funky \DosDevices\ protected files/folders

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
#1

I have a bevy of funky \DosDevices\ allowed for the Pirifom CCleaner installation on my system. I have no clue what they are. Anybody?

\DosDevices\c:\windows\isuninst.exe
\DosDevices\c:\program files\linkshellextension\uninst-hardlinkshellext_win32.exe
\DosDevices\c:\windows\unins000.exe
\DosDevices\e:\irfanview\iv_uninstall.exe
\DosDevices\e:\jdisk_report\uninstall.exe
\DosDevices\c:\program files\common files\microsoft shared\vsto\8.0\microsoft visual studio 2005 tools for office runtime\install.exe
\DosDevices\c:\windows\system32\nvudisp.exe
\DosDevices\c:\windows\system32\mshta.exe
\DosDevices\c:\windows\system32\javaws.exe
\DosDevices\c:\windows\isuninst.exe
\DosDevices\c:\program files\linkshellextension\uninst-hardlinkshellext_win32.exe
\DosDevices\c:\windows\unins000.exe
\DosDevices\e:\irfanview\iv_uninstall.exe
\DosDevices\e:\jdisk_report\uninstall.exe
\DosDevices\c:\program files\common files\microsoft shared\vsto\8.0\microsoft visual studio 2005 tools for office runtime\install.exe
\DosDevices\c:\windows\system32\nvudisp.exe
\DosDevices\c:\DosDevices\c:\windows\system32\javaws.exe\windows\system32\mshta.exe

#2

Where exactly are these entries? Can you show a screenshot?

#3

They’re entries ‘allowed file / folders’ tab of in the Protected files / folders access rights in the custom D+ rule-set for CCleaner (Piriform).

#4

Do you remember making these exceptions?

I just installed CCLeaner on my Win 8 installation. I did not see those entries spontaneously arise after using it. I am using CIS v6 beta 2.

Try removing the entries and see if they return or not. How long have you had CCleaner installed?

#5

I don’t rmember making those exceptions. However, they didn’t spontaneously appear; I had to allow them at one point. Resource access rules are set to ‘ask’ for all resources for all apps.

Looks like the CCLeaner installation folder was first created 2011 Mar 7 and has been patched regularly since then per update notification by CCleaner at launch. I’lll go ahead and delete them. I’m running CIS v5.12.256249.2599

FWIW, those are the entirety of \DosDevice\ rules existing for CCleaner, and moreover, in the order found (notice the duplicates). Furthermore, the files associated as \DosDevice\ each exist according to the path cited.

I may poke around and see if there are any other apps having resource access rules similar to these.

EDIT: I’ve removed those \DosDevices\ and the last version of CCLeaner seems to work w/out prollem. Furthermore, I’ve checked ALL 150 of my app rules and no app has protected file / folders referencing \DosDevicess\

Huh. Dunno.

#6

If CCleaner still functions then I guess these entries were no longer needed. That does not question how they got there or why they were there. Questions to which I have no definitive answer so I will leave them unanswered… :wink: