Protect against malware by running suspicious software safely

Interesting. I suspect this wouldn't protect you from a piece of malware that dug up sensitive information from the user's hard drive and sent it back to its master though?

Originally posted by nonoitall:

---

Interesting. I suspect this wouldn't protect you from a piece of malware that dug up sensitive information from the user's hard drive and sent it back to its master though?

---

Yeah, I know. This does appear to be an effective means of protecting the system itself from harm. I think I'll stick with virtual machines for shady program usage though. :-P

Originally posted by nonoitall:

---

Yeah, I know. This does appear to be an effective means of protecting the system itself from harm. I think I'll stick with virtual machines for shady program usage though. :-P

---

I have been using this program forever. If you don't care to have virtual machines etc you cannot beat this program. It does not bog down your system at all. You will not really notice any change as far as functionality and you can run anything in the sandbox. I know I like to try out different programs and such that I have hard of. It can be a hassle if you hate it and uninstall and crap is still left in your registry. Everything you run in the sandbox will not have an effect on your registry settings. You don't like what you've installed? Just delete the sandbox and everything is gone. I run my browser in the sandbox. I don't even bother with having antivirus software anymore because I do everything in the sandbox and there is virtually no chance of me getting a virus.

Originally posted by ahiah9:

---

Wow... I've been using Sandboxie for about 3 years, but still have the AV. PC use without that just seems a little to... Mac? :p

---

Looks great! I will need to down load this puppy before I forget.
I ALWAYS disable the network before I do anything that try to use the internet. In fact I only enable when I need it. I have gotten a warning once after installing some software. It complained that the internet was down when nothing should have been doing that. I couldn’t find the Trojan for a good long time. Finally I made a very nasty call to the software company. I assumed it had a virus. They confided that it was only trying to register the software. I uninstalled the software and I never saw the message again.

By not starting up with the network off, you insure your firewall ect is fully up and running before you get internet access. I do not wish to get auto updates for anything. They cause much more troble than the solve. If I have a problem then I update otherwise I do not. I have had far less if any incompatibility problems since I wised up.

I do not trust firewalls much. I keep an IP blocker as well. I gives me the creeps how much info gets blocked I assume because the firewall let it in. There is all sorts of add ware trying to spy on you to say the least.

cool. i've never heard of this before. i'll give it a try. thanks for the review/guide dela.

Quote:

---

as you would probably be suspicious if you run it and you don't see anything happening.

---

As others have said, Sandboxie is a great tool for keeping a malware-free system. I usually run all of my browers in a sandbox for this purpose.

Originally posted by SoCalSRH:

---

cool. i've never heard of this before. i'll give it a try. thanks for the review/guide dela.

---

Originally posted by joe777:

---

Well done, for informing the community of this great little app.

---

I'm surprised I just found out about this. I always had to run malicious software through qemu or VMWare but this is far easier and much more practical.

Thanks very much for this!

Originally posted by rvinkebob:

---

I'm surprised I just found out about this. I always had to run malicious software through qemu or VMWare but this is far easier and much more practical.

Thanks very much for this!

---

I've used sandboxie before but was unsure of it's effectiveness and the setup can be a little complicated. Right now I just use "returnil" virtual system(freeware), for me it's much simpler, when enabled it places the entire c: drive into virtual mode(this process is immediate). Any virus/malware encountered will only live in the virtual world. The only drawback is you need to reboot to come out of virtual mode.
Sandboxie is more of a software for people who have a good understanding of security threats and will setup sandboxie accordingly.
Sandboxes and virtual systems are the only security software that can defeat (or at least make non-permanent) virus/malware. Anything that bypasses your firewall/antivirus probably won't make it through a virtual system.

A word of note - Sandboxie will not run on 64 bit Windows unfortunately.

Originally posted by FreqNasty:

---

A word of note - Sandboxie will not run on 64 bit Windows unfortunately.

---

This only solves half the problem. If it can still connect to the internet and send data back home how is that safe from stealing your passwords or reporting key presses?

If this program added in a network monitor that tells you when it's making a network call and inspects the data for you AND let's you inspect it and stop the call then you've got a great program.

The whole Windows environment needs all it's software to run like this all the time. Let the user see exactly what everything is doing in his or her system.

That's what the firewall is for and does. We sure don't need any more of that AUC crap and most people aren't going to understand what they are even looking at if we did lets say a packet inspection.

I ran Sandiebox for a long time but finally gave up on it as it's too much bother for the minimal protection you may get from it. Most malware/trojans lay dormant for some time so you won't catch them in the sandbox any how. You can run antivirus on them while in the sandbox but even AV packages won't protect you fully and these days all of the false positives makes it hard to even trust your AV protection.

I'm testing a new AV Suite Avast!Professional Family Pack - antivirus for home networks and it has a sandbox in it that you can add whatever browser you want to it. It looks intersting, it is cheap, it will push updates as you get 1 server & 10 workstation licenses with it. So that is the direction I will go in, once again I wasn't impressed by Sandboxie.

for those concerned with the transmission of personal information from malware within sandboxie, yes a firewall either hardware or software that monitors for personal data is best bet.

but i have had a few programs that sandboxie alerted me of suspicious file access and internet communication and blocked it. you can even set it so a sandbox has certain resources before executing the program