SandboxIE (Paid) vs Defensewall

[TVH]

I know both are excellent sandboxing programs but which one do people prefer to use?

[MikeNAS]

I like both and they are excellent. After all I'm using Sandboxie because I like it little bit more and it fit to my setup perfectly. Lifetime license is good plus.

[Antarctica]

I also think that DefenseWall is easier to use on a daily bases. My wife could never understand Sanboxie.;D With DW, no problems.:)

[Blackcat]

At the present time, Sandboxie.

This is because DW sucks up CPU cycles on my machine, which eventually leads to a slowdown. It is related to the untrusted processes windows search cycle. Ilya is looking into it.

[the_sly_dog]

Very happy using defensewall tried sandboxie but prefer defensewall now

Ilya is very helpful in any problems i have ;)

not saying sandboxie support is bd just never needed them so only can comment on what i have used

[Scoobs72]

-{ Quote: "

Ilya is very helpful in any problems i have ;)

not saying sandboxie support is bd just never needed them so only can comment on what i have used" }-

Same view here - the support from Ilya is very good. And my wife can also understand Defensewall.

[arran]

I think Sandboxie is better because you have the option to delete all the crap in the sandbox after each browsing session. where as with defense wall it doesn't have a delete option like sandboxie so any Malware that has got in cauld be sitting on your pc for ages.

Another reason why I think sandboxie is better is because it has another option. which is nothing inside the sandbox can access the internet except the programs you choose like your browser program. therefore if any spyware or malware comes into your Sandbox during your current browsing session it cannot access the internet and have any contact with any other remote servers.

unfortunatly defense wall does not have these features.

[Huupi]

-{ Quote: "I think Sandboxie is better because you have the option to delete all the crap in the sandbox after each browsing session. where as with defense wall it doesn't have a delete option like sandboxie so any Malware that has got in cauld be sitting on your pc for ages.

Another reason why I think sandboxie is better is because it has another option. which is nothing inside the sandbox can access the internet except the programs you choose like your browser program. therefore if any spyware or malware comes into your Sandbox during your current browsing session it cannot access the internet and have any contact with any other remote servers.

unfortunatly defense wall does not have these features." }-

I will say be sure that your system is malware free otherwise SBIE is useless in the way you have set it up. [ an example ;keyloggers on your system has their own ways to reach out]
If the system is clean then your config. is rocksolid !!-------waiting for the next hole ! ask Rasheed.

[Ilya Rabinovich]

-{ Quote: "I think Sandboxie is better because you have the option to delete all the crap in the sandbox after each browsing session. where as with defense wall it doesn't have a delete option like sandboxie so any Malware that has got in cauld be sitting on your pc for ages." }-
It is not really true- inactive malware is harmless, I have a tons of it at my hard drive, but I'm not any infected with this malware staff.

Other hand, if you are a professional user who clearly understands what is what- 'rollback' function is at your service.

-{ Quote: "
Another reason why I think sandboxie is better is because it has another option. which is nothing inside the sandbox can access the internet except the programs you choose like your browser program. therefore if any spyware or malware comes into your Sandbox during your current browsing session it cannot access the internet and have any contact with any other remote servers." }-
It's just a question of the near future. I just don't want to be hurry with such the functionality, I need to understand clearly how to keep it the same balance as the main protection itself- simple, clear and strong in defense. It is not so easy work...

[Antarctica]

-{ Quote: "
It's just a question of the near future. I just don't want to be hurry with such the functionality, I need to understand clearly how to keep it the same balance as the main protection itself- simple, clear and strong in defense. It is not so easy work..." }-

Take your time Ilya,no rush.Your program is already very good as it is, and more important bug free.
Thanks for your fantastic support.:)

[arran]

-{ Quote: "I will say be sure that your system is malware free otherwise SBIE is useless in the way you have set it up. [ an example ;keyloggers on your system has their own ways to reach out]
If the system is clean then your config. is rocksolid !!-------waiting for the next hole ! ask Rasheed." }-


it is malware free, since reinstall I never surf the net unless browser is inside sandbox and sandbox contents is allways deleted after each browsing session.

and also the sandbox is only there as a back up incase malware slips thru my filtering software setup.

you see before I knew that Sandboxie even existed I was able to surf porn sites loaded with malware and not get infected and I still can.

And even if malware and trojans etc was able to get passed my filtering setup and get passed Sandboxie which is Highly unlikley my hips software and or antivirus would just nail it.

