bypass comodo?

a256886572008 · August 14, 2011, 9:28am

1.I double click on the malware.

2.bot.exe is sandboxed as partially limited

3.then, I check the active process list

4.comodo popups an alert window

5.Is it a hidden process?

[attachment deleted by admin]

miloszcz · August 14, 2011, 9:30am

Hi.
Run process and check with KillSwitch:

a256886572008 · August 14, 2011, 9:45am

a hidden process?

[attachment deleted by admin]

miloszcz · August 14, 2011, 10:36am

Can you provide me a sample?

doskey · August 14, 2011, 11:16am

Hi a256886572008.
Could you please send the sample file to me? I PMed my email address to you just now.

We will check what happen with it.

Thanks,
Doskey.

miloszcz · August 14, 2011, 11:21am

This file doesn’t want to run on my system (XP, SP3, x32).

evil_religion · August 14, 2011, 10:05pm

@a256886572008: Thanks for providing the sample.

My guess is that the process exited already and the pop up was already in queue → pop up for not existing process.