CIS V5 public beta

Well found a malware fake av that went right through comodo v5. Its called PC Defender and it installed and took over virtual machine. I saved the msi file to my desktop and right clicked on it to choose properties and chose unblock in the advanced section of the properties then when I ran it, it was added automaticlally to trusted files, the sandbox didn't pick it up. If anyone wants to try it as well its on MDL.

 

Apparently you can import a backed-up bases.cav file into CIS 2011,it's located within 'scanners' subfolder of CIS program folder.There's a post about it over on the Comodo forums which I'll link here if I can find it again.

 

Did you try to run the fake av outside comodo's sandbox

 

Ok I will download the v5 BETA and will try to apply the database manually

 

"Well found a malware fake av that went right through comodo v5. Its called PC Defender and it installed and took over virtual machine."

Its true! (beta bug? installer problem?).

 

No just ran the msi but comodo sees it as a trusted file so it never gets sandboxed. Apparently its a bug with msi installers.

 

Ok but you can manually run the file in sandbox does your result leads the same thing

 

Cant run it in sandbox manually.

 

http://forums.comodo.com/beta-corne...e-execution-t60089.0.html;msg422319#msg422319

 

good so its gunna get fixed glad to hear that

 

Considering it since i uninstalled Malware Defender

 

How would it run it in sandbox unless you run it manually? Comodo 5 doesn't have an auto-sandboxing feature. The execution control has auto-cloud scan but all sandboxing has to be done manually or with the "Always Sandbox" list. If you uncheck the "Automatically trust files from trusted installers" on the Sandbox settings tab, it should run inside the sandbox.

If you have enabled any of the "trusted applications" settings, it may get through if the installer has a forged certificate.

Nevermind. I see now "Untrusted Files" are automatically sandboxed. I'm not set up to use that feature so that's why I haven't seen it happen.

 

does CIS5 beta have auto program updates? or do i have to install every new beta?

cant remember with past betas

 

I even asked the same question
Info

 

There is an auto update feature that allows you to update to new betas.

 

thanks for the info guys.

 

hows the sandbox in version 5?

 

This however does not work from what I have heard, it is disabled in the beta. I could be wrong though.

 

trying out CIS5 beta right now so far very stable. really no popups at all. im liking it.

hows the sandbox? any issues? does it work better in version 5 than 4?

thanks

 

The automatic sandbox has been tweaked for compatibility while still maintaining security. Everything I've run so far that's been automatically sandboxed has run without problems.

 

I don't know if this is a proper place to ask but didn't want to start a new thread for this.

How many time Comodo AV updates a day?

 

not sure but it seems to be alot

 

Thanks...

 

For me,because i always check almost every one and a half-two hours.

 

It varies,but it can be many times a day,there's no set limit.