Malware test CIS 8 on youtube and 6 trojans recognized by "HITMAN PRO"

[Citizen_K]

According to the head developer

@egemen post:62

Right so the new default configuration keeps track of files downloaded from the Internet or coming from the removable or network based media. We have collected telemetry information for about 2 years and found out that automatically sandboxing unknown executables from these sources will prevent infections.

In your case, you are testing with some VMs and have specific scenarios. You need to fine tune either CIS or your environment. CIS is flexible though. By all means you can simply switch to old way of doing things. All you need to do is to go to Rules #3 in auto-sandbox policy and remove all source criteria.

I attached the screenshot.

May be the issue is related to the advanced users who download malware archives from the web, copy archives with malware to a virtual machine and possible other actions that get rid off the ADS?