Excel.exe version 16.0.7369.2118 contained by Containment Policy

Products ITarian Endpoint Manager
1

Hi,

Hmm, why is this Excel.exe and also Word.exe from the same version contained? Should they not be Trusted from Comodo?


Name:
EXCEL.EXE
Path:
C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Age:
496 days
Hash:
C58F71A63D98D0416B13F13AC14EA22708035F71
Version:
16.0.7369.2118
Size:
32.5 MB



Name:
WINWORD.EXE
Path:
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Age:
496 days
Hash:
B3344B093925B8080D13CE1BB5E525AEFC200158
Version:
16.0.7369.2118
Size:
1.9 MB

Thanks.

2

We’ve been experiencing the same issue today, but after a few reboots the issue has been resolved. We have also been advised by support to add %windir%\system32\audiodg.exe to shellcode injection exclusions.

3

Hello @Noiden

We have raised a support ticket in investigating your case. Please reply to our email as soon as possible, Thank you

4

@Jimmy @Noiden please could you post the outcome of this issue here.

5

Hello @nct,

Yes we will also post the outcome here.

6

Since notifications don’t always work on the forum, please email me, too.

7

Hello @nct,

We have sent you an email regarding with this case to make sure that you will also be updated.

8

@Anna_C email has not been received, please resend.

9

Hi @nct ,

I’ve already resent the email. Thank you.

10

We’re also seeing this MS file being contained. It seems to be a new Office update file. Logged with Comodo support who are aware already of the issue C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8500.40955.0_x64__8wekyb3d8bbwe\HxTsr.exe

11

Hi @nct ,

We’ve already replied to the supported ticket. Thank you.

12

I’ve now been informed by development the file is now trusted by Valkyrie

13

Hi @nct . Thank you for your time earlier and we are glad that it is working now as expected. Hi @Noiden, we had send you an email about your preferred schedule for the session. We will look forward for your response.

14

Hello @Noiden ,

The issue is fixed with new CCS Hotfix. Please make sure that you have the latest version of the agent.

https://c1forum.comodo.com/forum/products/other-comodo-products/comodo-device-management/17518-ccs-hotfix-for-auto-containment-of-windows-processes-issue

Thanks
AhmetEnes