Virtualization/sandbox

[nixie21]

I give up trying to get greenborder pro working with my system...

What program is as good and as easy? Free if possible (I won greenborder, but it destroys my system!)

Thanks

[nixie21]

I installed sandboxie

Any comments / setup tips/options would be great!!

Thanks!

[KikiBibi]

Hi nixie,

DefenseWall is very easy to use if you will pay. No config needed.

[EASTER.2010]

Hi nixie21

You might be interested in Power Shadow perhaps. Just another suggestion. It's been thoroughly tested and heavily discussed. See line below. Regards EASTER

http://www.wilderssecurity.com/showthread.php?t=161735

[Peter2150]

-{ Quote: "I installed sandboxie

Any comments / setup tips/options would be great!!

Thanks!" }-

I am running Sandboxie. Not much to setup that I can see. I like it.

[Perman]

Hi,Nixie21: If you are willing to pay. You may want to test this one; DeepFreeze standard. It is very simple to use, only thawed and freeze modes. The upside of it is: you can install app and test run it in freeze mode, it will vanish upon reboot. The drawback is : you can not keep any changes including tested app and you can not install apps requiring reboot. other than that, DF is a very solid and very safe product. I use it w/ these apps: ZASS,Avast home, prevx1, prosecurity free, AVG AS plus, BlackIce, wintatrol plus and SuperAd Blocker, no problems so far.

[andylau]

I am using Sandboxie , it's quite good!

Or you may try BufferZone Pro:)

[simmikie]

i believe you are on the right track with Sandboxie. it seems very secure for browsing, email, P2P, and you just will not find a more involved developer than Tzuk.


Mike

[aigle]

-{ Quote: "I give up trying to get greenborder pro working with my system...

What program is as good and as easy? Free if possible (I won greenborder, but it destroys my system!)

Thanks" }-
Free ones- GesWall, Sandboxie
Paid- defenceWall, GesWall Pro
Just try one by one and see what u like. All are a bit different so u have infact many choices.
Others are BufferZone, and virtualization products like DeepFreeze, ShadowSurfer( there used to be a free offer), ShadowUser etc.

[Bio-Hazard]

Free: Geswall

Paid: Defensewall

[korb]

-{ Quote: "I give up trying to get greenborder pro working with my system...

What program is as good and as easy? Free if possible (I won greenborder, but it destroys my system!)

Thanks" }-

if powershadow consider as sandbox,then i recommand.(i thought P>S more like system restore)

[nixie21]

Thanks for the responses. I would prefer free :) I am trying sandboxie right now. What is the big difference between sandboxie and geswall? The thing I like about sandboxie so far is the ease of use. My wife can use it and if she does not download anything (very rare) there is no difference to her.

Thanks again

[Pedro]

SandboxIE virtualizes all changes (fake registry, file system, etc.). Everything downloaded is re-directed to a copy of the real folder inside the sandbox. Not exactly like this, but this is enough. If you want to learn how it works, i can't explain more than Tzuk himself, in SandboxIE's site. Very well detailed.

Geswall is policy based, it allows you to save files in the right places from start, temporary files go to temp folders, etc., but during a isolated session, every file downloaded is marked untrusted, and can't touch the most important parts of your system. Rootkits are there, but can't do anything, keyloggers can't tap anything etc.
Geswall's site is also good to understand, and the manual. Less to read too, lol, and too the point.

I have more faith in SandboxIE, since all goes to one folder that i can delete/erase. But geswall has good points, it's simpler to use in some cases.

[nixie21]

-{ Quote: "SandboxIE virtualizes all changes (fake registry, file system, etc.). Everything downloaded is re-directed to a copy of the real folder inside the sandbox. Not exactly like this, but this is enough. If you want to learn how it works, i can't explain more than Tzuk himself, in SandboxIE's site. Very well detailed.

Geswall is policy based, it allows you to save files in the right places from start, temporary files go to temp folders, etc., but during a isolated session, every file downloaded is marked untrusted, and can't touch the most important parts of your system. Rootkits are there, but can't do anything, keyloggers can't tap anything etc.
Geswall's site is also good to understand, and the manual. Less to read too, lol, and too the point.

I have more faith in SandboxIE, since all goes to one folder that i can delete/erase. But geswall has good points, it's simpler to use in some cases." }-

Thank you for that, I appreciate it!

[Chuck57]

I use Powershadow exclusively. Mostly, I don't bother, but if I'm going to a site I haven't visited before, or downloading software even from a safe site, I engage Powershadow and haven't the least bit of worry about my computer being infected.

Sandboxie is good, they're probably all good, but I've yet to find anything to equal Powershadow.

[Pedro]

-{ Quote: "But geswall has good points, it's simpler to use in some cases." }-
To give an example, imo, Geswall would be best with P2P. Because i'm downloading things that i want to save, obviously. Geswall would silently block access to key parts of the system.
On the other hand, one could say that it's no more dificult with SandboxIE. Since P2P programs will download all files to the same folder, you just tell SandboxIE which folder, and save what you want with just a few more clicks. And delete what you don't want with a click too.

