About the "driver loading"

[a256886572008]

1.sample:

VirusTotal

http://camas.comodo.com/cgi-bin/submit?file=1d2c3d0b4e135b78bbb68ed8af1311fd7db04ed36703cc8ea6b70fdc4ff89bdb

http://valkyrie.comodo.com/Result.html?sha1=4e63a2848bd2b6dfdfae9c586e3c1f9f8c3c8127&&query=1&&filename=killhips.exe

2.What does it do?
(1) It created a .sys file on the root of the disk.
(2) It loaded the driver.
(3) The .sys file is a copy of “vga.sys” trusted by CIS.

3.Tests:
(1)partially limited and HIPS

2013-01-29 13:40:15 C:\virus\killhips\killhips.exe Sandboxed As Partially Limited

2013-01-29 13:40:18 C:\virus\killhips\killhips.exe Modify File C:\22222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222321.sys

The .sys file was installed successfully.

(2) limited, restricted, untrusted

nothing happened

(3) fully virtualized

The registry key remained in the real system.

4.environment:
Windows XP Pro SP3 32bit

[egemen]

Thanks a lot for reporting. Can you also send me the sample for a quick check?

[Citizen_K]

The root of the disk is not protected by CIS.

[Chiron494]

@egemen post:2

Thanks a lot for reporting. Can you also send me the sample for a quick check?

Any update on this?

[egemen]

This is fixed.

[thug4real]

@egemen post:5

This is fixed.

Thank you egemen Can wait the new release(that will fix network issue, I believe is this week)

Regards RealNature,

[egemen]

ITs fixed as well. Its ont related to release. So current 6.1 already has all the issues addressed.

[thug4real]

@egemen post:7

ITs fixed as well. Its ont related to release. So current 6.1 already has all the issues addressed.

Ok that’s great then. :■■■■

[Citizen_K]

@egemen post:5

This is fixed.

Is the root now a protected folder?

@RealNature post:6

Thank you egemen Can wait the new release(that will fix network issue, I believe is this week)

Regards RealNature,

@egemen post:7

ITs fixed as well. Its ont related to release. So current 6.1 already has all the issues addressed.

Thanks egemen. Comodo is always acting quickly when bug of this impact happens.

Is the problem in Boot up extremely slow after CIS 2013 v6.1 update related to the problem with the networking problem or is this a different problem? Ronny’s comment suggests it may be:

@Ronny

I have seen this ‘slow’ thing also, it seems to be caused when the network is ‘unusable/offline’ if you disable all NICs on your system and boot it takes CIS ages to load…

[egemen]

@EricJH post:9

Is the root now a protected folder?Thanks egemen. Comodo is always acting quickly when bug of this impact happens.

It is not what this issue is about. It is an XP only bug.

]Boot up extremely slow after CIS 2013 v6.1 update[/url] related to the problem with the networking problem or is this a different problem? Ronny's comment suggests it may be:

It will be fixed with an update next week. Some binary updates are now like antivirus updates i.e. will be updated frequently. This issue will be resolved with next update i.e. before May.

[Citizen_K]

Thanks egemen.