Returnil

I have been testing Returnil on a spare computer. Seems to work very well - exactly as promised. Before I load it on my primary machine, does anyone have any comments or warnings about it?

There are a lot of experts on this Board who talk about things I don't fully understand (changing MBR etc.) I just want to be sure I am not doing something to my computer or operating system (XP SP3) that I should be concerned about.

Also, I am still reading about features of the premium (paid) version. Any comments about value of the additional premium features?

Thanks,
Len

 

Hello Len.
If you are using Windows Vista, diasable the hibernation feature on your computer as the current release version will cause recovery from hibernation to fail. We are testing a new 2.01 Beta version that addresses this issue right now and it is proving to be valid and stable.

Mike

 

Okay Folks - I promise I will not bump this again, but I was surprised to not hear back from any Returnil users concerning my questions as a potential long term user.

I did note Coldmoon's response concerning the hibernation problem. Are all other users totally pleased with it? I hope so!

 

Hi, Len, I am NOT a Returnil user and never have been but I can tell you as a long time reader at Wilders that Returnil seems to be one of the better and more reliable "virtual" programs. Just use the "Search" feature here at Wilders and you will see a gazillion threads that mention Returnil and you can read for yourself how many folks here like it ... might even have to try it out myself someday.

Acadia

 

Should have thought of that (searching prior posts). Thanks - will do.

 

Len, personally (on XP Pro), i yet to experience any real issues except those of my own doing like trying to access Returnil from an alternate partition whereby it tells me i might need to reinstall again. And so, i can even reinstall from that secondary partition (and access my Virtual Drive Image) from the other partition, but that's really not neccessary in reality. Just my own little experimentations with it.

Frankly RETURNIL is been one of the most reliably consistent virtual apps i ever dealt with eclipsing in many ways my long time fav PowerShadow!

I use it On-Demand Only and it delivers! each and everytime without problem or nusance, and that's super good programming if you ask me.

EASTER

 

Returnil is one of the first programs I install on my xp computer (never tried it on vista). I use it as my antispyware software. I would be very hesitant to surf the internet without "returnil" running in the background.

It's proven very reliable on every computer I installed it in, never crashes, never interferes with other programs, doesn't slow down my computer. I bootup my computer, download the latest virus definitions, then engage returnil.

Since I've been using "returnil" nothing virus/spyware has caused permanent damage to my computer. My computer security is very simple.
1.basic zonealarm firewall
2.avg free antivirus
3.firefox browser
4.returnil
That's it, nothing has ever defeated my defenses.

I tried "powershadow" (paid version) crash my computer several times, I tried the demo of "deepfreeze" that also crash my computer giving me a BSOD. I always recommend returnil to everyone, it's a rock-solid protection.

 

Keep'n it simple, smart user

 

I have used it for the last 8 months or so on my XP laptop. No issues at all. I love knowing when I reboot that all is well again. It reminds me of the "magic slates" I played with as a kid.

 

I've also been using Returnil for a good while with no problems. It's always been there for me when I needed it. I use it as an on demand tool for trying programs, surfing the 'dark side' of the internet and recently for finding and submitting malware.

It's much easier to use that most people think. If your using the virtual partition, think of it as a file that you can turn on and off (mount and dismount) anytime you want. You can move files to an from it like any other file. You can also experiment with Returnil by creating small non-important notepad files and move them around and reboot etc. It's what I did until I was comfortable with my understanding of Returnil.

 

Returnil is good ,but the software itself is not complete , neither is powershadow.If u want more options like exclusion list , i would suggest shadow defender.

I left returnil becos it does not have option of protecting non-system drive.

 

Thank you everyone - very helpful and encouraging feedback. I always try to be cautious with new software and test it before committing to it; but nothing beats getting input from many independent users.

 

I am also a long time user of Returnil, on XP machines, had a minor prob when I first started using it (early version), but that was sorted by next release since then I have never had an issue. Great program, easy to use. My only disappointment now is that when I move to Vista 64 Returnil can't come too

 

I personally would not be without Returnil...it performs wonderfully. The only minor gripe I have against it is that after a year your license/subscription expires, even on the free version. Then you have to uninstall and reinstall it to get another year of use, or update to a new version if one is available.

 

It has been really trouble free here. I have used the free version for a few months.
The paid version allows you to save
anything you download or create during a session to your "real" hard drive.
With the free version it is not possible other than by burning it to CD,or
maybe using Internet mail to email yourself an attachment of a WordPad document,or something like that.
I am Sure you know,but here is a Wilders thread offering a free one year Returnil paid version lic.
https://www.wilderssecurity.com/showthread.php?t=228677&highlight=returnil

That is one i snapped up instantly.

