Recent Posts1
News / Announcements / Feedback - CIS / Re: Comodo Internet Security v10.2.0.6526 - Hotfix - Released
« Last post by umesh on Today at 11:12:27 AM »This is file-less malware feature, where when commands are passed to some interpreters, in your case powershell, CIS creates a temporary file under 'P:\ProgramData\Comodo\Cis\tempscrpt' and executes under Sandbox.
We already improvised message in CCAV so you could see as which is the origin application that was responsible for launching commands on interpreter.
We already improvised message in CCAV so you could see as which is the origin application that was responsible for launching commands on interpreter.
Since April 23 CIS is starting a powershell script several times per hour. Umesh, what is it for?
It runs from P:\ProgramData\Comodo\Cis\tempscrpt and is named C_powershell.exe_A58C59F8D833AE24E2A5BFBE578E325AC5F8AD0A.ps1. It creates two temp files, will create a start up in P:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell with name StartupProfileData-NonInteractive , and it will also change HKSUS\DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs key several times in the process.
See attached image.
