running only comodo firewall, df+, and sandbox. no av installed.
noticed as described in the previous posts that if one tries to launch any .msc command from another application such as the cmd prompt that the sandbox alerts that it is running in the sandbox. this does not happen if one launches the .msc command from the run box. most of the previous posts are referenced in particular to gpedit.msc only because that is how I discovered it. but any .msc command will reproduce the sandbox alert. the other third party application that reproduces this anomaly is “vista start menu”. it replaces the xp start menu. it comes supplied with it’s own “run” window.
adding the .msc command path to “my own safe files list” does not inhibit this behavior.
firewall running in safe mode, df+ running in safe mode, and sandbox enabled.
Just FYI, I’m having exact (I believe) same problem on Windows 7.
If I run gpedit.msc from a command prompt, I get sandboxed. If I run it from the “search” window, I don’t get the prompt. Checking the “do not run this sandboxed again” doesn’t make it go away. Neither does “Always trust the publisher of this file”.
Are you running a replacement start menu or explorer replacement or is your OS modified in any other way?
Was your OS installed from a slipstream disk?
If you run SFC /scannow with your OS disk in the drive does it solve the problem? (Runs for an hour or so, checks and reverts all OS files to correct current versions). (Make a restore point first, I suggest).
I think my replacement menu (vista start menu) only pointed to a problem, was not the root cause. I uninstalled it and the same thing happened using the command prompt window to execute any *.msc command. Again, using the run box does not produce a sandbox event.
If possible would like someone with Vista to try it. My feeling is that it would occur here too. This area of windows is probably unchanged from XP.
If you have a “home” version of windows group policy (gpedit) is not installed. But one could use the command for event viewer. It is “eventvwr.msc”.
Only guessing here, but it appears that Comodo sandbox alerts only when the .msc command is launched with another application or executable, such as cmd.exe. I do not feel that “Vista Start Menu” is relevant to the problem in particular. Vista Start Menu works by using a system of “hooks” to integrate into the menu system. The actual file that does this is a library file named vistastartmenu.dll. It detects or intercepts the action of moving the mouse over the “start” button. Probably should add that Vista Start Menu application does not alter any system files.