Microsoft Outlook 2010 everything is sandboxed

Comodo Internet Security - CIS AV False Positive/Negative Detection Reporting
#1

Hello,

   I can't for the life of me figure out why

Microsoft Outlook 2010 and anything to do with
it is Sandboxed! ???

It's in my safe files, but deletes itself from my own

safe files.

Q:\140062.ENU\Office 14\outlook.exe

Odd why is it accessing q drive? Not sure it's a new computer

with Windows 7 Pro x64.

  I added it as a running process and it works until I reboot

and it gets sandboxed again over and over. Or if I go to View defence + events
and from there find Q:\140062.ENU\Office 14\outlook.exe and add it again to safe files works
but is a pain to do it each time I boot-up.

Also, I tried to add it to my Trusted Software Vendors, but it say’s
The file does not seem to be a valid signed executable.

So I can’t put it in there either.

  There must be a fix?

   Please somebody help!

                      Thanks for your time.
How long does it take? Please
#2

Hi Larry404,

Please submit the file at Comodo Antivirus Database | Submit Files for Malware Analysis.

Thanks and Regards,
suhaifeng

#3

also please submit the file to http://www.virustotal.com and post a link for me to see, thanks.

#4

MS Office 2010 uses a virtual drive - hence the Q drive. This could be the reason for continued sandboxing.

John

#5

To only add to John’s comment. Is your Outlook on an external USB/eSata drive?Or on a Truecrypt or otherwise encrypted drive?

At John.What makes you think Q is a virtual drive?

#6 
     Thank you sahaifeng, all done!  :)

languy99,

  Here's the link:

http://www.virustotal.com/reanalisis.html?57bafea676a4b061192497b83b238027f4d6a89c7b6da06284507075abe25ab0-1280199743

And EricJH.

 It's on my c:drive. And as far as I know it's not  encrypted or on a USB drive

JJasper.

          My thoughts exactly! But how does one bypass this sandboxing,if Q drive is not there for Comodo sandbox,or that's what it's tellling me.(not such drive)



    Thanks for the reply's!  :)
#7

I guess I should have said phantom drive rather than virtual drive. although MS support says:

"Niyamath Khan Microsoft Support

This means you installed Office 2010 using Click-to-Run. Click-to-Run is based on Application Virtualization technology. The Q:\ drive is the virtual file system drive where virtualized apps “live” in the file system namespace. The Q:\ drive is not a real drive; it has no space and is not accessible from Windows Explorer or “My Computer”.

Any access to the Q: drive, including hiding or deleting it, has been removed.

John

#8

My guess would be that the virtual drive is seen as a “mounted device”. CIS behaves like it is by not remembering its rules after closing the Windows session.

That behaviour is by design as a " mounted device" cannot be monitored continuously as it can be decoupled and be hooked up to another system and get infected.

#9 
Hello EricJH,

          Thanks for helping me understand why CIS is blocking outlook,but is there away,besides shuting off the sandbox everytime I want to use outlook?

So for now I don’t use the auto block feature on the sandbox and it seems to load with no problems…so far!

                                     Thanks,Larry
#10

There are ways of trying to keep program being sandboxed. Please read Mouse1’s Introduction to the Sandbox (see my signature for link) section “How can I prevent software being sandboxed?”.

But I am afraid that may only work until the next reboot. Can you report back if that is the case or not.

#11

Hello EricJH,

If outlook is Sandboxed, or anything to do with
Microsoft Office Home and Business. I found by unchecking
The sandbox option> Automatically run unrecognized programs inside the Sandbox.
All my Problems have stopped. Just have to put the check mark back in the sandbox, after using anything to do with Microsoft Office Home and Business and all works great!

That’s my work around and no need to reboot your computer on Windows 7 Pro x64. If you uncheck that option. Also I have saved it as a safe file from an exe and a running process.

                                 Thanks, Larry
#12

Thanks for reporting back the workaround. :slight_smile:

#13 
 Hello EricJH.


                       It seems the problem has stopped. I can even have Auto sandboxed checked on and no more sandboxing!  :)   Not sure how this happened? Did your team deem it as a safe file? Anyway just wanted to tell you everything works without a work around.

                                  Thanks Larry
#14

I guess it must have made it to the safe list and that the cloud look up now deems it safe.

#15

Hello Again,

              Bad news! It’s back again everything from Microsoft Office Home and Business is Sandboxed. I did change antivirus programs. From AntiVir to Comodo and had to uninstall Comodo firewall. Bad move!  :o

So on reboot everything was back to being sandboxed. Now I have to uncheck the sandbox option (Automatically run unrecognized programs inside the Sandbox) and everything runs ok. Too bad it was great until I uninstalled it! Why won’t your team allow it? It is Microsoft after all! >:-D
Thank you,Larry

#16

It’s not my team. Thanks for giving me that much credit. (:KWL) (:NRD)

I am not a Comodo employee. All moderator are volunteers and don’t work for Comodo. You can recognise the Comodo employees with the Comodo Staff avatar