Kiosk crash/termination leads to inop syst until force rbt/logoff [M550]

Comodo Internet Security - CIS Format verified Issue Reports - CIS
21

I’m sorry, but as I am unable to reproduce it, the only way I can forward it is if someone who is experiencing this issue creates a formatted bug report. It’s likely then that there is something particular about the systems, either configuration, other installed programs, hardware, etc… which is causing this.

Without enough information to diagnose that I’m afraid the devs would not be able to solve this.

22

After killing Virtual Kiosk processes, details provided below, if I try to launch virtkiosk.exe from sandbox mode: the bar at the bottom reappears (I use Touchscreen mode), but if I click button to return to Windows, it doesn’t work and if I click Exit button I pass to a black screen, because I’m still in the sandbox mode but processes are closed. If I press CTRL+ALT+DEL, I go to a logonui.exe screen and if I want to start the Task Manager, it will be open out of black screen and so I can’t see it.

A. THE BUG/ISSUE (Varies from issue to issue)
[ol]- Summary - Give a clear summary in the topic subject, NOT here.

  • Can U reproduce the problem & if so how reliably?:
  • If U can, exact steps to reproduce. If not, exactly what U did & what happened:
    Option 1

• Start Virtual Kiosk;
• In Virtual Kiosk, open a folder. In the folder path (in the top) write “c:\windows\system32\taskmgr.exe”. So it will run.
• Find virtkiosk.exe processes and kill them.

Option 2

• Start Virtual Kiosk;
• Download Process Explorer from here Process Explorer - Sysinternals | Microsoft Learn.
• Extract procexp.exe and run it in the Virtual Kiosk environment.
• Kill virtkiosk.exe processes. The first time kill first the virtkiosk.exe parent and then the child, the second time kill first the virtkiosk.exe child and then the parent. The child is placed under the parent.

Option 3

• Start Virtual Kiosk;
• Open Killswitch in the Virtual Kiosk.
• Kill virtkiosk.exe processes.

  • If not obvious, what U expected to happen:
    The user should be able to return to Windows.
  • If a software compatibility problem have U tried the conflict FAQ?:
    NA
  • Any software except CIS/OS involved? If so - name, & exact version:
    NA
  • Any other information, eg your guess at the cause, how U tried to fix it etc:
    Don’t know.
  • Always attach - Diagnostics file, Watch Activity process list, dump if freeze/crash. (If complex - CIS logs & config, screenshots, video, zipped program - not m’ware)
    [/ol]

B. YOUR SETUP (Likely the same for each issue, so you can copy forward)
[ol]- Exact CIS version & configuration:
Comodo Firewall 6.2.282872.2847. Proactive Security.

  • Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
    I enabled HIPS in Safe mode. Advanced Protection Mode enabled
  • Have U made any other changes to the default config? (egs here.):
    I enabled HIPS in Safe mode. Advanced Protection Mode enabled
  • Have U updated (without uninstall) from a CIS 5?:
    [li]if so, have U tried a a clean reinstall - if not please do?:
    [/li]- Have U imported a config from a previous version of CIS:
    [li]if so, have U tried a standard config - if not please do:
    [/li]- OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
    Windows 7 Professional 32-bit
  • Other security/s’box software a) currently installed b) installed since OS: a=Avira Free Antivirus b=ZoneAlarm Free Firewall, Online Armor Free, Microsoft Security Essentials.
    [/ol]

I quickly written this post. I will post more details when I have more time.

I’m waiting for an answer.

P.S.: excuse me for my English :slight_smile:

Richard

23

I have added the framework for the correct format into your above post. I also filled in any information I could.

Most of what needs to be there for a bug report is now in place. However, I still need some more information from you. Please answer the following questions.

Did you update from CIS 5?
If so, did you uninstall CIS 5 and then install CIS 6, or did you install CIS 6 over CIS 5?

Also, did you import a configuration from a previous version of CIS?

Also, do you have UAC enabled?
Are you running your computer as an administrator or did you switch to a limited account?

