Z:\ drive bug?

this is the same bug I reported a few months back. Whenever I start Virtual Mode I can see my original drive in Z:\
I can still see it in the latest version.


maybe this thing cant be fixed? If so.. can I use File Protection to protect the Z:\ drive or that would cause Returnil/my system to break?

also... I'm afraid something can get inside the Z:\ Drive while Virtual Mode is ON because even I can easily copy and paste files to it.

 

Very bad news Can’t Returnil solve its own serious bugs

 

With Virtual Mode enabled, I do not see the Z: drive when I open Windows Explorer from the bar icon. It appears when I try to save a file using “Save as…” and I browse for a location to save, but it is not possible to save to it.

Windows 7 x64, RSS Free.

 

my explorer screenshot

when i copy paste a file in Z:\ I am prompted by UAC elevation probably because of security measures I have in place.

 

Hi Konata Izumi,
This is happening on 64 bit Windows Vista/7 like Robin's report?

Mike

 

Windows 7 Professional (32bit)

 

I will DBAN my HDD and install a fresh Windows 7 Professional 32-bit on it and will give the latest Returnil System Safe 2011 FREE another spin.


btw can Returnil with its antiexecutable and antimalware turned OFF with only Virtual Mode ON protect me against TDL3/TDSS rootkits?

 

Some variants of those RKs use techniques that are similar to virtualization circumventors so I would say you are far better off with the A-E than without it. Remember, RSS is not a bundle where one component should be used instead of another component linearly. Rather, the design is a vertical layered approach where all the components back each other up.

If you are going into a risky situation, would you rather go it alone or have a few of your larger buddies at your back just in case?

Mike

 

update:
Z:\ drive still showing in explorer.

Only thing I did after the clean windows 7 installation that could be the reason for the Z:\ drive bug are the ff:

1. Windows Update: all recommended and important updates up to Win7 SP1.
2. Installed and applied Enhanced Mitigation Experience Toolkit 2.0.0.3
3. Modified some group policy settings.

EDIT: or maybe this problem is hardware specific

 

Z:\ Drive only shows when virtual mode is started with the setting "Start Virtual Mode when I start Windows"

 

I have been trialling RSS Pro 2011 and RVS Pro 2011 as possible replacements for Shadow Defender on my XP Pro SP3 system and I can confirm that this Z:\ Drive bug is happening on Windows XP as well.

 

Hi All,
Just a note and my apologies for the late reply on this. The phantom "Z:\" drive issue still exists, but as discussed earlier, it is not universal and does not effect the security of your real system. We are still working towards a resolution of this and will include the correction details in the release notes as soon as the fix has been applied to a future build.

Mike

 

I never had this problem until I recently updated to the current version now it pops up every now and then. This is on Windows XP 32 bit. I hope it gets fixed soon.

 

Not true...sometimes it happens when I activate virtual mode for only one session.
Windows 7 32 bit here with Returnil 3.2.12471.5765-REL13

 

Hi,
Noted and the team has been updated.

Mike

 

Anything new on this?

I installed the latest free version for a friend (Win7 64.bit) and did not notice the z-drive at the time, until later where I was at a loss of explaining where this came from.

Al

 

I tested the latest build yesterday on Windows XP and the Z:\ drive bug now appears to have been fixed, as detailed in the change release notes: http://www.returnilvirtualsystem.com/products/rvs-pro/release-notes

If there is still a problem, maybe it is specific to Windows 7 64-bit.

 

Did you or the friend create and mount a Virtual Drive (Virtual Mode > Tools > Virtual Drive tab)?

Mike

 

No, we did not create a virtual disk. It happened when virtual mode is set to enabled on on every boot. I did not previously notice this before when I tested it by manually turning it on/off, but I may have missed it so I can't say for sure.

Al

 

latest version fixed this problem for me.

 

As far as I know, I installed the latest version, unless there was a new release in the past few days.

Al

 

A new build was announced on July 6th: https://www.wilderssecurity.com/showthread.php?t=302879&highlight=returnil

 

OK, I need to check that. It could well be that version was not out when I downloaded either on the 5th or 6th of July. I don't have the laptop anymore, so it may be a while before I can get back with the info.

Al

 

With v. 14 and Windows 7 x64, I sometimes see Z:. It depends on the setting Virtual Mode > Overview > Start Virtual Mode when I start Windows. If this setting is enabled, Z: appears. If it is disabled (my normal mode of operation) Z: does not appear.