[EASTER]

Would it be considered redundant or even problematic to run BOTH SandboxIE + DefenseWall together?, or can the two actually be of some real benefit for users that choose such as this choice of defense approach.

[Scoobs72]

-{ Quote: "I think Sandboxie is better because you have the option to delete all the crap in the sandbox after each browsing session. " }-

Surely the fact that Sandboxie deletes everything is quite limiting? You lose all your cookies for example? Also, what if you want to securely delete the browser content? With Sandboxie, is it unrecoverable from your hard disk?

[LoneWolf]

-{ Quote: " Also, what if you want to securely delete the browser content? With Sandboxie, is it unrecoverable from your hard disk?" }-

Read all about it here.
http://www.sandboxie.com/

[Huupi]

-{ Quote: "Surely the fact that Sandboxie deletes everything is quite limiting? You lose all your cookies for example? Also, what if you want to securely delete the browser content? With Sandboxie, is it unrecoverable from your hard disk?" }-

i think you can get it back,some users have an app. called ERASER for this,i myself have no experience with it.

[arran]

-{ Quote: "It is not really true- inactive malware is harmless, I have a tons of it at my hard drive, but I'm not any infected with this malware staff.

" }-

so you have tons of inactive malware sitting on your pc. If I had tons on my pc as well even tho it is inactive it would make me feel uneasy and nervous.

besides it is just wasted space it would be a messy untidy pc with all the extra files and folders, searching for files on your pc would just take longer and your registry would be all cluttered up with all these extra keys relating to all the malware.


-{ Quote: "Surely the fact that Sandboxie deletes everything is quite limiting? You lose all your cookies for example? Also, what if you want to securely delete the browser content? With Sandboxie, is it unrecoverable from your hard disk?" }-

I don't find it limiting at all its quite simple to recover any files I download before I delete the contents. loosing cookies doesn't really bother me because it only takes few seconds to load a web page for the first time with having no cookies for it. and as for deleting why would it need to be unrecoverable?

[Scoobs72]

-{ Quote: "Read all about it here.
http://www.sandboxie.com/" }-

I've taken a look and searched the forum about erasing and cookies. Looks fiddly to me. Not my sort of thing, but I guess if you like playing around with those sort of apps you can get it to work.

[Wake2]

I think both programs are great, when Sandboxie was
first introduced wife and I both started using it, and as
this program evolved it became increasingly complex
and my wife does not understand how it works so she
prefers Defensewall, we have licenses for both, and I
think big issue here is user preference, and taking time
to learn, and understand these programs.

Wake

[aigle]

-{ Quote: " If I had tons on my pc as well even tho it is inactive it would make me feel uneasy and nervous.
besides it is just wasted space it would be a messy untidy pc with all the extra files and folders, searching for files on your pc would just take longer and your registry would be all cluttered up with all these extra keys relating to all the malware.
" }-Why do u expect to have tons and Gigs of malware on ur system. I am sure u might not get more than a few KB or MB of that in routine use.

[the_sly_dog]

I think they are both great programs both have pros and cons so what ever one you feel fits your bill :thumb: :thumb:

[MikeNAS]

-{ Quote: "Also, what if you want to securely delete the browser content? With Sandboxie, is it unrecoverable from your hard disk?" }-

Here you are (example):

"c:\Program Files\Eraser\eraserl.exe" -folder "%SANDBOX%" -subfolders -method DoD -results -queue

eraserl [Data] [Method] [-silent | -results | -resultsonerror ] [-queue] [-options]

Data:

-file....................data [-subfolders]
-folder................data [-subfolders] [-keepfolder]
-disk..................drive: | all
-recycled

Method:

-method.............Gutmann | DoD | DoD_E | Random passes | Library

Parameters:

-file...................The data to erase is a file (wildcards may be used)
-subfolders.........Include subfolders
-folder...............The data to erase is files on a folder
-subfolders.........Include subfolders
-keepfolder........Do not delete the folder
-disk.................The data to erase in unused space on a drive or all local hard drives (all)
-recycled...........Erase all data on the Recycle Bin
-silent...............Do not show any windows
-results.............Show Erasing Report
-resultsonerror..Show Erasing Report only in case of error
-queue..............Wait until previous instances have finished
-options.............Ignore all other valid parameters and show Erasing Preferences window

[EASTER]

Mine is a little different

For starters at top menu just under CONFIGURE-EDIT CONFIGURATION ... open in notepad and just under these listings
LingerProcess=devldr32.exe
LingerProcess=acrord32.exe
LingerProcess=jusched.exe
LingerProcess=syncor.exe
ClosedFilePath=!iexplore.exe,\Device\Afd*
ClosedFilePath=!iexplore.exe,\Device\RawIp
ClosedFilePath=!iexplore.exe,\Device\Udp
ClosedFilePath=!iexplore.exe,\Device\Tcp
ClosedFilePath=D:\
ClosedFilePath=E:\

In blue is users choice but will block access if needed:

Replace !iexplore.exe to your own choice if using another browser of course.

