Sandbox allows malware to infect system?

[tolis14]

Hello to everybody, as I’m a new member to the community…
I wanted to get your opinion on this problem:

I installed CIS 4 on a virtual machine and run certain malware samples to test it. One of them was a fake AV, which I run normally. Although I received the confirmation that the file was sandboxed as an unknown application, it was eventually allowed to run and completely infected my system, rendering it unusable.
Any ideas why this might have hapenned?

By the way forgive the use of the language as I’m not a native english speaker…

Thanks for your replies…

[bulgroz]

Comodo sandbox is only a partial sandbox which allows unknown apps to write to disk and registry. It is therefore possible for malware to infect your PC.

What I find a bit more worrying is that the other components of CIS have not picked up on the malware. The AV and D+ should have. Unless sandboxed apps are not scanned for virus and bypass D+…

Cheers

[tolis14]

So, please correct me if I’m wrong, running a program that is malware sandboxed, could have the same (bad) results as running it normally…
So I wonder, what is the real use of the sandbox?

[Tooby]

Fake AV Bypassing and Causing System Malfunction is fixed, After my self also reporting the same issue:

@egemen post:22

hi Guys,

I have observed 2 issues.

1 - When realtime scanner detects this malware, and shows the alert, cfp.exe crashes. This is a minor issue and will be fixed with the next update.

2 - Rogue DOES change some of the protected registry keys unless it is executed inside the sandbox manually. We have identified the bug and it is fixed. The bug affects previous version of CIS too.

We will hopefully release an update the next week latest which should address these issues too.

Thank you very much for the feedback.

Egemen

So hopefully we will see a release tomorrow, or early next week, with this bug fixed.

Tooby

[rejzor]

In my own test, rebooting the system got rid of the junk. Or at least deactivated it.

[tolis14]

Maybe “automatically detect installers/updaters and run them outside the Sandbox” has something to do with it? Maybe the fake AV fooled comodo into thinking that it was an installer and therefore it was ran outside the sandbox?

[Dain_Bramage]

@tolis14 post:1

Hello to everybody, as I’m a new member to the community…
I wanted to get your opinion on this problem:

I installed CIS 4 on a virtual machine and run certain malware samples to test it. One of them was a fake AV, which I run normally. Although I received the confirmation that the file was sandboxed as an unknown application, it was eventually allowed to run and completely infected my system, rendering it unusable.
Any ideas why this might have hapenned?

By the way forgive the use of the language as I’m not a native english speaker…

Thanks for your replies…

its a known problem (some registery classes are not protected) and will be fixed with next update. At least according to egemen.
to lazy to search for his post, so if you want to confirm my reply, search the forum

[tolis14]

Thank you everybody for your replies…
Now I noticed another thing…there is no Threatcast tab in the alerts…any idea why?
Thank you again…

[Tooby]

@RejZoR post:5

In my own test, rebooting the system got rid of the junk. Or at least deactivated it.

For almost all Rogues, Rebooting does help. This Rogue I personally tested, and so did a few others, Actually was even still loading on startup. Even Safe Mode it ran, (And causing system malfunction: Such as CIS 4 GUI not opening, antimalware installers not even starting). Anyway I’m glad it’s fixed… Just waiting for the next update now.