-{ Quote: "I use Powershadow exclusively. Mostly, I don't bother, but if I'm going to a site I haven't visited before, or downloading software even from a safe site, I engage Powershadow and haven't the least bit of worry about my computer being infected.

Sandboxie is good, they're probably all good, but I've yet to find anything to equal Powershadow." }-
My problem with that is i don't want to virtualize the whole desktop:o .

But it's all about opinions and flavours, so each chooses what he/she likes best, according to his/hers needs.

[thedriver]

-{ Quote: "i believe you are on the right track with Sandboxie. it seems very secure for browsing, email, P2P, and you just will not find a more involved developer than Tzuk.


Mike" }-
Is a Sandbox really necessary with apps like PG and firewall etc?

[Jarmo P]

Not necessary, but very well recommended.

Thing is I don't trust myself to be so smart to rely on a classical hips only.
For me firewall mostly protects my system from incoming attacks and against services I dont want myself to allow.
PG lets me see what is running on my system. I have of course it not on learning mode, but even that can be helpful for seeing what is/have been running, but really it should be used for execution prevention.

The beautifull thing with sandboxing solutions is that they just work. Need not much deep security expertice to run them.

[Bob D]

-{ Quote: "Is a Sandbox really necessary with apps like PG and firewall etc?" }-
PG (and other HIPS) typically are your last line of defense. If they flag something, typically, it's already on your system.
Sandboxed browsing, for example, keeps anything from getting on your system in the first place.
Firewalls are a different story.
I run my browser almost exclusively sandboxed, but I'm not tossing out my HIPS app. (yet).

Cheers

[thedriver]

-{ Quote: "PG (and other HIPS) typically are your last line of defense. If they flag something, typically, it's already on your system.
Sandboxed browsing, for example, keeps anything from getting on your system in the first place.
Firewalls are a different story.
I run my browser almost exclusively sandboxed, but I'm not tossing out my HIPS app. (yet).

Cheers" }-

Thanks I am not sure exactly how to run Sandboxie. I know I can delete all the browsing but should I delete each time? What will I do with web data I now save to my Documents. Should there be a copy in the sandbox and one outside, if it is safe or should the my documents folder be IN the sandbox?

[Pedro]

Every change made from browsing is virtualized- placed in the sandbox. Inside the sandbox, SandboxIE makes copies of the real folders where things would go without SandboxIE, as they are needed/used.

When you close the browser, you can recover what you want, and delete the rest. You just have to choose what folders SandboxIE should monitor, like "downloads" folder, and when you select "recover files", it will show what's in the "downloads" virtual folder (a mirror/ copy of your real "downloads" folder, inside the sandbox), and the other folders (any folder you want).
This is true for documents, bookmarks etc.
This is called the "Quick Recovery" function, to ease things. When you select to recover, those files are copied to the true folder, the one the sandbox mirrored.

SandboxIE has predefined settings for Firefox, IE, Outlook and Thunderbird, where you can choose what you want.

You can also explore inside the sandbox to recover files from folders you didn't specify in those settings.

I suggest reading from the source (http://www.sandboxie.com/index.php?HelpTopics).

[Bob D]

-{ Quote: "...I know I can delete all the browsing but should I delete each time? What will I do with web data I now save to my Documents. ..." }-
By default, (if you just close your browser) ALL browsing stuff is gone. History, cookies, nasties, EVERYTHING. You don't have to do a thing (pretty neat).
-{ Quote: "What will I do with web data I now save to my Documents" }-
Someone's prior post offers some good suggestions.
Simply put, (before you exit your browser) you can right click on Sandboxie taskbar icon "Contents of Sandbox" / "Explore Contents" and there you will find all of your Sandboxed files which you are free to copy to your un-sandboxed harddrive.
Download and play with it. Part of it's allure is that it is fairly intuitive. You needn't be terribly geeky to utilize it.
Great feeling to surf feeling invulnerable.

[nixie21]

Using sandboxie for 2 days now, and it is very easy as stated. I like it very much...thanks!

[19monty64]

What actually happens to deleted (sandboxie) files??? Couldn't find that at their site...

[Peter2150]

-{ Quote: "What actually happens to deleted (sandboxie) files??? Couldn't find that at their site..." }-

I know this will sound a bit smart assed, but simply they are deleted.

[19monty64]

I was just referring to secure deletion lol and asking if undelete could retrieve these files. Windows "delete" vs. secure delete???

[Franklin]

Using Sandboxie and PowerShadow here with no conflicts or slowdowns.

Blacklists, who needs em.:-X

You can set Ccleaner to empty the sandbox storage folder when not active under options - custom - add folder.

Also the desktop icon "run default web browser under sandoxie" can be renamed to Firefox or whatever and the icon changed to suit.

My FF's normal run icon outside the sandbox is in quicklaunch.

Lean ,mean and clean!