For Secure Erase i found this setting also works for ERASER 5.82/5.86

At top menu-SANDBOX-DEFAULT BOX-SANDBOX SETTINGS-DELETE-command and add eraserl -folder "%SANDBOX%" -subfolders -method DoD -results

This should be close if not spot-on to working settings, if not feel free to dispute my selections and offer corrections please.

EASTER

[MikeNAS]

-{ Quote: "eraserl -folder "%SANDBOX%" -subfolders -method DoD" }-

Yeah that works too because eraserl.exe is in system folder. You haven't blocked any registry access? I have also deleted those linger process rules because they can't run because I have also this "killer" rule:

ClosedIpcPath=!opera.exe,* <- Only Opera can run.

[Huupi]

Tzuk recommend to stay away of it,instead to use the GUI,yes it can all be done from the GUI.
I did so to configure it to my satisfaction.

[EASTER]

-{ Quote: "Yeah that works too because eraserl.exe is in system folder. You haven't blocked any registry access?

" }-

Registry access?Mind pointing those out for me please?

Thansk

[Threedog]

I've been trying them both out but am starting to lean a little more on the Defencewall side.

[Rasheed187]

-{ Quote: "If the system is clean then your config. is rocksolid !!-------waiting for the next hole ! ask Rasheed." }-

Huupi, of course I was also very disappointed, but I guess these things are unavoidable, almost every HIPS out there can not protect against certain types of malware. Even HIPS who are developed by more than one guy still have holes, or don´t even monitor important stuff, so you also need to put things in perspective.

Btw, I think it´s best to execute malware (or apps that you´re not sure about) only inside VM, because you can never be sure if sandboxes wil be able to stop advanced attacks. Running as non-admin also helps a lot of course. But I must say that so far SafeSpace does make a very good impression, none of my malware samples were able to "leak".

[demoneye]

hi all

both programs are great , DW is for more like home user and SB is for more advence users.

if u put this 2 awesome progs one against each other i am sure u will find out thats SB is more secure in many ways , more user control in programs behavior , and most command are open to edit and adjest the system for your needs.

and yes also abig and importand advantage SB on DW like other says in here its the option to clean the continer and get rid of any malware known and unknown to mankind :dry:

cheers

[EASTER]

For good measure i cover these and my HIPS with Power Shadow or in everyone else's case it would be Returnil or some other one.

[Empath]

The x vs y threads are bothersome for me, particularly when you're dealing with two different concepts. DefenseWall and SandboxIE are not the same type of utility. SandboxIE can be called on to perform isolations from internet threats. DefenseWall was designed with isolating such threats in mind.

DefenseWall isolates through policy, and SandboxIE isolates literally though temporary environments. That is not a comparable arrangement.

The protection from DefenseWall is maintained after exposure by policy and tagging of potential threats. The protection from SandboxIE after exposure is by literal removal of the exposed environment.

I like them both. I have to recognize one thing though. If I have DefenseWall protecting me from Malware on my system, then removing DefenseWall leaves me vulnerable to the Malware. If I have Sandboxie protecting me, and I remove SandboxIE, there's no Malware still sticking around.

[demoneye]

-{ Quote: "The x vs y threads are bothersome for me, particularly when you're dealing with two different concepts. DefenseWall and SandboxIE are not the same type of utility. SandboxIE can be called on to perform isolations from internet threats. DefenseWall was designed with isolating such threats in mind.

DefenseWall isolates through policy, and SandboxIE isolates literally though temporary environments. That is not a comparable arrangement.

The protection from DefenseWall is maintained after exposure by policy and tagging of potential threats. The protection from SandboxIE after exposure is by literal removal of the exposed environment.