In addition to the answers to these questions the only other things I need from you are for you to attach your diagnostics report and the Process List. If you’re not sure about how to get either of these, or have questions about the above questions, please feel free to ask me. I am absolutely willing to help and would really like this bug to be addressed.

Thank you.

24

I can tell you I have not upgraded from a previous version and I have UAC cranked on maximum. I mention that because that is a windows setting that I manually set to its highest setting possible and then make it ask for a username and password on the secure desktop when admin actions are needed. As for specific config and details about software/processes I am running I cannot give that out.

25

For a bug like this, which may be complicated, this sort of information is required for a bug report. Thus, let’s hope that RickyDefended will be able to supply enough information for a bug report.

26

Answers for Ciron

Did you update from CIS 5? Yes, I did.
If so, did you uninstall CIS 5 and then install CIS 6, or did you install CIS 6 over CIS 5?
I installed CIS 6 over CIS 5. But after I needed to uninstall CIS 6 and reinstall it.

Also, did you import a configuration from a previous version of CIS?
No, I didn’t.

Also, do you have UAC enabled? Yes, level 4 (the max).
Are you running your computer as an administrator or did you switch to a limited account? Administrator

Main format (I don’t know if I did it well):

A. THE BUG ISSUE (Varies from issue to issue)
[ol]- Summary: Pls give a clear summary in the topic subject, NOT here.

  • Can U reproduce the problem & if so how reliably?: Always.
  • If U can, exact steps to reproduce. If not, exactly what U did & what happened:
    a. I launched Virtual Kiosk.
    b. In the Virtual Kiosk, I launched Process Explorer, downloadable here: Process Explorer - Sysinternals | Microsoft Learn (here there is v15.31, I used v15.3, therefore I attached Process Explorer that I used).
    c. I killed the virtkiosk.exe child process without errors using Process Explorer in Virtual Kiosk (child is under the parent).
    d. I killed the virtkiosk.exe parent process without errors using Process Explorer in Virtual Kiosk.
    e. Desktop and bar in the bottom disappeared. Now I can’t return to the Windows environment.
    This happened also with some viruses that I executed in Virtual Kiosk: they kill all the processes they can, and so when I launched them the bar in the bottom disappeared and so I cannot return to the Windows environment without the log off. These steps can be done also with Killswitch.
  • If not obvious, what U expected to happen: virtkiosk.exe processes should be protected against processes inside (and preferably also outside) Virtual Kiosk. They should not be able to kill Virtual Kiosk processes.
  • If a software compatibility problem have U tried the conflict FAQ?: I don’t think is a software compatibility problem.
  • Any software except CIS/OS involved? If so - name, & exact version:
    Process Explorer v15.3
    Comodo Killswitch 6.2.282872.2847
  • Any other information, eg your guess at the cause, how U tried to fix it etc:
  • Always attach - Diagnostics file, Watch Activity process list, dump if freeze/crash. (If complex - CIS logs & config, screenshots, video, zipped program - not malware)
    [/ol]

B. YOUR SETUP (Likely the same for each issue, so you can copy forward)
[ol]- Exact CIS version & configuration: Comodo Firewall 6.2.282872.2847, Proactive

  • Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV: D+/HIPS enabled = Safe, Autosandbox/BBlocker enabled = Not safe (Non sicuro), Firewall enabled = Safe, File evaluation = Cloud, I believe Comodo Firewall (free version) haven’t got the AV but I’m not sure.
  • Have U made any other changes to the default config? (egs. here):
    Yes. In the firewall, I enable the filter for the IPv6 and loopback traffics, the filter for the frammented IP traffic, the analysis for the protocols but the anti ARP spoofing isn’t enabled.
    In the HIPS I didn’t check the textual popup advices and I didn’t enable the adaptive mode. The advanced protection mode is enabled (Modalità di protezione avanzata).
    In the HIPS rules I setted only Cheat Engine because it isn’t recognized by Comodo and else it show each time advices about it.
  • Have U updated (without uninstall) from CIS 5: Yes, but after I uninstalled it and installed the CIS 6.
    [li]if so, have U tried a a clean reinstall - if not please do?: Yes.
    [/li]- Have U imported a config from a previous version of CIS: No
    [li]if so, have U tried a standard config - if not please do:
    [/li]- OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
    Windows 7 Professional, SP1, 32bit, UAC=Max level (4), admin, VM not used
  • Other security/sandbox software a) currently installed b) installed since OS:
    a) Avira Free Antivirus 13.0.0.3640 b) None
    My previous security software were ZoneAlarm and Online Armor. Before installing Comodo, I uninstalled ZoneAlarm and installed Online Armor. Then I uninstalled Online Armor and installed Comodo.
    [/ol]

