why avast detects the process of comodo firewall as virus?

[Hellion]

Hi Corsair,

It's not really a problem as this is only an issue encountered with memory scans and even after detection there is nothing you can do. (there is no option of deleting/Quarantining the detection)

I did try your suggestion now, I added the exclusions for both manual/auto scans and File system Shield, But this had no effect.

Regards,
Hellion

[Corsair]

Just a query:

Do your avast! settings and file system shield exclusions look like the attachments below?

[Hellion]

Hi Corsair,

Yes, they look EXACTLY like that.

It's very hard to screw something like that up


Regards,
Hellion

[DavidR]

Excluding comodo in avast won't make a difference in this case as:
a) this isn't an alert on any comodo file
b) is in memory, not a file or comodo location
c) whilst you can exclude a file from being scanned, you can't exclude its actions, e.g. in this case the insertion of unencrypted signatures into memory.

[igor]

Well, I believe you probably could exclude the memory detection, but you'd need an advanced magic for that
Let me know what exactly the detection says in the first column, I'll try to make the exclusion mask.

[DavidR]

I think the simpler option would be not to do the memory scan as you have on numerous occasions, if it gets into memory it is a bit late

[Corsair]

Ah. I see now. 

Just an FYI - it sounds similar to this: http://forum.avast.com/index.php?topic=78142.0

[Hellion]

Hi Igor,

This detection only occurs when you do  memory scan with "test whole files" option.

The detection reads...

File Name:
Process 884 [cmdagent.exe], memory block 0x0000000004b00000, block size 2097152

Severity:
High

Status threat: win32:fakevimes-b trojan

Hi Corsair,

Yes that thread has pretty much the same discussion going.


Regards,
Hellion

[igor]

You can set the exclusion (e.g. for the particular scan you created) as follows:
*PROCESS\*\cmdagent.exe
- then the Comodo process won't be scanned at all.

[Hellion]

Hi Igor,

What about people that are not computer savvy? I think this it what the OP was getting at.

This never bothered me since I know that the Comodo process is not a threat, but some other people might be confused by it.

BTW, Thanks for everyone's input,

Regards,
Hellion

[DonZ63]

A thousand kudos to Igor!

The *PROCESS tip works like a champ. I have added cmdagent.exe and mbamservice.exe to any scan that uses the memory scan option. No more signature alerts from Comodo and MBAM Pro.

Plese post this tip as a FAQ at the top of this forum for others.