I like them both. I have to recognize one thing though. If I have DefenseWall protecting me from Malware on my system, then removing DefenseWall leaves me vulnerable to the Malware. If I have Sandboxie protecting me, and I remove SandboxIE, there's no Malware still sticking around." }-

yes total agree with you . both use defrent method in order to prevent malware. SB use a virtual environments (like SD or DF) when DW uses policy.
this why SB is more secure and stable for any malware attack.

cheers

[lucas1985]

-{ Quote: "both use defrent method in order to prevent malware. SB use a virtual environments (like SD or DF) when DW uses policy.
this why SB is more secure and stable for any malware attack." }-
Please, back up your claims :)

[Threedog]

Hmmmmmm I dont know. Both are very strong but just different in the way they work. I cant see a person going wrong running either.

[steve161]

-{ Quote: "both programs are great , DW is for more like home user and SB is for more advence users." }-

As one of the resident noob testers, I can say that sandboxie was quite easy to set up and use effectively. With little effort with the free version, I was able to choose to run my browser sandboxed via the context menu, automatically delete the contents of the sandbox when closing the browser, or add the sandbox folder to both ccleaner and eraser if i wanted to securely wipe the contents of the sandbox. This was an earlier version, but I can't imagine the dev making subsequent versions more difficult to use.

[arran]

-{ Quote: "

I like them both. I have to recognize one thing though. If I have DefenseWall protecting me from Malware on my system, then removing DefenseWall leaves me vulnerable to the Malware. If I have Sandboxie protecting me, and I remove SandboxIE, there's no Malware still sticking around." }-

exactly like I said before Sandboxies better because you can delete all malware after each browsing session.

if your running defense wall and you have live malware on your pc trapped inside, what if for some reason defense wall became tempory disabled either by uninstalling it or reinstalling it or installing an up date?? I would hate to think what might happen to your pc if defense wall ever became disabled with all that malware sitting on your pc.

[lucas1985]

That malware won't do anything because it couldn't create autostart entries earlier. Seriously, these malware first isolated by DW are nothing but inactive files which can't do anything unless you double-click them.
GeSWall FAQ (http://www.gentlesecurity.com/docs/geswallfaq04.html#q3)
-{ Quote: "
Q: I am using the latest version of GeSWall and my AV discovered the Trojan/Backdoor in my system32 folder. How it got round GeSWall?
A: There is a difference between presence of virus/trojan and having it running. For example, on one of our system we have dozens of viruses, but the machine is not infected because viruses are not running just stored, The problem is when you have that trojan executable running. File presence doesn't flag a problem yet. There are security products that prevents creating files, but GeSWall designed to work in other way. Instead of blocking file creation (no matter what destination: system32, temp, etc. ) GeSWall tracks out files created by isolated applications. Assume you have somehow received that trojan through the isolated browser. GeSWall will not prevent the file to be written in system32. However, on the trojan start GeSWall will isolate it and prevent a damage posed by this trojan: no trusted file can be modified or deleted, no confidential data leaked. So basically the trojan is locked within GeSWall's isolation layer and cannot do a harm. Additionally, GeSWall prevents subsequent auto-runs (when it is started without your desire on some event: every boot, logon, etc.) of this trojan. Most places used by malware for auto-run covered by this
tool: http://www.sysinternals.com/Utilities/Autoruns.html. It means that trojan will not be installed in the system and cannot "re-started" later.
GeSWall use this "tracking" approach in order to be as non-intrusive as possible. Nobody knows in advance if a file is dangerous or not, preventing creating files into system32 may break functionality of
certain application. Using ""tracking GeSWall avoids those problems and keeps security measures at the high level.
In that scenario you would need an Antivirues in order to clean malware files from your system, when a vendor becoming aware of it. But, again, just presence of malware files on your disk does not mean
that you are infected by the malware.
" }-

[MikeNAS]

-{ Quote: "Registry access?Mind pointing those out for me please?

Thansk" }-
ClosedKeyPath=HKEY_CURRENT_CONFIG
ClosedKeyPath=HKEY_USERS
ClosedKeyPath=HKEY_LOCAL_MACHINE
ClosedKeyPath=HKEY_CURRENT_USER
ClosedKeyPath=HKEY_CLASSES_ROOT

[EASTER]

-{ Quote: "ClosedKeyPath=HKEY_CURRENT_CONFIG
ClosedKeyPath=HKEY_USERS
ClosedKeyPath=HKEY_LOCAL_MACHINE
ClosedKeyPath=HKEY_CURRENT_USER
ClosedKeyPath=HKEY_CLASSES_ROOT" }-

hMMM, Interesting.

So in SandboxIE theres really no limitations to ClosedPaths except seems i remember tzuk saying in his forums that ClosedFolderPath would take precedence over other ClosedPath's, for example ClosedFilePaths. Gives me something to study up on since i'm not quite sure just how all this ties in so i think some more reading at SandboxIE forums are in store for me.

