Sandboxie Acquired by Invincea

Discussion in 'sandboxing & virtualization' started by ad18, Dec 16, 2013.

Thread Status:
Not open for further replies.
  1. Moose World

    Moose World Registered Member

    Joined:
    Dec 19, 2013
    Posts:
    905
    Location:
    U.S. Citizen
    On my PC down-stair in the basement. The PC is ob 24/7!
    After the PC go into sleep mode and I awaken it the UC
    Browser still have left over from early. You have to delete
    it a second time to complete remove content.
     
  2. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4,644
    Location:
    Under a bushel ...
    I like WizTree, but hadn't come across MyFolders which is useful in the SBIE world - thanks for the tip Rasheed, now installed.
     
  3. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,147
    Location:
    Nicaragua
    Hi Moose, if you set the sandbox to delete on closing sandboxed programs and the sandbox doesn't delete automatically every time, that doesn't mean there is a problem with Sandboxie. What it means is that you have a program in your computer that sees files inside the sandbox as being copied to the disk and decides to scan them and locks them. Thats the usual reason for sandboxes that don't delete automatically. An antivirus is usually the program that causes it.

    If you experience this situation once a month or every few months, I wouldn't mind it. All Sandboxie users experience this sort of thing sometimes. But if you experience it every other day, then it would be worthwhile figuring out the program thats locking sandboxed files. In my personal case, after I stopped using real time antiviruses, this thing pretty much never happens anymore for me.

    Bo
     
  4. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    I never see this with EAM, off course I never have done a full disk scan, which is probably what looks the files
     
  5. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,147
    Location:
    Nicaragua
    Hi Pete, usually, it is the real time part of the AV that locks the files, that includes the HIPS, behavior blocker, etc. As files are created within the sandbox, the AV see these files as being copied to the disk, locks them and scans them. If an AV does not lock sandboxed files often, I think that can be taken as a sign that the AV gets along well with SBIE

    Bo
     
  6. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Yep, EAM/EIS sure seem to. I've seen the lock up occasionally, but usually the problem was the software between the ears.
     
  7. Page42

    Page42 Registered Member

    Joined:
    Jun 18, 2007
    Posts:
    6,944
    Location:
    USA
    Currently I am running 5.05.2. I believe I read that there have been no code changes since then, just the version # has been changed to 5.06? Is that correct? TY
     
  8. marzametal

    marzametal Registered Member

    Joined:
    Mar 19, 2014
    Posts:
    766
    If you visit this page, you will see there was a version 5.0.5.3
     
  9. Page42

    Page42 Registered Member

    Joined:
    Jun 18, 2007
    Posts:
    6,944
    Location:
    USA
    Thank you, marzametal.
     
  10. Moose World

    Moose World Registered Member

    Joined:
    Dec 19, 2013
    Posts:
    905
    Location:
    U.S. Citizen
    Bo! Thank you for your insight and information with details.
    Appreciate!
    :thumb:
     
  11. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands
  12. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands
    Isn't this a bug? I don't believe that this should be possible. BTW, I've noticed that if I run Opera 12 and Firefox in the same sandbox, FF often crashes, this didn't happen with SBIE v4. FF works just fine in a separate sandbox.
     
  13. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4,644
    Location:
    Under a bushel ...
  14. guest

    guest Guest

    Anyone knows which registry keys of Sbie should be protected against external modifications and potential process terminations?
     
  15. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,147
    Location:
    Nicaragua
  16. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,147
    Location:
    Nicaragua
    I don't know why it happens but it shouldn't happen. The guys from Invincea read this thread but perhaps you should post your findings at the SBIE forum. I PM one of the guys at Invincea and suggested he reads posts 2144 and 2147.

    Bo
     
  17. guest

    guest Guest

    not exactly what i want; imagine a malware manage to run on my system (from an external vector unrelated to Sbie, say an infected USB, etc...), and try to terminate/modify Sbie by modifying registry keys , i would want to know which keys should be protected to avoid this scenario.
     
  18. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,147
    Location:
    Nicaragua
    Like Tzuk said, the point of Sandboxie is to isolate programs in the sandbox. In my opinion, for Sandboxie to work, you have to start with a clean computer. If thats the case, Sandboxie works well. If the computer is infected and then you install SBIE, is very little what SBIE can do.

    Bo
     
  19. guest

    guest Guest

    i know, Sbie is installed right after a clean install, but everything can happen, im doing an assessment of my security to minimize the potential risks, protecting processes/registry keys/folders/files.
    so knowing which keys will be less laborious than selecting all of them.
     
  20. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,147
    Location:
    Nicaragua
    You edited your post. I ll reply to what you added. If you are a Sandboxie user, you should not ever be infected by anything running out of a USB drive. All you have to do to protect yourself from an infected flash drive is to force your USB drives. If you do, anything that runs out of the USB drive, runs sandboxed automatically using a sandboxed version of Windows explorer.

    Bo
     
  21. guest

    guest Guest

    i know lol, i just want to know which registry keys are related to Sbie in that scenario... doesn't matter if i am infected or not , or how i get infected.

    Take this metaphor, In a car you have breaks, but the breaks have a mechanism to make them work, so you need to know which parts of this mechanism need to be checked once a while to ensure your breaks will not fail.
     
  22. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi guest

    I think you are going for overkill. If something has gotten past everything else you've got by the point it gets to SBIE registry keys it's all over anyway.
     
  23. guest

    guest Guest

    Seems i will never get my answer lol. I just wanted to learn more about Sbie. Thanks everybody anyway.
     
  24. Mr.X

    Mr.X Registered Member

    Joined:
    Aug 10, 2013
    Posts:
    4,813
    Location:
    .
    There's always Curt at Invincea to respond your questions, I guess...
     
  25. guest

    guest Guest

    Yes i will try there. I was just used to ask here ^^
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.