Comodo Sandboxing

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
#1

Comodo sandbox is repeatedly reporting that it has sandboxed Xq0.exe and the separately Xq1.exe. It has been happening now for a week. How can this be repaired or stopped? No upgrades are available.

#2

Go in Sandbox and see what is there and remove or Add what you want: Defence+ → Sandbox → Add a Program to Sandbox

#3

Please add the files to My Safe Files and re-start them, or reboot the computer.

Best wishes

Mouse

#4

those look like malware, don’t add to safe list.

http://www.prevx.com/filenames/2724614024501430733-X1/XQ0.EXE.html

submit them to virustoal.com to make sure they are safe first.

#5

Agreed. If languy thinks its malware it probably is! Will leave it to him to guide you!

Best wishes

Mouse

#6

Can you please upload these files to virustotal and post a link to the results?

#7

Original Poster used “Report to moderator” to reply, not sure why but I’ll post the reply here:

#8
Comodo points to; c:\users\gordon\appdata\locals\temp\Xq0.exe

If these files don’t show up in explorer there are 2 possibilities

  1. the files are hidden, either for explorer or by a rootkit.
  2. the files where present but are no longer there, only some shortcut, or Scheduled Task still tries to execute them.

Can you please verify if there are Scheduled Tasks that try to start these files, if so then Sandbox will still alert you that these run sandboxed, even though the files no longer exist.

#9

Thanks to Ronny’s assistance I think we have found scheduled tasks using autoruns that mention xq0.exe and xq1.exe. These have been deleted and I’ll see if I get anymore Comodo sandboxing questions. Thanks Ronny!