Thanks MikeNAS for posting those. I'll test them out.

Regards EASTER

[Scoobs72]

-{ Quote: "SB use a virtual environments (like SD or DF) when DW uses policy.
this why SB is more secure and stable for any malware attack.
" }-

Doesn't that depend on the user? If I gave SB to my wife, who then had to configure it, I bet you my house that SB would be far less secure that DW. In fact SB would probably not even work at all :D
As I see it, for 99.99% (or whatever percentage of people are not PC security literate) of people DW would provide a more secure solution, without the risks of configuration. Of course, most people on Wilders could probably handle SB. Myself? I just grew weary of the prompts from trying out various HIPS and never knowing with 100% certainty if "Allow" was really the right thing to do.

[MikeNAS]

-{ Quote: "Doesn't that depend on the user? If I gave SB to my wife, who then had to configure it, I bet you my house that SB would be far less secure that DW. In fact SB would probably not even work at all :D
As I see it, for 99.99% (or whatever percentage of people are not PC security literate) of people DW would provide a more secure solution, without the risks of configuration. Of course, most people on Wilders could probably handle SB. Myself? I just grew weary of the prompts from trying out various HIPS and never knowing with 100% certainty if "Allow" was really the right thing to do." }-

SB is secure without extra settings. Just remember to run programs inside of that :D

[innerpeace]

Ok, I'm using Sandboxie and trust me, I'm not an advanced user ;). However, it provides me advanced protection that changed the way I look at security setup. Sandboxie is the only sandbox program that I have tried and I'm sticking with it for now because it works, I understand it and it works with what I do daily.

With that said, I was very tempted to try DefenseWall when it appeared on GAOTD. 99% of what I read about Sandboxie and DefenseWall is positive and the same can be said about their developers. As already stated, you can't go wrong either way. I'm also sure if you have a problem with either program that a solution will be found eventually. What more could you want?

innerpeace

[EASTER]

-{ Quote: "Doesn't that depend on the user? If I gave SB to my wife, who then had to configure it, I bet you my house that SB would be far less secure that DW. In fact SB would probably not even work at all" }-

If that same 99.99% can do something as elementary as Copy/Paste text on a PC then they won't have any real difficulty with SandboxIE, since all a user needs do is access their RIGHT CLICK MENU and select RUN SANDBOXED.

How much simpler can it get?

But i see your point on DefenseWall but also consider this, DefenseWall ALSO employs a RIGHT CLICK MENU to access RUN AS UNTRUSTED/TRUSTED etc.

So there's very little difference in that respect.

[Scoobs72]

-{ Quote: "If that same 99.99% can do something as elementary as Copy/Paste text on a PC then they won't have any real difficulty with SandboxIE, since all a user needs do is access their RIGHT CLICK MENU and select RUN SANDBOXED.

How much simpler can it get?

" }-

And I think that's the bit that would catch most users out! It seems to me (and correct me if I'm wrong because as haven't used Sandboxie), that you need to add programs into the Sandbox to make them 'untrusted', whereas with Defensewall all you internet facing apps and anything you download from them is untrusted automatically, unless you specifically trust them. Have I got that right?

[EASTER]

-{ Quote: "And I think that's the bit that would catch most users out! It seems to me (and correct me if I'm wrong because as haven't used Sandboxie), that you need to add programs into the Sandbox to make them 'untrusted', whereas with Defensewall all you internet facing apps and anything you download from them is untrusted automatically, unless you specifically trust them. Have I got that right?" }-

It's a two-way street as i understand it Scoobs72, some apps are by default auto-non-trusted=sandboxed and with the right click menu, it's there to add more or even change status to trusted and such. But i'm also still feeling my way around this fabulous program myself.

The resident specialist is it's chief developer Ilya and he can better address any concerns or questions regarding this program along with clarifying the rights from the wrongs ways of useage. :)

Regards EASTER

[MikeNAS]

BTW Sandboxie users. Now you can add more than one program which can access to internet.

Download v3.23.05 (http://www.sandboxie.com/SandboxieInstall-323-05.exe)


-{ Quote: "

OK ... This was requested too many times so I decided to do something about it. I added the concept of process groups, so you can now declare:

[GlobalSettings]
ProcessGroup=<InternetPrograms>,iexplore.exe,MyDownloadManager.exe,firefox.exe,outlook.exe


(Don't forget to reload the configuration after adding this new setting.)

