A. Some Executables Bypass the Restriction Level set in the sandbox.
Can you reproduce the problem & if so how reliably?:
Yes. I have the following rule in my rule sets for the sandbox:
Action: Run virtually
Target: All applications
Reputation: Unrecognized
Location: any ; Origin: any
Options: I enabled restriction level and I set to Limited.
I got malware samples that comodo did not detected and i ran them by double clicking, comodo virtualized them, however some samples were virtualized and partially limited not virtualized and limited.
If you can, exact steps to reproduce. If not, exactly what you did & what happened:
Explained above.
One or two sentences explaining what actually happened:
Some malware can bypass the restriction level set in the sandbox.
One or two sentences explaining what you expected to happen:
All malware should run as limited in the sandbox
If a software compatibility problem have you tried the advice to make programs work with CIS?:
NA
Any software except CIS/OS involved? If so - name, & exact version:
No
Any other information, eg your guess at the cause, how you tried to fix it etc:
NA
B. MY SETUP
Exact CIS version & configuration:
CIS 8.0.0.4344
Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
Antivirus - stateful, Autosandbox - enabled, Firewall - enabled
Have you made any other changes to the default config? (egs here.):
No. Except the Sand box rule modified
Have you updated (without uninstall) from CIS 5, 6 or 7?:
No
if so, have you tried a a a clean reinstall - if not please do?:
NA
Have you imported a config from a previous version of CIS:
NO
if so, have you tried a standard config - if not please do:
NA
OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Windows 7 Home Premium, SP1, 64 Bit, UAC enabled, Administrator, V.Machine is used.
Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
a=none b=none