Malware Kills Internet Connection When Sandbxed As Partially Limited [M1164]

A. THE BUG/ISSUE (Varies from issue to issue)

Can U reproduce the problem & if so how reliably?:
Every time
If U can, exact steps to reproduce. If not, exactly what U did & what happened:
1:Run the script sandboxed as Partially Limited and see that it is able to kill the internet connection.
One or two sentences explaining what actually happened:
After running a script file “bat” inside the Sandbox partially limited Patch disconnect the Internet.
One or two sentences explaining what you expected to happen:
At the default settings the sandbox must be able to protect the internet connection from being disabled by sandboxed apps.
If a software compatibility problem have you tried the conflict FAQ?:
NA
Any software except CIS/OS involved? If so - name, & exact version:
NA
Any other information, eg your guess at the cause, how U tried to fix it etc:
Not sure.

B. YOUR SETUP
Exact CIS version & configuration:
CIS 7.0.317799.4142
Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
Default configuration (except Viruscope is enabled)
Have U made any other changes to the default config? (egs here.):
Just enabling Viruscope
Have U updated (without uninstall) from CIS 5 or CIS6?:
No
if so, have U tried a a a clean reinstall - if not please do?:
NA
Have U imported a config from a previous version of CIS:
No
if so, have U tried a standard config - if not please do:
NA
OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
In real system , windows 7 x64
Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
a=None b=None

Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.

Developers may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

Many thanks again.

The problem is not solved in Default setting “Run virtually”

Do you mean that with CIS version 8.0.332922.4281 this same malware is now able to kill the internet even if sandboxed correct as Fully Virtualized?

Exactly

Please create a separate bug report for this in the Beta section of the forum. I think this sort of vulnerability is important enough to warrant it’s own report, even though it is the same application.

Thanks.

ok,thanks :-TU

Hi SD Ahmad,

Devs have marked this issue as “Fixed” in version <8.0.0.4314>. Please verify.

Thanks.

Yes, the problem was solved in version 8 Beta

I’m sorry the error, I was my intention to put this post in this issue
https://forums.comodo.com/format-verified-issue-reports-cis/malware-able-to-restart-computer-even-if-sandboxed-as-limited-and-above-m1060-t105688.0.html

I’m sorry, but I’m not sure why you wanted to put this link in your previous reply. Do you mean that both this bug, and the one in that link, are both fixed with this Beta?

Thanks.

In this issue the problem is not solved,But this link topic problem has been resolved
https://forums.comodo.com/format-verified-issue-reports-cis/malware-able-to-restart-computer-even-if-sandboxed-as-limited-and-above-m1060-t105688.0.html

Thanks, I have responded to the other topic and updated the tracker for this issue.

The devs have not marked this as Fixed in the tracker. However, sometimes bugs are fixed by the release of new versions, but not marked as Fixed in the tracker.

If you are able please check with the newest version (CIS version 8.0.0.4337) and let me know if this is fixed on your computer with that version.

Thank you.

Please Chiron, delete this topic because it already exists

https://forums.comodo.com/format-verified-issue-reports-cis/in-sandbox-commands-issued-from-command-line-affect-real-system-m620-t107034.0.html

Thanks for pointing this out. For the moment I will not close this issue, but I have asked in the tracker how they would like to proceed.

Thank you.

Fixed in cis 9 beta.

In that case, I will move this one to “Resolved” section.
Thank you.