Then you can go to Sandbox Settings -> Resource Access -> Internet Access,
click Set By Name
and type <InternetPrograms>
(note the <angle brackets> there)

At some later time I will revise the Internet Access page to display a nice list of programs, and manage the process group behind the scenes. For now, you have to do it manually.

A process group can be used almost anywhere a process name can be used, so that should be in OpenXxxPath, ClosedXxxPath, OpenWinClass, ForceProcess, AlertProcess. But NOT in LingerProcess.

And just in case it wasn't clear, <InternetPrograms> is an example, you can declare any name for a process group, and any list of processes.

" }-

[EASTER]

Thanks for the heads up.


EASTER

[Ilya Rabinovich]

-{ Quote: "whereas with Defensewall all you internet facing apps and anything you download from them is untrusted automatically, unless you specifically trust them. Have I got that right?" }-
Not Internet-facing, but those of them which contact potentially dangerous content. Also, there are too many such the applications in the world, it is simply impossible to add all of them into the built-in list- it is just out of the human possibilities. Some need to be added to untrusted manually.

[demoneye]

welp new SB version been relese http://sandboxie.com/phpbb/viewtopic.php?t=2936..

SB owner is very fast :argh:

[MikeNAS]

ClosedIpcPath=!opera.exe,* <- Only Opera can run.

With newest version you can use that ProcessGroup setting with ClosedIpcPath so you can set more than one program which can run inside of that sandbox. So you can set it like this:

ProcessGroup=<Browsers>,iexplore.exe,opera.exe,firefox.exe

ClosedIpcPath=!<Browsers>,*

Now I only need to easy way to block all unneeded system ( c: ) drive access. Maybe I have to start use portable K-Meleon.

[demoneye]

-{ Quote: "ClosedIpcPath=!opera.exe,* <- Only Opera can run.

With newest version you can use that ProcessGroup setting with ClosedIpcPath so you can set more than one program which can run inside of that sandbox. So you can set it like this:

ProcessGroup=<Browsers>,iexplore.exe,opera.exe,firefox.exe

ClosedIpcPath=!<Browsers>,*

Now I only need to easy way to block all unneeded system ( c: ) drive access. Maybe I have to start use portable K-Meleon." }-

i dont realy understand what this new improve can do....u can always make a new countiner and add lots of programs run in sandbox...what the improvment in the new ver?

cheers :wacko:

[Huupi]

-{ Quote: "ClosedIpcPath=!opera.exe,* <- Only Opera can run.

With newest version you can use that ProcessGroup setting with ClosedIpcPath so you can set more than one program which can run inside of that sandbox. So you can set it like this:

ProcessGroup=<Browsers>,iexplore.exe,opera.exe,firefox.exe

ClosedIpcPath=!<Browsers>,*

Now I only need to easy way to block all unneeded system ( c: ) drive access. Maybe I have to start use portable K-Meleon." }-

Is there any special with ProcessGroup,can u explain,as far i know it was always possible to run several programs at the same time in a box.

[MikeNAS]

-{ Quote: "Is there any special with ProcessGroup,can u explain,as far i know it was always possible to run several programs at the same time in a box." }-

Yes there is lots of speciality. Without this you can set that only one specify program can connect to internet or run. With ProcessGroup you can set that many specify programs can connect to internet or run. Other blocked.

[Huupi]

-{ Quote: "Yes there is lots of speciality. Without this you can set that only one specify program can connect to internet or run. With ProcessGroup you can set that many specify programs can connect to internet or run. Other blocked." }-

I have a Sandbox specific for Online Banking,only my browser allowed to connect,further i can't think of any other program on my rig that need that exception.

BTW some malware if at all on your system will phone home with their own dedicated server,they need no connection through the browser.

But you may correct me if i don't get the concept of ProcessGroup.

Sandboxie is insofar usefull if you start with a clean system and keep it that way so a layered protection will your second defence.

[MikeNAS]

-{ Quote: "i dont realy understand what this new improve can do....u can always make a new countiner and add lots of programs run in sandbox...what the improvment in the new ver?

cheers :wacko:" }-

With new version I can type this:

[GlobalSettings]

ProcessGroup=<InternetPrograms>,k-meleon.exe,sandboxiedcomlaunch.exe,sandboxierpcss.exe,start.exe

[DefaultBox]

ClosedIpcPath=!<InternetPrograms>,*

So now only those listed processes can run. With older version I can only allow one so there is some problems because needed sandboxie components can run.