One strange peculiarity about CIS Sandbox

Comodo Internet Security - CIS Beta Corner - CIS
1

Hello all

For some time I’ve been experiencing a rather annoying peculiarity connected with the way the sandbox works. Namely, when sandboxing is fully operational (all options are ticked) I cannot get the Call of Duty game to launch. Why? Because CIS sandboxes a file called ~e5.0001 located in …AppData\Local\Temp folder which is crucial to running it.

I tried to add this file to My Own Safe Files, but to no avail - although I did everything in the correct way, the file never ended up on the list ???.

However, when I unticked the ‘Automatically run unregognised programs inside the sandbox’ option I got two D+ popups asking me whether to allow ~e5.0001 to innitiate the game launcher or not. This way everything worked fine.
Here’s the strange thing - having a D+ policy for the ~e5.0001 file already created, I re-ticked the ‘Automatically run unrecognised programs inside the sandbox’ option hoping to get better results. Unfortunately, the game didn’t launch leaving me even more baffled :-.

I don’t know whether this is only a bug or the way in which things work, but please clarify this to me!

I’m running a fully-patched 64bit version of Vista Home Premium SP2
Other security software: Windows Defender, AVG Linkscanner beta

2

As opposed to the above I have Win7 x32 and “Dragon Age Origives”. But All the rest is exactly the same. I think the sandbox option is still disabled due to these reasons. I have also an unfunctional voice engine using SAPI4. It works fine when the sandbox is disabled.

3

~e5.001 is part of a Macrovision CD/DVD protection mechanism. I believe it is dynamically generated each time the game is run. Bit of a PITA.

One possible reason for it failing to appear in the safe list is that it is executed off the CD/DVD.

Ewen :slight_smile:

4

Hey guys and thanks for your replies and interest in the topic.

I think you’re right panic.

As far as this is concerned I’m not so sure, but you might be right here as well.

Regards