topic Re: False-Positive on Comodo in General Topics

False-Positive on Comodo

umesh.comodo — Sat, 12 Aug 2017 16:16:19 GMT

Hi There,
Not sure what's the right place to report this false-positive.

I would like to draw urgent attention of Paloalto Networks staff to resolve following false-positive on one of Comodo Internet Security files:
Virus Total (1/64)
https://www.virustotal.com/en/file/f80c084dc4747b8fee70ac4028e9b734cbc8aa3aea230b24fa9740da44ffcec1/analysis/1502048473/

We will appreciate if you could please resolve it asap.

Thanks
-umesh
comodo.com Staff

Re: False-Positive on Comodo

TranceforLife — Sat, 12 Aug 2017 17:14:49 GMT

Hi,

How to Submit an Anti-Virus False Positive:

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/How-to-Submit-an-Anti-Virus-False-Positive/ta-p/74600

How to Submit a Vulnerability Signature False Positive:

https://live.paloaltonetworks.com/t5/Featured-Articles/How-to-Submit-a-Vulnerability-Signature-False-Positive/ta-p/74602

Re: False-Positive on Comodo

DonohoeRobert — Sat, 12 Aug 2017 23:40:17 GMT

Hi Mate,

Downloaded same, which triggerred a wildfire upload and its been marked as benign by the threat analysis cloud. So its not been classed as malicious now anyway.

Best regards,

Rob

Re: False-Positive on Comodo

umesh.comodo — Sun, 20 Aug 2017 23:34:10 GMT

Hi,

I have verified afresh on virus-total and still see it detected as of 20th Aug, 2017, 7:30 PM EST:

https://www.virustotal.com/en/file/f80c084dc4747b8fee70ac4028e9b734cbc8aa3aea230b24fa9740da44ffcec1/analysis/1503271961/

Please re-check.

Thanks

-umesh

Re: False-Positive on Comodo

BPry — Mon, 21 Aug 2017 16:56:48 GMT

@umesh.comodo,

Have you actually tried this from wildfire itself to verify directly. I wouldn't exactly trust virustotal to give you the proper verdict that WildFire actually generates.

If you can get it to show up as malicious or grayware in WildFire it's pretty easy to request a verdict change, seeing as people who have already tested it report that it's beneign in an actual enviroment I really wouldn't worry about it.

Re: False-Positive on Comodo

umesh.comodo — Mon, 21 Aug 2017 17:57:50 GMT

We also have our own Comodo Antivirus product and understand how Virus Total works.

We are also present on Virustotal.

At times people upload files to Virustotal and go by that.

So i will request PaloAlto team to scan the file and resolve the false-positive.

Thanks

-umesh

Re: False-Positive on Comodo

Remo — Mon, 21 Aug 2017 18:17:00 GMT

I do not work for paloalto, so this is ot an official statement, but I don't know if this community forum (even if there are people from palo here) is the right place to request something like that ...

Re: False-Positive on Comodo

umesh.comodo — Mon, 21 Aug 2017 21:18:07 GMT

Possible to point to me download location of their product for consumer?

Thanks

-umesh

Re: False-Positive on Comodo

BPry — Mon, 21 Aug 2017 21:34:38 GMT

@umesh.comodo,

I just noticed that you have not posted this under the VirusTotal discussion. That forum is the proper place for this type of submission, although I can not actually verify the forum is activly watch any longer.

https://live.paloaltonetworks.com/t5/VirusTotal/bd-p/VirusTotal_Discussions

File Hash: <hash>

Link to Virustotal report for the file: <link>

Current VirustTotal Verdict: <verdict>

Description: <description>

That being said what was suggested by @TranceforLife would have worked perfectly fine in this instance, as WildFire recognizes the file as benign already as verified for you by @DonohoeRobert. It appears however from your last reply that you have not taken action on the info Trance has given you, which would continue to be the recommended course of action.

Re: False-Positive on Comodo

umesh.comodo — Mon, 21 Aug 2017 22:57:44 GMT

Thanks BPry,

I have posted in there:

https://live.paloaltonetworks.com/t5/VirusTotal/False-positive-on-comodo/m-p/172480#M185

Reharding:

"That being said what was suggested by @TranceforLife would have worked perfectly fine in this instance, as WildFire recognizes the file as benign already as verified for you by @DonohoeRobert. It appears however from your last reply that you have not taken action on the info Trance has given you, which would continue to be the recommended course of action. "

We want detection to be removed from VirusTotal, as that creates wrong perception.

I hope someone from paloaltonetworks.com will look into it.

Thanks

-umesh