Win 8 firefox allows download of test files blocked in Win7 [V6][M383]

A. THE BUG/ISSUE (Varies from issue to issue)
[ol]- Summary - Give a clear summary in the topic subject, NOT here.

  • Can U reproduce the problem & if so how reliably?: It happens every time I test CIS v6 under Windows 8 with the Firefox browser on the EICAR test website.
  • If U can, exact steps to reproduce. If not, exactly what U did & what happened: Under Windows 8, with Firefox, navigate to the EICAR test website at http://www.eicar.org/85-0-Download.html Proceed to download the 4 EICAR files under http and again the same 4 EICAR files under https.
  • If not obvious, what U expected to happen: I expect CIS v6 to immediately block and prevent download of all EICAR files under Windows 8, the same way CIS v6 blocks immediately all EICAR files under Windows 7.
  • If a software compatibility problem have U tried the conflict FAQ?: None that I know of
  • Any software except CIS/OS involved? If so - name, & exact version: The real-time scan malfunction only happens under Windows 8. Real-time scan functions perfectly under Windows 7
  • Any other information, eg your guess at the cause, how U tried to fix it etc: Probably a permission problem under Windows 8
  • Always attach - Diagnostics file, Watch Activity process list, dump if freeze/crash. (If complex - CIS logs & config, screenshots, video, zipped program - not m’ware)
    [/ol]

B. YOUR SETUP (Likely the same for each issue, so you can copy forward)
[ol]- Exact CIS version & configuration: CIS 6.1.275152.2801 ProActive Security

  • Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:Antivirus=Heuristics Low, HIPS=Enable HIPS Unchecked, BBlocker=Untrusted, Firewall=Safe,
  • Have U made any other changes to the default config? (egs here.): Yes. Followed Chiron’s Guide for CIS v6, but did not check “Do not show pop-up alerts” under Firewall. Followed the same guide from Chiron under Windows 7 and Windows 8. The Settings and configuration are exactly the same under Windows 7 and Windows 8. Real-time scan not working well under Windows 8.
  • Have U updated (without uninstall) from a CIS 5?: No. Clean Windows 8 install. Clean CIS v6 install
    [li]if so, have U tried a a clean reinstall - if not please do?:Not Applicable
    [/li]- Have U imported a config from a previous version of CIS: No
    [li]if so, have U tried a standard config - if not please do: Not Applicable
    [/li]- OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used: Windows 8 Professional 64-bit, UAC=Notify, Account Type=Administrator, V.Machine=No
  • Other security/s’box software a) currently installed b) installed since OS: a=None b=None
    [/ol]

[attachment deleted by admin]

Thank you very much for your bug report in standard format. We very much appreciate the effort you have made to document this bug.

We are sorry to trouble you further but there are some items of information missing or unclear in your post:

  • waht is actually happening on win 8
  • A.8 your watch activity process list
  • A.8 your CIS diagnostics file

The reasons we need these items of information, though they may not seem directly relevant to the issue are explained here.

We would be very grateful if you would add these items of information so we can forward this post to the format verified board, where it is more likely to get fixed. You can find assistance using red links in the Format and here. If you need further help please ask a mod. If you do not add the information after a week we will forward this post to the non-format board. If this happens we will tell you how to rectify this if you wish to.

In the current process we will normally leave it up to you whether you want to make a report which includes all necessary information or not. We may remind you if we think a bug of particular importance.

Many thanks again

Mouse

Okay. Thanks.

CIS v6 is not detecting all the EICAR test files on Windows 8 as it does on Windows 7. On Windows 8, I can download to my desktop almost all the EICAR files from http://www.eicar.org/85-0-Download.html

On Windows 7, all the EICAR files are stopped immediately by CIS. This is indicative of a real-time scan problem on Windows 8.

The request debug files have just been attached to the debug report.

Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.

Developers may or may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

Many thanks again

Mouse

OK so just to check
a) you get no detection notification on download?
b) the files are allowed to download into the downloads directory

If you then try to execute them, what dialog/notofiocations do you get?

Best wishes

Mouse

That’s right. No malware notification on download on Windows 8. Only eicar.com.txt is detected. The other 3 EICAR test files are not detected. On Windows 7, all EICAR files are blocked immediately on download.

On Windows 8, I do get the Antivirus malware alert when trying to execute the files.

Can you please check and see if this is fixed with the newest version? Please let us know whether it is fixed or you are still experiencing the problem.

Thank you.

PM sent.

Hello, the devs are currently working to replicate this bug. However, they have so far been unable to reproduce.

Can you please provide detailed steps for how you are able to reproduce this issue? I can then pass it on to the devs so they can reproduce, and then fix, this bug.

Thank you.

The devs are still unable to reproduce this. Can you please respond with the requested steps?

Also, does this issue still occur with CIS version 6.3.294583.2937?

Thanks. PM sent.

The issue still occurs with CIS version 6.3.294583.2937

I went to the EICAR test download site at:

http://www.eicar.org/85-0-Download.html

On Windows 8, I’m still able to download the eicar test files to my desktop. On Windows 7, they’re blocked immediately as they should.

What happens if you double-click on the files after they’re on the desktop?

I have received feedback from the devs that this is not a bug. Even if a browser is allowed to download the file the AV should isolate and remove them when they are scanned, read, or executed. If that does not happen please create a bug report.

I will now move this to Resolved.

Thank you.