1. The full product and its version:
COMODO Internet Security 8.0.0.4314 Beta 2
2. Your Operating System (32 or 64 bit) and ServicePack revision. and if using a virtual machine, which one:
Windows 7 32bit
3. List all the configuration changes you did. Are you using Default configuration? If no, whats the difference?:
Sandbox Enabled, otherwise at default.
4. Did you install over a previous version without uninstalling first, or import a previous configuration file?:
New installation
5. Other Security, Sandboxing or Utility Software Installed:
None
6. Step by step description to reproduce the issue. Or if you cannot reproduce it, what you actually did before it happened, step by step:
1). A malware file was placed in the Downloads directory
2). Other files were also added to the download directory
3). The malware file was run, and confirmed to be sandboxed
4). The parent malware file spawned a payload, au.exe, that appeared to be an installer. This file also was sandboxed (confirmed).
5). The spawned payload will run and take a listing of all files in the directory where the original parent malware resides (in this case, the Downloads folder).
6). All files in the downloads directory will be deleted.
7. What actually happened when you carried out these steps:
Although sandboxed the malware was still able to delete the real files placed in the same folder as it.
8. What you expected to see or happen when you carried out these steps, and why (if not obvious):
Although obvious, a sandboxed executable should not be able to make these changes to the parent system. Note that in Comodo version 7 (sandbox at Fully virtualized level) no files were deleted- the parent and spawn were isolated.
9. Any other information:
Configuration and diagnostics file are attached.
[attachment deleted by admin]