Comodo tmpscript

[fjordhammer]

I do not exactly know where to post this.

What is comodo tmpscript powershell.exe? I have now more than 512 files and when I tried to upload them comodo because comodo asks for it gets stuck and sending is failed. What is this script doing or is this malware activity that is detected as unknown malware, I have now removed all the files uploading to comodo gets stuck and stuck.

[ZorKas]

@fjordhammer post:1

I do not exactly know where to post this.

What is comodo tmpscript powershell.exe? I have now more than 512 files and when I tried to upload them comodo because comodo asks for it gets stuck and sending is failed. What is this script doing or is this malware activity that is detected as unknown malware, I have now removed all the files uploading to comodo gets stuck and stuck.

This is a known issue, the report has been made
File submission does not consider .bat files
You can delete them

[C.O.M.O.D.O_RT]

Hi fjordhammer,

Thank you for reporting.
The tempscripts are safe and it’s not malware.
kindly refer the below link for further detail of the tempscript.
https://forums.comodo.com/defense-sandbox-faq-cis/why-are-all-these-comodocreated-batch-files-getting-sandboxed-t117693.0.html;msg848092#msg848092

Thanks
C.O.M.O.D.O RT

[fjordhammer]

Okay, I checked 478 tmpscripts files and checked first the log. 192 tmpscripts are blocked by HIPS it means dangerous ■■■■ and for me again a warning that something is not ok. I checked all 478 tmpscripts and not 192 tmpscripts are dangerous but more than 345 are dangerous while Comodo HIPS blocked 192 files. When attempting some PowerShell ■■■■, then Comodo reacts again and block the action. Comodo must fix this, all those files are unwanted and should never be saved to the disk, it is asking for problems. So I deleted all those nasty tmpscripts and override it securely.

[C.O.M.O.D.O_RT]

@fjordhammer post:4

Okay, I checked 478 tmpscripts files and checked first the log. 192 tmpscripts are blocked by HIPS it means dangerous rubbish* and for me again a warning that something is not ok. I checked all 478 tmpscripts and not 192 tmpscripts are dangerous but more than 345 are dangerous while Comodo HIPS blocked 192 files. When attempting some PowerShell rubbish*, then Comodo reacts again and block the action. Comodo must fix this, all those files are unwanted and should never be saved to the disk, it is asking for problems. So I deleted all those nasty tmpscripts and override it securely.

Hi fjordhammer,

Thank you for reporting.
We will take this to the team notice and update you.

Thanks
C.O.M.O.D.O RT

[cuser]

Got this and bit more just now, 1st CIS was running it’s pshell scripts (by containment log) and then CIS asked if compattelrunner.exe allow access to pshell (create process and I allowed it) and then CIS announced that it has blocked (contained) c_powershelllotsofnumbersandletters.ps1 and ran it virtually.

So I assume that CIS prevented E.T. (Win10) to call home (Microsoft).

[domo78]

Hi C.O.M.O.D.O_RT,

When I clink on the link I got this:
“Oops! That page doesn’t exist or is private.”

[C.O.M.O.D.O_RT]

Hi domo78,

Here is the link:

Why are all these Comodo-created batch files getting sandboxed?

This is new technology to protect you from file-less scripts as Egemen explains here. To prevent these scripts getting sandboxed, so long as you are sure they are safe, you just add the batch files to trusted files. Kind regards Mouse

Thanks
C.O.M.O.D.O RT