.pdf files being sandboxed [Issue Report]

The bug/issue

  1. What you did: Opened a .pdf file from an Usb flash drive
  2. What actually happened or you actually saw: Auto-Sanbox popped -up sayind that a .pdf file was automatic sandboxed
  3. What you expected to happen or see: well sandbox shouldn’t take action on pdf files, I think
  4. How you tried to fix it & what happened: didn’t try
  5. If its an application compatibility problem have you tried the application fixes here?:
  6. Details & exact version of any application (execpt CIS) involved with download link: Adobe Reader X latest version (up to date)
  7. Whether you can make the problem happen again, and if so exact steps to make it happen:
  8. Any other information (eg your guess regarding the cause, with reasons):

Files appended. (Please zip unless screenshots).

  1. Screenshots illustrating the bug: Appended
  2. Screenshots of related CIS event logs and the Defense+ Active Processes List:
  3. A CIS config report or file.
  4. Crash or freeze dump file: Not applicable

Your set-up

  1. CIS version, AV database version & configuration used: CIS 5.3.181415.1237 // AV: 7886 //
  2. a) Have you updated (without uninstall) from CIS 3 or 4: No
  3. a) Have you imported a config from a previous version of CIS: No
  4. Have you made any other major changes to the default config? (eg ticked ‘block all unknown requests’, other egs here.):Make rules for safe applications
  5. Defense+, Sandbox, Firewall & AV security levels: D+= training, Sandbox= enable, Firewall = training, AV = stateful
  6. OS version, service pack, number of bits, UAC setting, & account type: Windows 7 Service Pack 1 32bit, UAC off, Administrator account
  7. Other security and utility software installed:None
  8. Virtual machine used (Please do NOT use Virtual box) None

EDIT:
Added D+ log files
This happens every time I open a .pdf of a USB flash drive

[attachment deleted by admin]

Copy that file to hard disk and then open it from there.
What happens?

It doesn’t get sand boxed, the .pdf files opened from the hard drive open normally. The same files when opened from the USb device are sand boxed.

That means USB device is untrusted by default. :wink:

You can add it to the Exclusions list and it won’t get sandboxed again.

Actually, you can’t exclude anything from external media. It will always be considered untrusted.

so all file inside a external device are sandboxed. is there an actual need to sandbox .pdf files, I mean should sandbox act only on programs?

Thank you for your issue report in the required format.

Moved to verified.

Thank you

Dennis