Sandboxing multiple malicous/safe programs sometimes causes BSOD. [M272] [v6]

A. THE BUG/ISSUE
1. Summary When running a file in sandbox, after that one terminates, I start another and sometimes it causes Blue screen. This doesn’t always happen though.
2. Can U reproduce the problem & if so how reliably? Random, About 20% of the time I try this.
3. If U can, exact steps to reproduce. If not, exactly what U did & what happened
a. download Executable mailcious file.
b. run it in fully virtualized sandbox.
c. Wait for it to finish what ever is doing
d. Do not reset sand box and re run the same program.
e. You could possibly get a blue screen.
4. If not obvious, what U expected to happen:
5. If a software compatibility problem have U tried the conflict FAQ? I don’t belive compatability issue.
6. Any software except CIS/OS involved? If so - name, & exact version: got Win 7 6-bit, Microsoft office 2007. Programs you find on normal users desktop.
7. Any other information, eg your guess at the cause, how U tried to fix it etc: I do not know, I will have diagnostic report attached.
8. Attachments. See attached file.

B. YOUR SETUP
1. Exact CIS version & configuration CIS Version 6.0.264710.2708 Internet Security Config. With modified settings.
2. Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV HIPS Enabled, Fiwewall Enabled set to prompt user for action/ Auto sandbox set to Fully Virtualized BB left alnone other than AUTO-Sandbox. AV, High heuristics and auto quarantine. Sanning: cloud enabled High Heur. Auto Quarantine when finished. HIPS and Firewall both set to Safe
3. Have U made any other changes to the default config? no more changes.
4. Have U updated (without uninstall) from a previous version of CIS Used installer to upgrade from 5.12 to 6
5. Have U imported a config from a previous version of CIS Did not import any settings form V. 5
6. OS version, SP, 32/64 bit, UAC setting, account type, & virtual machine used Win 7 64-bit SP 1 Home Premium. Not a virtual machine experiencing bug on product machine. Administrator account.
7. Other security/sandbox software a) currently installed b) installed since OS a) No other Realtime scanning software. Malwarebytes free. b) No other Realtime scanning software. Malwarebytes free.

Mod note. Killswitch processes are appended to tenth post.

Note: I have had this bug in the first release before this one so I am now reporting this.

[attachment deleted by admin]

Thanks very much for your issue report. Could you add all the headings from the format in please, as it is very difficult for QA to read like this. Please add any missing information including your ‘Watch Activity’ process list at the same time.

To help you, standard request with links is below.

Best wishes

Mouse


Thank you very much for your issue report.

We would very much appreciate it if you would be kind enough to edit your report to put it in the standard format and add any additional information requested, as this will make it much easier for the developers to diagnose and fix the problem.

The reasons we need all the information in the format, though they may not seem directly relevant to the issue are explained here.

If you are able to do this we will forward this post to the format verified board, where it is more likely to get looked at by developers. You can find assistance using red links in the format and here. If you need further help please ask a mod. If you do not add the information after a day or two we will forward this post to the non-format board. If this happens we will tell you how to rectify this if you wish to.

In the current process we will normally leave it up to you whether you want to make a report in standard format or not. However we may remind you if we think a bug of particular importance.

Many thanks again

Mouse

Edited.

Hi Andrei, thanks for doing what you have done, but the prompts are still missing. (Sorry maybe I used the wrong word). If you just copy and paste from the format into a post you will get the headings. Then you can cut and paste into it from your report above.

Best wishes

Mouse

Edited to what I understood.

Thanks Andei, much appreciated.

Have edited to sort out remaining problems. Please check to make sure I have not misunderstood.

We are nearly there. You still need:

  • a screenshot of your Watch Activity process list. This is so QA can check for software interactions.
  • details of the files you were testing (if malware don’t post direct links provide infomation to locate, and exact names instead)
  • your UAC setting

If you don’t understand any of the above you should find red links in the format to help you. If you cannot understand them please PM me.

Best wishes

Mouse

How do you do a screen shot, or is there a program for this.
I said that I had admistrator account

Thanks for looking at this.

Probably the easiest thing to do is to export the list. Use Killswitch menu ~ Save Current view.

To find your UAC setting, go to Control Panel ~ User Accounts ~ CHange User Account Control Settings. Look at the slider. (This is different from account type).

Best wishes

Mouse

PM sent

Screenshots of running processes to Killswitch here.

[attachment deleted by admin]

Thanks Andrei.

If you have an operating system dump file that will also be of great assistance to devs in fixing this bug.

Guidance on how to find it is here.

Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.

Developers may or may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

Many thanks again

Mouse

Can you please check and see if this is fixed with the newest version? Please let us know whether it is fixed or you are still experiencing the problem.

Thank you.

PM sent.

I am not experiencing the problem. But I will stress that this was a rare and extremely random bug it did not always happen when I would try to reproduce it. For now I have not had the problem yet and hopefully not again.

Ok leaving open for present. Please post in this topic if it recurs. Many thanks

Mouse

Have you experienced a BSOD with this yet?

If not then, from your prior experience, would it be a safe bet to say that if the bug existed you would have had a BSOD by now?

Thank you. PM sent.

I believe the bug is gone. Have not recieved a BSOD since the update that addressed the bug.

Okay. Thank you for checking.

In that case I will move this to Resolved. However, if you experience this bug again please send me a PM and I can move the bug report back.

Thanks.