HIPS does not alert for folder creation [M1459]

A. THE BUG/ISSUE (Varies from issue to issue)
Can you reproduce the problem & if so how reliably?:
?
If you can, exact steps to reproduce. If not, exactly what you did & what happened:
1:The protected file E:*
2.With mistrust program creates folder in E disc Not intercept,Create the file will intercept

One or two sentences explaining what actually happened:
The running time of a virus, found to create file interception, create folders do not intercept

One or two sentences explaining what you expected to happen:
To create files and folders are prompted to intercept

If a software compatibility problem have you tried the advice to make programs work with CIS?:
?
Any software except CIS/OS involved? If so - name, & exact version:
?
Any other information, eg your guess at the cause, how you tried to fix it etc:
I wrote a program test, first set up the E disk as the protection of the file, and then run this program.

B. YOUR SETUP
Exact CIS version & configuration:
CIS 8.0.0.4344, Proactive Security
Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
Default

Have you made any other changes to the default config? (egs here.):
Antivirus:
“Do not show antivirus alerts”: disabled

HIPS:
Insane Mode
“Create rules for safe applications”: disabled

Auto-Sandbox: disabled
Firewall: disabled

Have you updated (without uninstall) from CIS 5, 6 or 7?:
No
if so, have you tried a clean reinstall - if not please do?:
?
Have you imported a config from a previous version of CIS:
?
if so, have you tried a standard config - if not please do:
?
OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
win7x32 sp1
Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
a=sandboxie b=?

C. ATTACH REQUIRED FILES (delete this section (section C) after attaching required files)
Always attach the diagnostics file (instructions on how to do this provided here) and the KillSwitch Process List (instructions on how to do that provided here and put the resulting file in a zip file. Both should then be attached to your post.
Note that additional information may be requested by the processing Moderator.

[attachment deleted by admin]

I have pasted the required format in for you. Can you replace the ? with your answers for each question.

Thanks

It reproduces here with CIS 8.1.0.4426 x64 with Automatic Sandbox disabled. No SandboxIE installed. Only on demand malware scanners installed.

Once the diagnostics and killswitch process list is attached i will forward this bug.

PM Sent

Since the required files have not been attached i will move this to the incomplete section. Please note the devs dont often look in this section so your bug may not be fixed. Feel free to add the requested files then i can forward this to the devs.

Thanks

Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.

Developers may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

The devs have requested you try reproducing this bug with the latest beta build located here:
https://forums.comodo.com/beta-corner-cis/comodo-internet-security-8204474-beta-released-t110199.0.html

I can reproduce with the beta version, or at least I think it’s the same issue…

[ol]- Block explorer.exe from accessing D:\Test* in HIPS applications settings.

  • Use explorer to go to [b]D:\Test[/b] then try to create a .txt file (it should fail)
  • Do step 2 but try to create a folder instead, it will be able to create a folder.[/ol]

[ol]- Set up * as protected files/folders

  • Run Test Viruscope.exe (my own test application, unknown) and run choose option 10 and run the command mkdir Test which will then create the folder Test without question; trying to create a file will result in question from HIPS.[/ol]

I believe the fundamental issue is the same in both scenarios detailed above and the one reported in the bug report, and this fundamental issue has not been fixed.

Thank you very much for testing this. I will update the tracker with this info.

Not fixed in version 8.2.0.4591

I’ve updated tracker data.

Thanks.

Not fixed in 8.2.0.4704 as any new folder created in any path does not alert for the creation of the new folder, however when attempting to delete a folder a HIPS alert will be shown. I tested this by running the mkdir command from a command prompt and then deleting the folder with rmdir with HIPS set to paranoid mode and having the new folder created on the desktop.

I’ve updated tracker data.
Thank you.

We got word from Umesh

New folder creation is not a security risk, so it is by design.

Moving this to resloved