VoodooShield/Cyberlock

Discussion in 'other anti-malware software' started by CloneRanger, Dec 7, 2011.

Page 210 of 767
  1. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    Dan et al
    1) Need another explanation...thinking VS Basic Settings not working. I clicked on Windows Defender desktop Icon that's been dormant for a very long time on my 7yo Vista box. Well, I got the Windows pop telling me W Defender is Off. NO PROMPT from VS.
    Log shows Allowed c:\program files\windows defender\msascui.exe and Whitelist shows same. Here's the rub. I have Automatically allow all software from the Programs Files folder not-checked. VS 2.13beta was SMARTMODE.
    ___________________________________________
    2) When I close Snapshot VS Sync's ~ I have Synchronize and Backup NOT CHECKED.
    ___________________________________________
    3) Disabled VS Protection to update CCleaner to latest. Upon open first time VS Allowed and Whitelisted NO PROMPT. The hash cannot be the same as prior version. And the rub is...I dragged the Installer to VS after and it pop'd Threat Has Been Detected ~ Win32/Bundled.Toolbar.Google.D
    ______________________________________
    4) So, I delete CCleaner from my Snapshot. Open CCleaner ~ NO PROMPT from VS
    Open and Close CCleaner several times. No Log or Snapshot info for CCleaner.
    Like it does not exist.

    Something is not firing on all cylinders.
     
    Last edited: Nov 28, 2014
    bjm_, Nov 28, 2014
    #5226
  2. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    There is probably some kind of line your going to need to Sandboxie so it can communicate with VS. I've had to do it with ERP, EMET, HMPA etc.
     
    Peter2150, Nov 28, 2014
    #5227
  3. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    Well, fwiw "bo elam" says not to sandbox VS
     
    bjm_, Nov 28, 2014
    #5228
  4. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    That is correct, same is true not to sandbox any of the securities programs. But they have to be able to communicate with stuff in sandboxie. That is where the "line" I am talking about comes into play
     
    Peter2150, Nov 28, 2014
    #5229
  5. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    Well, I don't how to edit the config to accomplish. Norton has a SBoxie Template as does EMET. VS no Template. IDK
    If you have idea's ~ I'm all ears
     
    bjm_, Nov 28, 2014
    #5230
  6. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,147
    Location:
    Nicaragua
    If there's no problem then there's no need for a template or edit the SBIE config file. Try both programs as you have it now, if a problem comes up, its likely that you ll notice it. And then, look for the solution.:)

    Bo
     
    bo elam, Nov 28, 2014
    #5231
  7. Gillor

    Gillor Registered Member

    Joined:
    Jul 12, 2013
    Posts:
    88
    Location:
    UK
    I am running VS and Sandboxie and certainly VS doesn’t operate within Sandboxie (well, the way I have my system set up anyway) but I don’t really see the need.
    Anything lurking within the sandbox is toast once Sandboxie closes and then VS comes into its own if you decide to recover anything from the sandbox.
    To protect against the possibility of man-in the-browser attacks and passwords theft during a sandboxed session then try something like Zemana Keylogger Free.
     
    Gillor, Nov 29, 2014
    #5232
  8. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    VS EULA states << VoodooShield™ was designed to be a better alternative to the Microsoft Windows User Account Control (UAC). >> Okay VS is not an alternative to UAC. VS is a better alternative to UAC. Hence a replacement for UAC as I wrote in #5208.
    Upon Install VS takes the field and UAC is supposed to be sent to the bench. Only on my box the Manager of the Team is confused. VS Install does not send UAC to the bench. So, as a devoted Fan. I send UAC to the bench prompting the Manager to warn UAC has been benched. The Manager wants UAC on the bench but, also warns UAC is on the bench. The Manager is clearly confused. The Fan does not know what to make of the Manager's anomaly.
     
    bjm_, Nov 29, 2014
    #5233
  9. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    Since, there is an answer for everything. Maybe you can offer an answer why when I open NirSoft BluescreenView for the first time since VS Install. VS was silent. NirSoft populated to Log Allowed and populated to Snapshot. As stated before I have removed the check from "Automatically allow all software..." I am beta testing. I need to see VS WAD (working as designed).
     
    bjm_, Nov 29, 2014
    #5234
  10. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    An anti keylogger will not stop a breach by malicious browser extensions. Zemana is a browser extension. The PCWorld article posted explains in detail the vulnerability of browser extension. Malware can manipulate Zemana to act as keylogger reporter.
    <<Note: The “Free” version of Zemana AntiLogger only encrypt keystrokes and does not notify nor block any detected keylogging activity. It’s a very different method to protecting against keyloggers and you can read more about the keystroke encryption test that we’ve done.>> https://www.raymond.cc/blog/what-is-the-best-anti-keylogger-and-anti-screen-capture-software/
    That said this venue is not for discussing the value of anti-keyloggers nor the value of Sandboxie. This venue is for testing the value of VS. I need to know if VS will thwart manipulation of browser extensions sandboxed / not sandboxed.
     
    bjm_, Nov 29, 2014
    #5235
  11. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Correct. It will take the VS developer to work that out maybe with the help of the SBIE folks. The reason you want it is so VS can react to something that may run in the sandbox, rather then let it run and be deleted by deleting the sandbox. If they can't talk then VS won't react to anything in the Sandbox.
     