[attachment deleted by admin]

27

Great bug report. Thank you very much.

However, I thought you had previously said that other AV’s had previously been installed on the computer. If so these should be included in B7.

Also, if you can please upload one of those pieces of malware which also cause this to VirusTotal and put a link in your bug report. This will allow me to flag it as critical, which usually means greater attention, as the link would prove that there are currently malware out there in the wild which can cause this.

I will forward it as soon as you have added the VirusTotal link.

Thanks.

28

Excuse me, what is B7?

Can I attach virus here in a password protected archive?

29

Sorry, this is the part which states “Other security/sandbox software a) currently installed b) installed since OS”. I’m asking whether other security software used to be installed on the computer, but is now removed. That is what should be listed in part b.

Sure, just don’t post the password in your bug report. Tell the devs that they can contact you for the password.

30

Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.

Developers may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

Many thanks again.

31

Can you please check and see if this is fixed with the newest version (6.3.294583.2937)? Please let us know whether it is fixed or you are still experiencing the problem.

Thank you.

PM sent.

32

Can you please check and see if this is fixed with the newest version (7.0.313494.4115)? Please respond to this topic letting us know whether it is fixed or if you are still experiencing the problem.

Thank you.

PM sent.

33

The devs are not able to replicate this behavior. Therefore, this seems that it may have been fixed. I will therefore move this to Resolved.

RickyDefended, if you are still experiencing this issue please let me know and I can move it back for further processing.

Thank you.

34

Hello,

Excuse me if I took so long to reply. I was very busy and I am not english, so I took a lot of time to write this post (and I hope it is grammatically correct).

I am sorry with version 7.0.317799.4142 the problem still occurs.
To reproduce this problem, follow these steps:

  1. Download packaged version of Process Explorer from here (Process Explorer - Sysinternals | Microsoft Learn);
  2. Extract only “procexp.exe” program, and put it on the Desktop;
  3. Start Virtual Kiosk desktop
  4. Click the “C” (bottom-left corner)
  5. Click “Settings” (third option starting from the bottom) in the menu that appears
  6. Instead of tablet mode, set classic mode
  7. Find “procexp.exe” on Desktop
  8. Right-click on “procexp.exe”, then launch it as administrator
  9. If an UAC message appears, answer Yes
  10. If the processes view is not tree view (in tree view child processes are below their parents and a bit more right than them), then click “Show Process Tree” (this button should be just below the row with “File”, “Options”, “View” etc menus, you can check if it is the right button by leaving mouse pointer on it and waiting, the description of the button should appear after a while)
  11. Click “Options” menu, then uncheck “Confirm Kill”
  12. There should be a “virtkiosk.exe” process with a “virtkiosk.exe” child (the latter should be below the first, and a bit more right than the first). Click it once with the left button (practically select it).
  13. Press Del, so it will be killed
  14. You should immediately come to the normal environment, so open the Virtual Kiosk again.
  15. You should find Process Explorer still open
  16. Select again the virtkiosk.exe parent process (the virtkiosk.exe process above the virtkiosk.exe child process)
  17. By pressing Shift-Del on keyboard, Process Explorer should kill both virtkiosk.exe parent process and virtkiosk.exe child process
  18. Now what happens in my PC is that the bar at the bottom disappears and so I can’t come back to the normal environment (outside Virtual Kiosk). So the problem occurs again

