Sandboxie Acquired by Invincea

A question for anyone running MB3 alongside Sandboxie.

Previously one had to manually include Template_MBAE in Sandboxie Config.: https://www.wilderssecurity.com/threads/sandboxie-acquired-by-invincea.357312/page-88#post-2543950

I have been running MB3 Anti-Exploit module only for a few days and have not had any issues with e.g. Firefox in Sandboxie. There is no MB3 Template in the Config Global Settings.

But is there anything I should be adding manually to the Sandboxie Config?

 

Hi Paul, usually, if a program is working well along Sandboxie, you would not need to add a template. I know you say MBAE is working fine along Sandboxie but it would be ideal if you could test MBAE to make sure its working properly without the need of settings from the Sandboxie side. If you can test and MB works as its supposed to, you don't need to add a template and you are better off not having to do it.

Bo

 

FWIW ~ w my setup. I'm able to confirm need for Direct Access for favicons.sqlite. My previously reported random issue with CCleaner #3988 seems to be so random to allude reproducing, at this time.

 

Thats correct, bjm. Everyone using Sandboxie and Firefox has to allow Direct file Access for favicons.sqlite in order for favicons to be saved out of the sandbox.

Bo

 

Short feedback. I struggled to make Sandboxie compatible with Symantec Enterprise Antivirus and Firefox. The Firefox just didn't wanted to start. I had to try to open it several times, to get it started. Now I am using Free Bitdefender (which I don't like cause of lack of options) and Firefox is running fine.

I am on Win 7. Is MS antivirus any good for this OS? I see that Win Defender has replased MS antivirus in Win 10. Any suggestion.

 

I have been using this template.

https://www.wilderssecurity.com/thr...warebytes-3-0-beta.389946/page-3#post-2631486

I have not tried it recently without this. Certainly earlier builds of MB3 didn't work for me by default. Have you checked the anti-exploit is actually working using e.g. process explorer.

 

In my opinion, if you are disciplined enough to use Sandboxie most of the time, MSE is more than plenty as an AV. But I dont know if MSE is still available.

Bo

 

Good to know, Stapp. Thank you.

@albsat, MSE and WD get along perfectly well with Sandboxie. You ll avoid issues and malware by using them along each other.

Bo

 

I was using MB3 AE module only, because HMPA was not working for me, but now I am back on HMPA, so that particular template, if necessary, is no longer required.

I didn't notice any issues with Sandboxie / Firefox while I was using MB3 AE module only though, but I didn't check Process Explorer.

Would you care to elaborate (for this relative dumbo) how to check that? Look for a .dll under Firefox browser? In case I decide to test.

 

To know if it is working properly, you should see mbae64.dll or mbae.dll being injected into Firefox.exe.
If not, a template has to be used and especially these two lines of the template in #61 are forcing the injection:

Code:

InjectDll64=C:\Program Files\Malwarebytes\Anti-Malware\mbae64.dll
InjectDll=C:\Program Files\Malwarebytes\Anti-Malware\mbae.dll

 

Thanks @mood

Will get to testing this on my secondary machine soon. I will need to reinstall SBIE to test. (I have ReHIPS on there but currently disabled).

Edit: If I am not mistaken, your signature is shrinking ...

 

I have not yet installed all of my "usual security apps" on my new system. But the signature will grow soon (ERP,...)

 

This might help Sandboxie users using UBO. I discovered earlier today that UBO is now saving data to file "storage.js" instead of "ublock0.sqlite". So, if you like to save UBO data out of the sandbox, you need to change your settings in Sandbox settings and allow Direct file access to this file. The file is located in your Firefox Profile folder:

Profiles\abcd.default\browser-extension-data\uBlock0@raymondhill.net\storage.js

Bo

 

Well spotted . Probably due to FF 57 changes. There may be more / others.

Edit: And delete the "ublock0.sqlite" entry?

 

Yes.

Bo

 

Hi Paul, I know a lot of people had issues installing UBO 1.13.10, I didnt but I noticed tell tale signs while visiting websites I visit everyday that something was not right with that version of the addon. So, today when I saw update to UBO 1.14 being available, I updated. This version is bad, it doesnt retain updates to Filter lists (sandboxed or unsandboxed). So, if you update filters, when you close Firefox, the update is gone.

I uninstalled UBO and went back to Adblock plus. A couple of months ago I had switched to UBO after using ABP straight for 7 years when I experienced a freezing issue that turned out to be a bug, thats fixed now.

For anyone using ABP, ABP used to save data in file patterns.ini but now saves its data in the file below:

Profiles\abcd.default\browser-extension-data\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\storage.js

This is the file we need to allow Direct file access if we want to save ABP data out of the sandbox. I dont allow access to this type of files in my everyday Firefox sandbox, but I allow access to this kind of file in two sandboxes. The purpose for one of this sandboxes is so I can make changes in Firefox Options, about:config, NoScript, ABP and Classic theme restorer in the sandboxed environment, and make the changes stick. This allows me to run Firefox sandboxed every time I run it, except when updating the browser or the addons.

Bo

 

Yip.

Edit: I haven't tested this, below.

 

FWIW ~ Release Notes Ccleaner v5.34.6207 (12 Sep 2017) Browser Cleaning - Firefox: Internet History cleaning rule no longer removes Favicon content.

 

Hi bjm. Another FWIW. As of yet, I haven't experienced the favicon issue. Like I said to you a few days back, I think the way I set Firefox history to be deleted by Firefox is the reason why CCleaner doesn't delete favicons when I run CCleaner. The reason being that CCleaner never detects any history as my browser leaves none when I close the browser. I dont update CCleaner every time a new version comes out so I ll keep using the old one but is good to know that the issue is supposed to be fixed.

Bo

 

Yeah, since I've added Direct Access to favicon.sqlite. I'm good. IDK whether my favicon observe #3988 was a one off or related to my Fx setup or related to CCleaner favicon fix.
I update CCleaner every time.

 

Maybe not: https://www.wilderssecurity.com/threads/ccleaner-v5.370654/page-23#post-2705845

 

Sandboxie beta 5.21.4 is out.

https://forums.sandboxie.com/phpBB3/viewtopic.php?f=62&t=24741#p129389

Bo

 

5.21.4