    Peter2150, Nov 29, 2014
    #5236
  12. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    That is absolutely correct. The other programs I use are not sandboxed, but they do have to be able to talk to each other.
     
    Peter2150, Nov 29, 2014
    #5237
  13. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    Aha!!! So, VS does not have the ability to talk with SBoxie. Great info. Much appreciated. VS home page posts <<“No, thank you! What you guys have created is a masterpiece! It also works flawlessly with Sandboxie! I will do a large test against malware, with your permission, and perhaps post it here?”>> 'Here' pointing to Wilders. LUV to find that post and member. Any one see that post or know that member.
     
    bjm_, Nov 29, 2014
    #5238
  14. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    You have succinctly stated my quandary. Thank you ! :thumb:
    I'm also having problems getting VS to react outside sandbox.
     
    bjm_, Nov 29, 2014
    #5239
  15. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    I am going to test and post back.
     
    Peter2150, Nov 29, 2014
    #5240
  16. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Okay tested:

    Test methodolgy

    1. I routinely run NVT's ERP. for this test I first removed the compatibility line in Sandboxie in the my Default Sandbox which is set to all everything to run with no internet access
    2. Downloaded GRC's Leaktest.exe to my desktop
    3. If I just run Leaktest from the desktop ERP intercepts and asks about allow/block
    4. If I Right click on the Leaktest exe and select run sandboxed, I then select the default sandbox. It runs with no challenge from ERP
    5. If I replace the ERP lines in SBIE, and repeat step 4. Then ERP does indeed challenge Leaktest and either allow or block based on my choice.

    Now I installed VS and let it initialize and rebooted. Then I checked the snapshot, to be sure leaktest wasn't there.

    Now the test.

    1. Right clicked on leaktest.exe and ran it Sandboxed. VS didn't make a peep. The leaktest ran and couldn't access the internet.
    2. Just ran Leaktest from the desktop. VS did indeed intercept it. Then disturbingly it found it to be malware, and of course the choice was block or quarantine.

    Conclusion.

    By default installation, VS does NOT work with Sandboxie

    Comment.

    I was very disturbed by it's action thinking Leaktest was bad. I had no choice to get to run, but by selecting train. So if I wanted to let it run, but have VS on to monitor anything else it did I couldn't. For me this would be unacceptable behaviour

    Pete
     
    Peter2150, Nov 29, 2014
    #5241
  17. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    Hopefully, VS will take note...as I unfortunately came to the same conclusion despite VS allowing quotes from Wilders on VS Home page to the contrary <<"It also works flawlessly with Sandboxie! I will do a large test against malware, with your permission, and perhaps post it here?”>> VS virustotal scan blocks even on one flag. I prefer this criteria.
    I would rather take a few to investigate than to fluff off as false positive. Even though MalwareKits use VT to test detection and write code to avoid. "By default installation, VS does NOT work with Sandboxie"
    I've reverted back to 2.12 to re-test from my starting point. 2.13beta was not prompting as I think it should. As I thought it did with 2.12 ~ Edit: back to 2.13beta, still not prompting as I think it should. And UAC warning Icon sits in sys tray
    Thank you and Thanks Wilders
     
    Last edited: Nov 29, 2014
    bjm_, Nov 29, 2014
    #5242
  18. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    What's the purpose of the desktop shortcut. After VS Exit. Shortcut does not bring back VS. Have to restart. Seems all the desktop Icon does it look pretty.
     
    bjm_, Nov 30, 2014
    #5243
  19. trott3r

    trott3r Registered Member

    Joined:
    Jan 21, 2010
    Posts:
    1,283
    Location:
    UK
    I had the same problem(cant connect to service) with my internet down but for some reason i couldnt get into services.msc as i did not have admin rights so had to reboot.
    It works now and i have admin rights as usual.
     
    trott3r, Nov 30, 2014
    #5244
  20. trott3r

    trott3r Registered Member

    Joined:
    Jan 21, 2010
    Posts:
    1,283
    Location:
    UK
    I tried this on my win7 setup and winpatrol was the first to block it :)
     
    trott3r, Nov 30, 2014
    #5245
  21. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    So, VS never saw it ?
     
    bjm_, Nov 30, 2014
    #5246
  22. trott3r

    trott3r Registered Member

    Joined:
    Jan 21, 2010
    Posts:
    1,283
    Location:
    UK
    Correct
     
    trott3r, Nov 30, 2014
    #5247
  23. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,459
    Location:
    .
    Ol' WinPatrol
    They got a sale going on anyone interested
     
    Last edited: Nov 30, 2014
    bjm_, Nov 30, 2014
    #5248
  24. trott3r

    trott3r Registered Member

    Joined:
    Jan 21, 2010
    Posts:
    1,283
    Location:
    UK
    got the lifetime plus license from bitsdujour a month or so ago :)
     
    trott3r, Nov 30, 2014
    #5249
  25. trott3r

    trott3r Registered Member

    Joined:
    Jan 21, 2010
    Posts:
    1,283
    Location:
    UK
    Actually it is in my sig:
    "Desktop2ndboot:Win 7 64bit,Hitmanpro daily scan,Outpost 9.1"

    but out of date zemana and VS add to the above.

    mbae and AG are on xp
     
    trott3r, Nov 30, 2014
    #5250
Page 210 of 767
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...