File run right-click sandboxed kills real explorer - maybe via logoff [M241][v6]

[SanyaIV]

@mouse1 post:1011

Here, running in KIosk, the virtualised virtkiosk processes got terminated, and the virtualised copy of explorer.exe was terminated.

FV files are I think allowed to terminate FV processes, though I feel termination of virtkiosk and maybe explorer might be protected

However I did not start it in virtual kiosk, I right clicked it and manually sandboxed it. I’d assume that it perhaps started a virtualized explorer.exe? and then that got killed, but that shouldn’t kill my real explorer.exe, should it? Try doing it the way I explained and see if you get the same results as me, well, if you want to that is =P I’d like to see the results myself though.

[mouse1]

@SanyaIV post:1

However I did not start it in virtual kiosk, I right clicked it and manually sandboxed it. I’d assume that it perhaps started a virtualized explorer.exe? and then that got killed, but that shouldn’t kill my real explorer.exe, should it? Try doing it the way I explained and see if you get the same results as me, well, if you want to that is =P I’d like to see the results myself though.

No it shouldn’t, as I understand it, :). I’ll check.

[mouse1]

@SanyaIV post:1

However I did not start it in virtual kiosk, I right clicked it and manually sandboxed it. I’d assume that it perhaps started a virtualized explorer.exe? and then that got killed, but that shouldn’t kill my real explorer.exe, should it? Try doing it the way I explained and see if you get the same results as me, well, if you want to that is =P I’d like to see the results myself though.

Confirmed

Bug I think. Would you like to report it?

Seems to me that the RT click is running a virtkiosk instance, but no explorer instance, which is what happens in Kiosk. That’s why it’s different.

But from Kiosk NV processes seem protected from standard kills by FV processes - I tried several while investigating FV.

I guess it’s a non-standard kill, but will investigate.

Best wishes

MOuse

[mouse1]

Further discussion in bugs I think. Will split.

[mouse1]

PM sent

[DrHaze]

I right clicked on explorer.exe in the Syswow64 directory under windows, run in sandbox just to see what that would do. it worked fine attached is screen shot of what it does. outside the kiosk on win 8 x64. ill try the kiosk now…
Inside the kiosk i could right click on explorer.exe and run in sandbox and ran it again as administrator and had no crash at all. just same window as in screenshot pulled up. I then exited the kiosk and went to the comodo internet security directory and right clicked on vitrkiosk.exe and said run in sandbox and it still didn’t crash. Kiosk launched and then from inside the kiosk i tried right clicking on virtkiosk.exe and said run in sandbox and it just did nothing and kiosk kept running.

[attachment deleted by admin]

[SanyaIV]

@DrHaze post:6

I right clicked on explorer.exe in the Syswow64 directory under windows, run in sandbox just to see what that would do. it worked fine attached is screen shot of what it does. outside the kiosk on win 8 x64. ill try the kiosk now…
Inside the kiosk i could right click on explorer.exe and run in sandbox and ran it again as administrator and had no crash at all. just same window as in screenshot pulled up. I then exited the kiosk and went to the comodo internet security directory and right clicked on vitrkiosk.exe and said run in sandbox and it still didn’t crash. Kiosk launched and then from inside the kiosk i tried right clicking on virtkiosk.exe and said run in sandbox and it just did nothing and kiosk kept running.

I guess it should have been mentioned that this topic is about this leaktest: http://www.testmypcsecurity.com/securitytests/regtest.html
However now in the latest version .2708, I no longer get the issue, so I think it has been solved.

[DrHaze]

Ok. This doesn’t look like anything im going to test.
My PC is running fine and it suggests i back up my registry before running it so I think I will pass.

[mouse1]

OK I have logged it, in case it appears again, but marked it resolved for the present.

[mouse1]

We believe this problem to be resolved, so I am moving it to resolved issues. If you feel it is not resolved, now or at any time in the future, please PM an active mod who will move it back to the main board for consideration. When it is moved please add to the topic your reasons for believing it not resolved.

Best wishes

Mouse