Vunerability, cbxxx.tmp files, hard drive full when updating CIS

Learn about Computer Security Virus/Malware Removal Assistance
#1

Hello,

I use CIS on 60 digital signage pcs that have been droping out like files over the weekend. The first signs of problem is when when a message appears saying Unable to install package.

Looking into it on the 10th November the hard started filling up in the windows\temp folder. There are thousands of cbxxx.tmp files xxx being in hex format. I noticed these files are generated every 5 or 6 minutes and vary between 200mb and 100kb. Seems to be building up by a gigabyte every hour.

These files are also created when attempting to update CIS, assuming it si CIS related?

I wondered if there is a known vunerability or a solution to fix. I have tried deleting my the files soon build back up again.

I am not sure how these would have contracted a virus, as although they are connected to the internet they only display content from trusted sources.

Looking at the system processes I cannot see anything untoward.

I have run a full virus scan which doesn’t detect any virsues.

I would be extremely grateful for your advise.

Many thanks,
Andrew

#2

How many computers is this happening on?
It doesn’t sound like a virus, but I can’t be sure.

#3

Many thanks for your replay,

This is occuring on Virtually all of them which last updated on the 7th November.

I notice also these files are only generated when comodo is running. With as many other proceses closed.

Cheers,
Andrew

#4
Looking into it on the 10th November the hard started filling up in the windows\temp folder. There are thousands of cbxxx.tmp files xxx being in hex format. I noticed these files are generated every 5 or 6 minutes and vary between 200mb and 100kb. Seems to be building up by a gigabyte every hour.

These files are also created when attempting to update CIS, assuming it si CIS related?


What comodo version are you using??

While I go to go, I’ll be back in a few hours :slight_smile:

#5

Hi,
I will be able to check for specific virus definition and version but know it is version 4 series.

Many thanks,
Andrew

#6

Why not try upgrading at least some of them to V5 and see if the problem is resolved?

By the way, V5 is actually easier to use and more secure than V4. Hopefully you can update them all and that solves the problem.

#7
know it is version 4 series.
If my memory serves me correctly, that bug is solved in version 5.

I going to guess based on what you wrote. I’m going to assume the database is corrupted also Since your doing 60+ computers. here’s a way to fix that problem without having to a redownload all the databases for each computer

Wheather you choose to keep version 4 or or upgrade it to version 5. This is what I would do
You could just reinstall the database, then make a copy of bases.cav then install the bases.cav for each computer

Just follow these steps

Q: Where can i download the latest full AV database?

A:
As long as Comodo is not providing this on the public website where trying to keep this post up2date.

Q:
Will this link work with my download manager?

A:
Yes. It will work with your download manager because it supports resuming. That makes it suited for people on slow connections.

*** WARNING CIS version 3.12,3.13,3.14 and lower are no longer updated on the AV database ***

For respective CIS version, we have different complete bases.cav:

  1. For CIS 4.x
    Following link points to latest complete bases.cav always
    http://download.comodo.com/av/updates40/sigs/bases/bases.cav

  2. For CIS 5.x
    Following link points to latest complete bases.cav always
    http://download.comodo.com/av/updates50/sigs/bases/bases.cav

Q:
How do i activate this download?

A:

* Save the file on your computer
* Reboot in Safe-Mode
* Open explorer and go to C:\Program files\comodo\comodo internet security\scanners


                                 OR

Type in following in “Start–>Run” and press Enter key:
%ProgramFiles%/comodo/comodo internet security/scanners

* Rename existing bases.cav to bases.old and copy downloaded bases.cav
* Reboot your system in normal mode

Your AV database should be the latest full, and should only need to do an incremental update for the latest updates released after this full.

P.S. Side Note, the database (bases.cav) from version 4 is NOT combatiable with Version 5

#8

Hello,
Thank you for all your replies, very grateful.

I have deleted the temporary and updated using the more tab and check for updates option. Notice CIS 5 has installed with this update. Pleased to say that this seems to fix. Just got to bit of travelling round to do now.

I wondered where I might able to find more details specifically about this bug as my manager is asking me to evidence this was a bug in CIS and not a virus outbreak.

I only see one other case like this in the forums. Wondered why in my case why this occured over a short amount of time. These machines have had version 4 installed since September until this have not any problem.

Other than installing version 5 is their anyway I can prevent the databases to from become corrupted in furture? Would for instance it be safe for me to set up a scheduled task to remove all the files created in the windows\temp folder to prevent the drives becoming full so their is space to update and fix. Or is the problem caused by the attempts to update an already corrupted database?

Many thanks again,

Andrew

#9
I wondered where I might able to find more details specifically about this bug as my manager is asking me to evidence this was a bug in CIS and not a virus outbreak.

I would PM a mod on that

To help prove it’s not a virus outbreak

follow these steps here (depending on the windows version)

I believe xp and vista are the same commands :-TU