MBAM detects part of COMODO Firewall (FP)

[sp123]

I originally asked for help here about a odd registry key which was detected by Malwarebytes. I have now been able to find the VBS script loaded, and this is a false positive.

COMODO Firewall uses this script when uninstalling (and maybe installing?), and all it does is delete it's own autorun entry (and it's self) and open COMODO's website.

Detection log: comodo_detected.txt

VirusTotal: https://www.virustotal.com/gui/file/cca5e470410262b81e5cb82036fba0d24d80eb2a6125ebf0c3e59406c79a829d

File: ComodoWebStart.zip

[miekiemoes]

Hi,

I'll whitelist this.

This will be reflected in next database update.

[sp123]

Thank you.

[sp123]

@miekiemoes the registry key is still detected:

Trojan.Agent.Generic, HKU\S-1-5-21-3840172506-3331901336-1254842142-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|COMODOWEBSTART, No Action By User, 3585, 521269, 1.0.56847, , ame, , , 

Log: log.txt

Key: run.zip

[miekiemoes]

Ok, let me see what I can do. I don't want to remove this generic detection as it catches 99% of malware using that key and content, but I can bypass it in a different way.