Office 365 Click-to-run Installer Fails

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
1

A. THE BUG/ISSUE (Varies from issue to issue)

Can you reproduce the problem & if so how reliably?:
Each time Microsoft Office Click-to-Run installer is run it fails to install.

If you can, exact steps to reproduce. If not, exactly what you did & what happened:
Clean install of Windows 10 64bit Pro 1607 - 14393.576 and CIS 10 with Secure Shopping installed then run Microsoft Office Click-to-run installer.

If a software compatibility problem have you tried the advice to make programs work with CIS?:
Disabled CIS 10 and the installer ran without any problems and Office 365 installed.

Any software except CIS/OS involved? If so - name, & exact version:
N/A

Any other information, eg your guess at the cause, how you tried to fix it etc:
.tmp files being blocked by CIS ?

B. YOUR SETUP

Exact CIS version & configuration:
CIS Premium 10.0.0.6086 with Secure Shopping.
default “COMODO - Internet Security” configuration.

Have you made any other changes to the default config?:
No

Have you updated (without uninstall) from CIS 5, 6 or 7?:
No.
if so, have you tried a a a clean reinstall - if not please do?:

Have you imported a config from a previous version of CIS:
No.
if so, have you tried a standard config - if not please do:

OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Windows 10 1607 bld 14393.576, 64 bit, UAC: default, account type: administrator , V.Machine used: No

Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
a= No b=No.

2

Can you attach your HIPS and sandbox event logs? Also can you provide the mentioned application?

3

Hi,

Sandbox Log attached as requested. The HIPS Log is empty.

The Office 365 Installer is obtained from an Office 365 Home Premium account. Logging into the account allows an installer to be downloaded for installation and has a licence built in so as to lock to your account. An installer can be provided by PM for COMODO Developers to check, but unfortunately this would only be available for a short period as there is a limit on Licences for the account and one will have to be removed from one of my machines for this time.

4

Ok thanks I wonder if it can be downloaded through a trial account. Also when you run the installer does the active processes list show the rating as Trusted/Installer? or just trusted? Because it could be that CIS is not detecting it as an installer so whenever it runs cmd.exe with arguments, due to the new embedded script detection HIPS setting, it gets converted to a .bat file which is saved in the C:\ProgamData\Comodo\Cis\tempscrpt\ directory as its own script, which is then sandboxed as seen in you sandbox logs.

5

Hi,

When the installer is run it opens three processes.

The initial process is the setup O365 and is classed as ’ Trusted/Installer ’ in the active process list, Then a sub process is started with the same name and is classed as ’ Trusted/Installer ’ and then another sub process is started call Click to Run and this is classed as ’ Trusted '.

6

Can you try again with the newest hotfix release and also export your active configuration. I wonder if the file rating setting ‘trust files installed by trusted installers’ was not working right with the last release as the one fixes a bug where files where being trusted when the setting was disabled.

7

There is an old bug that seems related, M490.

I think the conclusion was some form of conflict with the virtualisation frameworks.

The OP "I suspect the issue is realated to the somewhat exotic way in which Microsoft Office Starter is installed. The Windows Start Button entries actually launch a “Virtualization Handler”. The actual Word and Excel executable appear to be located in a Q “drive”. This is not actually a drive but a virtual file system described by Microsoft here: Click-to-Run for Office 2010 - Office | Microsoft Learn . "

8

Hi, Tried the installer again with the Hotfix and worked O.K.