Just installed Comodo Firewall yesterday, first day everything seemed to be in order, but today the sandbox doesn’t seem to work anymore. I try to run a browser (either IE or FF) in sandbox and nothing happens, and when I look I have cmdvirth and virtkiosk in sandbox (trying to do this multiple times without resetting sandbox results in multiple instances of virtkiosk left there) and nothing else.
The defense+ log gets an entry for each such failed launch saying application: cmdvirth.exe / flag: terminate process / target: svchost.exe
HIPS is normally in Clean PC Mode with create rules for safe applications selected, viruscope active with sandbox only checked. However, yesterday when it worked HIPS was in Safe Mode, so even stricter, and today I tried it even with it off and the behavior remained, which was very odd. What gives?
Just noticed something, or more exactly no longer noticed something. The VTRoot directory doesn’t seem to exist anymore, shouldn’t that always be there? Or at least I saw it there last night when I don’t think I had anything in sandbox and now it’s not there anymore (yes, unchecked hide protected system files too). May that be it?
Question of how to fix it (and why it happened it the first place) remains.
VTRoot isn’t created until something is actually sandboxed. Not sure if resetting deletes the whole directory or just the contents.
Resetting removes the folder.
Ok, so that’s not it then.
… However, I don’t see it being created if I try to sandbox either. So pretty much nothing happens.