False-Positive on Comodo

[umesh.comodo]

Hi There,
Not sure what's the right place to report this false-positive.

I would like to draw urgent attention of Paloalto Networks staff to resolve following false-positive on one of Comodo Internet Security files:
Virus Total (1/64)
https://www.virustotal.com/en/file/f80c084dc4747b8fee70ac4028e9b734cbc8aa3aea230b24fa9740da44ffcec1/...

We will appreciate if you could please resolve it asap.

Thanks
-umesh
comodo.com Staff

[TranceforLife]

Hi,

How to Submit an Anti-Virus False Positive:

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/How-to-Submit-an-Anti-Virus-False...

How to Submit a Vulnerability Signature False Positive:

https://live.paloaltonetworks.com/t5/Featured-Articles/How-to-Submit-a-Vulnerability-Signature-False...

[DonohoeRobert]

Hi Mate, 

Downloaded same, which triggerred a wildfire upload and its been marked as benign by the threat analysis cloud. So its not been classed as malicious now anyway. 

Best regards, 

Rob 

[umesh.comodo]

Hi,

I have verified afresh on virus-total and still see it detected as of 20th Aug, 2017, 7:30 PM EST:

https://www.virustotal.com/en/file/f80c084dc4747b8fee70ac4028e9b734cbc8aa3aea230b24fa9740da44ffcec1/...

Please re-check.

Thanks

-umesh

[BPry]

@umesh.comodo,

Have you actually tried this from wildfire itself to verify directly. I wouldn't exactly trust virustotal to give you the proper verdict that WildFire actually generates. 

If you can get it to show up as malicious or grayware in WildFire it's pretty easy to request a verdict change, seeing as people who have already tested it report that it's beneign in an actual enviroment I really wouldn't worry about it. 

[umesh.comodo]

We also have our own Comodo Antivirus product and understand how Virus Total works.

We are also present on Virustotal.

At times people upload files to Virustotal and go by that.

So i will request PaloAlto team to scan the file and resolve the false-positive.

Thanks

-umesh

[Remo]

I do not work for paloalto, so this is ot an official statement, but I don't know if this community forum (even if there are people from palo here) is the right place to request something like that ...

[umesh.comodo]

Possible to point to me download location of their product for consumer?

Thanks

-umesh

[BPry]

@umesh.comodo,

I just noticed that you have not posted this under the VirusTotal discussion. That forum is the proper place for this type of submission, although I can not actually verify the forum is activly watch any longer. 

https://live.paloaltonetworks.com/t5/VirusTotal/bd-p/VirusTotal_Discussions

File Hash: <hash>

Link to Virustotal report for the file: <link>

Current VirustTotal Verdict: <verdict>

Description: <description>

That being said what was suggested by @TranceforLife would have worked perfectly fine in this instance, as WildFire recognizes the file as benign already as verified for you by @DonohoeRobert. It appears however from your last reply that you have not taken action on the info Trance has given you, which would continue to be the recommended course of action. 

[umesh.comodo]

Thanks BPry,

I have posted in there:

https://live.paloaltonetworks.com/t5/VirusTotal/False-positive-on-comodo/m-p/172480#M185

Reharding:

"That being said what was suggested by @TranceforLife would have worked perfectly fine in this instance, as WildFire recognizes the file as benign already as verified for you by @DonohoeRobert. It appears however from your last reply that you have not taken action on the info Trance has given you, which would continue to be the recommended course of action. "

We want detection to be removed from VirusTotal, as that creates wrong perception.

I hope someone from paloaltonetworks.com will look into it.

Thanks

-umesh