Trojan bypasses Comodo IS

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
1

I’ve found trojan on malwaredomainlist that can restart my system even If I have set Defense + to Paranoid Mode. Where I can report this issue?

2

https://forums.comodo.com/av-false-positivenegative-detection-reporting/submit-malware-here-to-be-blacklisted-2011-no-live-malware-t66780.0.html

3

doubtful - can you supply a link please ?

the only way this would be possible in my thoughts is if u trusted the file and it set a hook.

once a hook is allowed it’s game over

4

Are you running x32 or x64. Also, what version CIS?

5

Is rebooting the only thing that is allowed? Or is it capable of doing more than that?

Egemen, the head developer, never saw making the computer reboot as a problem and therefor no reason to make CIS alert it.

6

Besides, if a virus requires a computer to reboot before it will work, all tests thus far have shown the virus was stopped dead at the reboot with CIS. No infection, no issues.

7

Sorry for long reply. This trojan was a ransom trojan. I have downloaded trojan and run (automatically) in sandbox and suddenly the sytem restart. The other trojan was a “LockScreen” but after restart everything was ok. Screen:

http://i.imgur.com/pa95J.jpg

I am using a polish version of CIS. Despite the trojan was sandboxed (partly limited) system was restarted. This trojan looks very similar to Blaster or Sasser virus. I had changed sandbox seetings to limited and everything was ok.

Is it possible to block LockScreen trojan od default settings?

8

Under the default settings the malware inside the sandbox can shut down your pc but after the restart there will be no start entries for the malware itself, so the malware will not load automatic.

9

add a rule

LocalSecurityAuthority.Shutdown