In this test Fake AV Security Shield was Autosandboxed but it got installed. The tester ended the fake AV with TaskManager. I want to know instead of ending the fake AV if he would have restarted the system the fake AV would have been there or it would have been gone.
Thanxx
Naren
You can’t submit whatever failure, real or supposed, by the means of a social network video. (As far as i am concerned, i shall make a principle of never watching any).
Why don’t you provide the link to the test so everybody is able to test if he wants to on an independent basis?
did he even restart to see if comodo deleted those files that were in sandbox? he should have restarted to see if the rogue would still be there. Since he began to modify CIS he should have optimized CIS fully by having limited/restricted/untrested and not having it by default.
Regards,
Valentin N
XXXXXXXXXXXXXXXXXX (link to a malware)…pls do not post any link to malware directly…thx
This is the link for the malware. I would like to see how CIS Defaults did. I only have production machine so I can’t test.
Thanxx
Naren
I will try on my WM machine later today. I hope I don’t get infected since I have never tried any malware on WM machine.
Regards,
Valentin N
OK. I will wait for your comments. Plzz do try with CIS Defaults too.
Thanxx
Naren
okey 
My test:
This rogue is installed also with Limited and Restricted settings.
CIS completely blocks it only with Untrusted option (which I personally always use). :-TU
EDIT: It seems now that CIMA catches it…CloudBehavior.Suspicious…
Thanks for testing it !ot! do you use WMware’s Wmplayer?
Regards,
Valentin N
Did you tried it with CIS Defaults. And did you restarted the system to check if its there or gone.
Thanxx
Naren
[at]Valentin: Yes, the test was made on VMware Player 3.1.3
[at]naren: Yes, I restarted the system and it was not active. There is a shortcut in Start>Programs but when I launched it, it got caught by CIMA and vtkrxjszr.exe was erased from ApplicationData folder.
I tested it on VMware Workstation and the fake AV is installed on default settings. I terminated it with KillSwitch and restarted computer. Nothing was there after that. :-TU
[attachment deleted by admin]
so if someone is installing and it gets sandboxed then it will be away after the restart/reboot?
I think so. 
But anyway, I recommend using Untrusted option at first place.
Only if he terminates it in Task Manager.
okey thanks for the answer.
I tested it on my self, and D+ on proactivemode(without sandbox) blocked it well.
It is installing its executable in a non protected folder c:\users%username%\local\ . That’s how it got past.
and how do I find this? I have tried all combos but no success. Thanks
Regards,
Valentin N
Start > Run > %userprofile%\Local Settings
or in Vista/7
Start > Run > %userprofile%\Local
Hope this helps
Jake