Explaination
When you launch Virtual Kiosk, a program called “virtkiosk.exe” placed in the same folder with “cis.exe”, “cistray.exe” and other Comodo programs will be executed. It runs another “virtkiosk.exe” process, which we will call child of the first “virtkiosk.exe” (that we will call the parent process). The child executes all the applications the user want to execute. So you can execute everything, including, in this case, Process Explorer. After Process Explorer loads, it is possible to kill each process in Sandbox (including the two virtkiosk.exe processes, that seem to be considered in Sandbox). If you kill any of the virtkiosk.exe processes (only one of the two processes), the other exits and you return in the normal environment. Because it’s difficult to kill two processes at the same time for technical reasons (you should press Del button twice almost instantly), we can use the option “Kill Process Tree” of Process Explorer. But Process Explorer is a child of the second virtkiosk.exe process, so, if we try this option, Process Explorer will kill itself before trying to kill one of the two virtkiosk.exe processes. So we will kill one of the two virtkiosk.exe processes (in this case the parent), the other will exit and the tree will no longer exist. When we start again Virtual Kiosk, we will find Process Explorer (that is still running). Before, Process Explorer was the child of the second virtkiosk.exe, but now the new virtkiosk.exe child isn’t the parent of procexp.exe (because the parent of procexp.exe is a process that doesn’t exist anymore), so in the tree of virtkiosk.exe we will find only two processes: the first virtkiosk.exe (the new parent), and the second virtkiosk.exe (the new child). We are now able to kill the tree without killing Process Explorer itself. So we will select the virtkiosk.exe parent and then we will press Shift-Del (that is the shortcut for Kill Process Tree). So almost instantly Process Explorer will kill the two processes (like some viruses could do), and magically the bar at the bottom disappears. Now you can’t return back to the normal environment and you need to lose your data on which you were working at that moment (for example open documents, browser pages etc), because you need to do something as a log off (with ctrl-alt-del) or a shutdown, or a reboot etc that will close the Virtual Kiosk environment. We needed to open Virtual Kiosk twice just due to pratical reasons. If you aren’t quick enough, the problem won’t occur. Instead, viruses could kill both processes in a very small amount of time and so this problem will occur. A good thing to resolve the problem is to protect virtkiosk.exe processes from being killed by Sandboxed processes.

Another way to get this working
So, as I said above, the problem is that when we kill a virtkiosk.exe process, the other take you to the normal environment. And what will happen if we suspend both the two processes before killing them? Doing that, the process that would take you to the normal environment is “freezed”, and doesn’t do anything. So you have enough time (practically infinite) to terminate both processes, without one of the two processes is able to react. This is a faster way to replicate this behavior, thus it is possible to create a new list of steps to do this:

Steps for the second way
The first 10 Steps are the same of the first way. It isn’t necessary to uncheck “Confirm Kill”, but you can uncheck it if you want.
11) Find one of the two “virtkiosk.exe” processes, then right-click on it, and choose “Suspend”. The process should become gray.
12) Find the second “virtkiosk.exe” process, then suspend it like in Step 11
13) After both processes have been suspended, start killing them. Kill both processes in the order you like the most. If “Confirm Kill” is checked, you have to answer “Yes” each time Process Explorer asks you if you want to kill the selected process.

The second way is faster than the first way, and it should work as well as the first one.

If you have any problem to replicate this behaviour, please let me know

Thank you for considering my problem (and excuse me if I needed a lot of time to reply, I was very busy),

RickyDefended

35

Thank you for checking this. I have added this information to the tracker, re-opened this issue in the tracker, and moved this bug report back to Format Verified.

Thanks again.

36

The devs have not marked this as Fixed in the tracker. However, sometimes bugs are fixed by the release of new versions, but not marked as Fixed in the tracker.

If you are able please check with the newest version (CIS version 8.0.0.4337) and let me know if this is fixed on your computer with that version.

Thank you.

37

Hello,

The devs have not marked this as Fixed in the tracker. However, sometimes bugs are fixed by the release of new versions, but not marked as Fixed in the tracker.

If you are able please check with the newest version (CIS version 8.1.0.4426) and let me know if this is fixed on your computer with that version.

Thank you.

38

Please check with Comodo Internet Security V10.0.0.6071 Beta thanks.