bypass comodo sandbox (another malware)

Comodo Internet Security - CIS Beta Corner - CIS
#1

I disabled the antivirus and the cloud scanner.

I double clicked on the malware.

It is sandboxed as partially limited

I selected “allow”

http://i.imgur.com/KenwJ.png

comodo is then bypassed by the rootkit which is downloaded by the malware.

cfp.exe is terminated by it

I checked the defense+ events

2011-09-07 14:41:51 C:\Documents and Settings\Roger\桌面\virus\123\0access\info.exe Sandboxed As Partially Limited

2011-09-07 14:42:21 C:\DOCUME~1\Roger\LOCALS~1\Temp_898.tmp Sandboxed As Partially Limited

2011-09-07 14:42:22 C:\DOCUME~1\Roger\LOCALS~1\Temp_899.tmp Sandboxed As Partially Limited

FVS report:
http://valkyrie.comodo.com/Result.html?sha1=f95c9ade204a5cf71c210d5b1dd516f723df94a9&&query=1&&filename=info.exe

http://valkyrie.comodo.com/Result.html?sha1=8c2f57277da8e5df533408dcbd783114f87f0cd9&&query=0&&filename=_899.exe

#2

That’s gotta hurt… :smiley: :-TU

#3

It’s nice to have a community of malware collectors and analysts… :-TU
Comodo should be proud of us as much as we are proud to be its users… ;D

#4

Send me the smaple pls. Probably the same issue as the previosu one.

#5

Hopefully this will soon be resolved, we can all learn and adapt from this, nothing is perfect no matter how anyone tries, it is a constant battle going back and forth. >:-D

#6

Same family as before. CIS blocks it.

[attachment deleted by admin]

#7

So, CIS didn’t get bypassed?
Or this some new version.

#8

Current version is bypassed. This malware and all the malware OP submitted are all the same which use a specific bug in CIS.

So its fixed before but not released yet. this week you will get the new beta.

#9

Very nice to hear Egemen. :-TU

#10

Cant wait for it!

#11

Very nice, thanks for your job. We’re looking forward to it … :-TU

#12

:-TU :-TU :-TU
Great news

#13

Wonderful news. Thank you! :slight_smile:

#14

Released. Pls check build 2075.