but it’s still not fiexed :-(. I can upload the winlogon.exe, if Comodo needs to. Should I do it? Where should I send it to?

Also in the main screen of CIS it says 5 threat(s) detected so far. If I click at the number “5” a new window pops up and the list is empty. Do you have any idea what does it mean?

2

Hello. Sorry about the trouble.

How to submit a false positive;
https://forums.comodo.com/empty-t27062.0.html

Bug reporting for CIS beta 2;
https://forums.comodo.com/empty-t27062.0.html

3

Hello Vlada,

Sorry about the what happened there. Thanks for reporting. Please provide us with the following information,

  1. Is the file detected in CIS beta 1 alone or is it being detected in CIS beta 2 also?

  2. For beta testing, please make sure you are using the latest beta,
    Download here

  3. As kyle suggested , please suibmit the file to us so that we can check it out. To know how to submit the file to us, please check the following link.
    How to submit files to the lab

  4. Please give us the name under which the file gets detected for example, BACKDOOR.WIN32.XXXXXX.XXX ID: XXXXXXX. This is very important for us to be able to fix the problem.

Your help is very much appreciated.

Regards,
Baskar.

4

Hello Baskar,

the file is detected as a trojan in beta 2 too, I should have the latest version now. I already sent the file and some screenshots to you by e-mail. It is reported as Trojan.Win32.Patched.m@352071.

I now upgraded to XP SP3, so I’ll let you know if Comodo reports the new version of winlogon.exe (SP3 updates this file AFAIK) as a trojan too.

5

The FP has been fixed already. If you are still facing any problems, please let us know.

Much appreciated. :slight_smile:

Thanks and Regards,
Baskar.

6

Thanks a lot, for fixing this. :-TU

Just to mention with SP3 there are no more problems with winlogon.exe.

I’ll let you know if I ever come across another FP.

7

Thanks Vlada. We really appreaciate your taking time to report problems :).

Since this issue seems to be resolved now, i am closing this topic. If you want to this topic to be reopened, please pm a moderator or an admin of this board requesting to do so. This applies only to the original topic starter, all others please start a new topic.

Regards,
Baskar.