COMODO antivirus

Hi there WTT. Didn't know where to post this as i'm sure it's not malware but here goes… I've recently (yesterday) reinstalled my OS and after downloading combofix and running a scan with COMODO antivirus, it says that Combofix is an unsafe application and that msmsgs.exe is a Heur.suspicious@31571721 Like i said, i don't think it's malware and COMODO probably got it wrong but i just thought i'd check… See screenshot posted below for more info if needed N.B. the screenshot has had a blank segment removed from the middle to coincide with the Max Upload Size restriction of 500KB

You are correct it is a false positive, it's not uncommon for tools such as this to be seen as suspicious due to the sheer nature of what they are used for, and how they have to work close to actual infections, it is quite safe for you (assuming you have been given the all clear from the pro's) to ignore the Combofix findings, but it is probably better advised to simply delete the file, it is a powerful tool and should only be used under the guidance of the pro's, so once used it serves you no further purpose and therefore should be deleted.

Now I am a little concerned about the msn entry, where did you get it from ? and have you added any extra stuff too it ? eg like smiley packs etc.
Because msn in itself should not be flagged up as a risk, BUT, there are numerous ways it can become infected, and assuming that you got the original msn file from m$ directly, then the most common problem is people add all these fancy extras to it, such as smiley packs, winks, the fancy bit that turns your typing into images etc, all these such extras are often related to infections, some just annoying (non malicious), and others maybe worse, my best advice is uninstall that msn using Revo, delete ALL the remains, run junk file cleaners, run security scans to see if anything still gets flagged, if so tell the protection to delete it, then get WLM from this genuine source, and it shouldn't pick it up again, if it does it may be worth asking the pro's for a check up to be safe, hope this helps.

Now I am a little concerned about the msn entry, where did you get it from ? and have you added any extra stuff too it ? eg like smiley packs etc.

In answer to your question - I did get it directly from m$ ( i know not to download from any other sources than their owner/makers sites) and no, i haven't added ANYTHING to it. it's just a clean install from m$ (i'm guessing m$ is short for Microsoft as i see it flying around quite a lot on here)

Yeah thats what people abbreviate it to, so typing is faster lol. I appreciate you may know to only use original makers sites etc, but we have to double check to be safe, but in some ways that makes the entry even more questionable, looking at your original post again you say you got and ran Combofix, was this done under guidance\instruction from a pro trained to use this ? or did you use it yourself ? and if so are you trained to use it ? My concern is you used it yourself and are not trained to use it, and as such may have caused some corruption or similar, the best advice I can offer ATM is too uninstall and reinstall it again as described above and run the scan again, see if that helps.

I didn't run it

after downloading combofix and running a scan with COMODO antivirus

as i know it can do damage if used incorrectly (from reading infections removal) it's only installed in case i get infected and lose internet connectivity but i can uninstall if you feel this is necessary.

Thanks for replying so quick!

Duey

Given that situation then yes, it's perfectly fine to just leave the Combofix alone, and tell the anti virus to ignore it, you wont be bothered again by it, but I would suggest submitting the file to Comodo for investigation, not because it's bad, just so they can prove to themselves it's not bad, and update they're definitions so it doesn't pick it up as a threat in future. As far as msn goes I would still uninstall etc as I suggested above using Revo etc, once you reinstall it run the scan again and and see if it still sees it as a problem, then we can go from there. But if this is a fresh install was it done due to any kind of infection ? Just trying to see if there is any history that may help explain this entry.

no, it wasn't re-installed due to an infection, please see this thread to help clarify

Edit 1: i'm just sending COMODO the combofix.exe for analysis
Edit 2: I will uninstall Messenger tomorrow as i am at work in a short while. i'll let you know how i get on from there

Regards

Duey

Well if a reinstall of msn\WLM doesn't work I'm not sure what else to suggest, heres hoping.

i've uninstalled messenger and all associated junk with Revo as you suggested earlier and am just running a scan with COMODO (with definitions that were updated a second before the scan started) i'll let you know the results when it finishes… Duey

Scan has just completed - Found 0 infections/viruses… Just going to install WLM from the link you provided above Total Threats found after re-install of MSN - 0 Looks like whatever was 'infected' was removed and replaced with an 'uninfected' version. Thanks for your help and recommendations - they seem to have worked. Regards Duey

Sorry for slow replies, got so many things on it's crazy, well we will probably never know what this was all about, perhaps some minor corruption, maybe a false positive corrected in the latest update, but if your issue is resolved then we can't ask for more, glad you were able to sort it.

Sorry for slow replies…..well we will probably never know what this was all about, perhaps some minor corruption, maybe a false positive corrected in the latest update…..

It's ok (slow replies) at least you did reply. I understand that people live lives outside this forum too! LOL!
I guess (hope) it was a false positive.

I did tell COMODO to ignore it on the first scan but before i re-installed WLM, i removed the Ignore on it just to make sure that it was actually clean.

Thanks once again for your help

Regards

Duey

IT'S BACK..

i've installed a genuine XP Pro copy with a legit disk (& SP2) that i had laying around the house, installed WLM from M$ (have comodo a/v installed on this OS too…) all's fine.
did updates last night (one being SP3) and comodo says that msmsgs.exe is a virus YET AGAIN!! the same heur.suspicious as before (although it was fine on SP2) and same with combofix (despite being ignored and i've found ALL component parts to it and told comodo and ignored them too) i've done MBAM and CF scans (only scans, no removal) and they find nothing.

i'm thinking of changing AV. can you recommend a free one (other than AVG and avast!) and preferably one that detects Antivir 2010 as a vius.

Thanks

Duey

P.S. i followed all steps previously suggested before posting this…

Edit:
Maybe i should post this in Infections removal??

OK lets check something first, look at the warning and see where it says this file is, make sure it is in C:\Program Files\Messenger, if it isn't then it's advisable to get a check up from the pro's, if it is in that location then lets try another couple of tricks.

Click on Start - Control Panel - Add or Remove Programs, on the left select Add\Remove Windows Components, in the new window that opens scroll down to the bottom, and uncheck Windows Messenger, next it through and it will remove it, see if that helps.

Also click on Start - Control Panel - Administrative Tools, and launch Services by double clicking it, now these are listed alphabetically, so scroll down to the list to the M's, and locate Messenger, double click on that and select Stop, then from the drop down box select disabled, apply\save\exit and close any windows that are open, see if that helps.

*edit
An alternate choice thats highly rated is Avir

1) Yes, it is in that location
2) i told it not to insall windows messenger when i installed the computer, but i've checked and the windows messenger is UNticked
3) It was stopped when i opened its properties (in services) and in startup, it is set to Disable (N.B. i have not done this, it was already like this)

Thanks for your help (although more is needed)

An alternate choice thats highly rated is Avir

Does this detect (and remove) Antivir 2010 virus that lots of people seem to be 'catching'

Regards

Duey