Of course, those ghost images give a bit of confidence as well.;)

[Pedro]

-{ Quote: "I was just referring to secure deletion lol and asking if undelete could retrieve these files. Windows "delete" vs. secure delete???" }-
SandboxIE can only delete. To erase, you can associate an eraser with SandboxIE to erase the sandbox's content.

[Bob D]

-{ Quote: "SandboxIE can only delete. To erase, you can associate an eraser with SandboxIE to erase the sandbox's content." }-
Secure Delete info: http://www.sandboxie.com/index.php?SecureDeleteSandbox
Apparently, Tzuk opted not to incorporate any secure delete function, chose rather to keep program lean, avoid any bloat.
-{ Quote: "...asking if undelete could retrieve these files" }-
Which does beg the question, though:
IF one wanted to recover deleted files, where would they look?
Once the Sandboxed app is closed, all vestiges of sandboxed files go away.
Where do they go? Dunno. Not in recycle bin.

[pilotart]

Deleting just removes location from your 'tree'.

File Recovery software can usually retrieve deleted files as long as that spot on your Hard Drive has not been written over.

That is how "Secure Erase" works, by re-writing zero seven or more times on every spot on HD that held that file. There may be 'forensic software' that could still recover a 'written-over' file.

[Bob D]

-{ Quote: "Deleting just removes location from your 'tree'.
" }-
So where physically on your harddrive (if anywhere) could one find these "removed" files?

[simmikie]

-{ Quote: "Is a Sandbox really necessary with apps like PG and firewall etc?" }-

as necessary as having a girlfriend to back-up your wife.

just kidding. for me it's necessary. i do not walk the dark-side often, and i believe the security set-up i am currently using is pretty sound, but i like the idea of circumventing potential problems at the source. i became spoiled by sandboxing my main 'attack vectors' in particular browsers by Bufferzone. that redborder was/is highly comforting. Sandboxie adds a unusual twist as it does not allow (last i read) drivers to load, which i recently discovered can (at ring0) potentially fool sandboxies. how i do not know. but it seems Tzuk in his wisdom does not allow Sandboxie to load these. it may restrict to some degree the type of programs you can install sandboxed, but may increase overall security. i like that. if i wasnt to test install software i will use ShadowUser though it has some severe limitations itself.

nothing is 100% secure as has been articulated perhaps 100's of times on this forum. but when i have something that is as unobtrusive as Sandboxie, that offers so many potential security benefits, with so little downside (i must delete the contents of the sandbox once in a whenever), the question might be why not use it?



Mike

[simmikie]

-{ Quote: "I was just referring to secure deletion lol and asking if undelete could retrieve these files. Windows "delete" vs. secure delete???" }-

there is a post on Sandboxies website forum on this very topic. to summarize someone suggested making Sandboxies sandbox folder Top Level and using CC to clean. me i simply select delete contents of the sandbox. although i have not been bitten todate, i have been meaning to bring that up on their forum to ascertain exactly what might be insecure with that method.


Mike

[pilotart]

-{ Quote: "So where physically on your harddrive (if anywhere) could one find these "removed" files?" }-There are programs to find them for you; From the AntiVir folks:

Avira UnErase Personal (http://www.free-av.com/) (and click "Products" on that page)
Copy below from linked site above:-{ Quote: "
What is gone is gone? Far from it! Avira UnErase recovers data that have been deleted from the hard drive – either accidentally or as a result of a virus infection, an uninstaller or defective software. The danger of important data being lost forever is averted with Avira UnErase.

The private, non-commercial use of Avira UnErase Personal is free.
" }-
There are also companies that specialize in recovery of 'priceless' files from failed hard drives, at a very high price.

[jawadde]

Can i run sandboxie with 265 RAM? Or is defenswall beter...?

I want to use one of those but im not sure which one to choose :)

[Jarmo P]

With that amount of RAM anything might be too much.

Sandboxie has Control.exe 3.3 MB currently.
Then SandboxieDcomLaunch.exe 2.3 MB.
And SandboxieRpcSs 3.3 MB
And SbieSvc.exe 2.7 MB.

With my new XP Pro with ATI display driver software etc. as default install, my system starts at 370 MB. Must be some unnecessary software that could have been disabled. It did not take nowhere as much with my older XP Home puter with 512 MB memory.
There are PG free and Comodo firewall running as well as Avira Antivir Classic and none are heavy memory users except Avira might take some virtual memory, 52 MB as far as I see is avguard.exe taking, and I think many other software installed takes more memory too with 2GB memory than with having less though. But I do feel a bit ashamed about the machines memory consumption. Must be something I should do. I remember the early days with Sinclair ZX Spectrum, 48 KB memory, no hard disk and still able to run much in that spartan age. So I do think memory consumtion these days is bloated. Good be of use a new tighter designed operating system as well as added software carefully designed with better tools. Just my opinion :P

But Sandboxie is not a heavy user. Depends also how many programs you run sandboxed I think. Above was only with Firefox that is though a memory hog in itself.

[q1aqza]

-{ Quote: "as necessary as having a girlfriend to back-up your wife.

Mike" }-

;D ;D ;D