Look at attached image. Is it normal for svchost.exe to be fully virtualized? Also the first component from Comodo (CIS) seems to be Fully Virtualized as well. And whats the strangest, it says processes are trusted. Is this normal behavior or a bug?
I’ve used “Show only Sandboxed processes” in Kill Switch. I did start the Kiosk before trying this but i have fulyl exited it (using Exit button) before opening Kill Switch.
[attachment deleted by admin]
This is the same as that of sandboxie.
If you click ‘View’ Show all processes you’ll see why this happens.
The parent cmdvirth.exe starts theses svchost processes and therefor they are also run virtualized.
But wouldn’t this cause problems if Windows tries to use these virtualized svchost files? Unless it never does use these since usually there are more of them running at the same time.
Idon’t think that’s a problem. Those svchosts are virtualized copies of the real thing and they are used by other virtualized processes,if needed. The main system uses “real” ones.