Comodo not blocking Virtualbox

I use Virtualbox for testing and would like Comodo to ask me anytime it gets online. I know for sure that it used to. It has been a while since I used it and I noticed today that it does not notify me when it gets online. I double checked my application rules and there is nothing mentioning Virtualbox.exe in there. I can open IE in the guest system and Comodo pops up telling me that it is accessing the socks interface and then it gets online. I know that it used to pop up saying Virtualbox.exe is accessing whatever IP:Port. Did something change in Virtualbox enabling it to “sneak” by Comodo? If this is the case, couldn’t a piece of malware do the same? I know that Virtualbox.exe is the process that is used to get online because that is what shows in Killswitch as accessing the internet.

Please make sure to set the Firewall to Custom Policy Mode. That way you will get alerted for every program accessing the web.

I see the same on both Win7-x64 and Win8-x64, running the latest virtualBox 4.3.4. I have Comodo Internet Security installed (the latest version on Win8, and old version on Win7), running in Custom Policy Mode.

Comodo DOES NOT DETECT OR ASK about any network activity by VirtualBox.exe. So you can have any sort of viruses and malware running inside the virtual machine, and it will be never detected by Comodo.

Furthermore, any viruses running on the host machine will be never detected by Comodo, if they behave the same way as VirtualBox.exe.

To be honest I’m a bit shocked with the results. When do they plan to fix it?

Hey Locos

Could you check in your Application Rules and let us know what you have there ( or even a screenshot would be nice of Virtualbox.exe and it’s associated files).

Thanks…Jake

There are no rules in Application Rules for VirtualBox.exe.

I’ll try to test this and see If I can come up with anything.

Just to make sure; Firewall is set to Custom Policy Mode Correct? and Nothing is in the Application rules.

Jake

Yes, that is correct. There are no rules for VirtualBox.exe, but there are some rules for other apps.

I’m sure you can easily reproduce it. I was able to browse internet inside the virtual machine, and there were no alerts from Comodo.

I cannot produce the events you are talking about…

Firewall Set At Custom Policy Mode with Alert Frequency Level set at Low
Please See Firewall Behavior Settings, PC Firewall, Firewall Protection | Internet Security v6.2
As If you have it set to Low you will only see one alert and thats it.

I installed VBox(After installation and start VBOX It alerted me of A HTTP Request from Virtualbox.exe (most likely for update check/registration. Than I clicked allow this request and according to the above statement this will allow full access for virtualbox.exe, and I went online with it and just as you state no alerts no notifications what so ever; So I delete the Virtualbox.exe from application rules and set the Frequency level to a higher level and received alerts for everything Virtualbox wanted to do.

If you have “Alert Frequency level” Option disabled it seems that it only shows one alert per applications according to “Low” setting

If you want it to remind you of every connection and than untick “Remember my answer” on the alert window.

Hope this helps

Jake

[attachment deleted by admin]