a bug for the "installer/updater detection" of comodo sandbox

I checked the option

I double clicked on a program which contains an install package.

Result: CIS did not popup an alert window for the installer.

2011-11-04 15:48:30 C:\Documents and Settings\Roger\桌面\virus\ipchanger\ipchanger.exe Sandboxed As Partially Limited

2011-11-04 15:48:31 C:\DOCUME~1\Roger\LOCALS~1\Temp\i.exe Sandboxed As Partially Limited

2011-11-04 15:48:33 C:\DOCUME~1\Roger\LOCALS~1\Temp\w.exe Sandboxed As Partially Limited

2011-11-04 15:48:33 C:\DOCUME~1\Roger\LOCALS~1\Temp\Installer.exe Sandboxed As Partially Limited

2011-11-04 15:48:35 C:\DOCUME~1\Roger\LOCALS~1\Temp\server_et.exe Sandboxed As Partially Limited

2011-11-04 15:48:37 C:\Documents and Settings\Roger\桌面\virus\ipchanger\ipchanger.exe Modify File C:\Documents and Settings\Roger\Local Settings\Temp\i.exe

2011-11-04 15:48:37 C:\Documents and Settings\Roger\Local Settings\Temp\i.exe Modify File C:\Documents and Settings\Roger\Local Settings\Temp\w.exe

2011-11-04 15:48:37 C:\Documents and Settings\Roger\Local Settings\Temp\w.exe Modify File C:\Documents and Settings\Roger\Local Settings\Temp\server_et.exe

2011-11-04 15:48:37 C:\Documents and Settings\Roger\Local Settings\Temp\Installer.exe Modify File C:\Documents and Settings\Roger\Local Settings\Temp\IXP000.TMP\INSTAL~1.EXE

2011-11-04 15:48:37 C:\Documents and Settings\Roger\Local Settings\Temp\server_et.exe Modify File C:\Documents and Settings\Roger\Application Data\mservice32_t.exe

2011-11-04 15:48:37 C:\Documents and Settings\Roger\Application Data\mservice32_t.exe Sandboxed As Partially Limited

I double clicked on the installer directly.

Result: CIS popuped an alert window for the installer.

FVS report:

ipchanger.exe
https://valkyrie.comodo.com/Result.html?sha1=643fc13650b8dda92d1f22e86ed1e373bce9289b

What you are witnessing is by design. When a program gets run sandboxed all its siblings will also get run sandboxed.

Just to clarify the siblings or descendants will get sandboxed without alert.

Mouse