 

Hello raakii,
We have a new feature in 2.01 called File Protection that protects selective, non-system files, folders, partitions, and even entire drives. This is not done through exclusions however as that method is inherently riskier than the method we chose and has been used by malware in the past to circumvent ISR technologies. The reason for this is that the concept involves excluding something from being protected and as a result is available to both user and malware (potentially).

RVS File Protection is purposely designed to be simple and straight-forward by denying access to these resources until/unless the authorized user decides that they should be accessed by removing them from the protected list...

For the resources you do not protect in this way, there is no need to deal with that content or interfere with the user's ability to access and edit that material. Even if malicious content were to install itself in these areas it is still rendered impotent by the fact that the changes it needs to make to the System Partition (Usually the C:\ drive) to be active are lost at restart of your computer when RVS's protection is on.

We also see ISR as an integral part of a simple, but effective layered strategy. You should always remember that ISR (RVS or others) can only do three things by itself (currently):

1) Drop all changes to clonned resources
2) Save some changes to clonned resources
3) Save all changes to clonned resources

there is no decision making other than that of the user to determine which of these choices are made. While ISR by itself can be used effectively as a stand-alone approach, it is a method best used by an advanced user who knows exactly what is happening on their computer and has the experience to know what might be unwise, unwanted, or malicious. This has been the "sticking" point where this technology is concerned traditionally and why ISR has not been adopted widely prior to now. Add complex configuration and set up issues to this and you can see why the industry has been slow to accept, or even consider ISR for security rather than as a type of recovery tool.

Mike

 

I bought Returnil a few days ago and also signed up for the free license. I used returnil to run both sandboxie and defensewall to see which I was going to use full time. Returnil is light on resources{even on my crappy 3 yr old laptop}
and with a reboot I go back to my previous state. My question is if I wanted to keep the changes I made, what would I have to do? I'm a newbie to Returnil, much appreciation to the developers.

 

Thanks for the detailed explanation Mike .I am going to use Lite Virtualization extensively only after the update comodo diskshield or shadowuser.I am using it now only on demand.


@apathy, i think there is option saving the whole session in personal . In premium edition , u will surely have.

 

Hi Firebytes,
The registration period in the Personal version was adjusted in the 2.0.0 series to last 24 months rather than 12 months. The only reason for this is to ensure that the user has the most recent version with all current fixes/upgrades.

Edit: Firebytes is correct in post #21 and the registration period is still 12 months. The following is still valid:

For those who want to keep the option of not upgrading at that time, simply keep a copy of the installation file in your archives and then simply uninstall and then reinstall the same version to reset the registration period.

Another feature of the installer/uninstaller is that they are the same which means in a pinch, you can save a copy of the uninstall.exe and rename it to setup.exe and it should work as a "new" installer...

Note: Remember to uninstall before attempting to install again.

Mike

 

Hi apathy

In the Personal Edition you have two choices:

1) Save this content on a non-system drive (Ex: Data drive D:\, optical drive, USB stick/backup drive, firewire drive, etc)
2) Save this content within the Virtual Partition if you do not have access to #1

In the Premium Edition you have more choices:

1) Same as #'s one and Two above
2) Right click and select "commit selected to the Real System"
3) Drag & Drop the file onto the Returnil Tool bar
4) Add selected files and folders to your File Manager list, select the items to be saved by checking the box to the left of the line item, and then click the "Update Selected" link at the bottom of the list window
5) Use the Real System Explorer tool to move files between the Virtual and Real System and visa-versa

Mike

 

I installed Returnil Personal Edition version 2.0.0.5011 on this system in April of 2008 and it now shows "Subscription Status" as 4/4/2009. I assume that means it will expire and need to be reinstalled at that time which would be one year. Am I wrong?

 

Let me check and get back to you on this, but it is supposed to be 2 years.

Mike

 

Hi,
I've been using the trial version of Returnil for around a month. I still aren't exactly sure of the minor details of what is going on as far as System changes.
A couple of things I note:
I run Kaspersky Internet Security and I feel that if it updates its Data base while I have Returnil "running", once I reboot I think the updates are gone. Kaspersky doesn't seem to like this and gets confused so I update before enabling Returnil, and change to Manual update for KIS.

I have a C:\ Drive which is the System Drive, i.e. WinXP SP3 is installed there, plus all my Programs.
I also have a E:\ Drive (not a partition but a 4 GB HDD , for my Virtual Memory PageSwap File=1024 MB's), and an F:\ Drive(6 GB's), for all my Multimedia.

The C:\ Drive is 40 GB, has the Returnil 4GB Partition on it, and around 14 GB's free space . I have 512MB of RAM so I suppose that's why Returnil created a Partition, instead of using RAM ?
So I feel I have to be on the ball really, or I'm actually gonna make work for myself, therefore I make sure everything I want to do to the System I do before going "Virtual". Is that wrong ? Am I missing something ?

If I download something I will put it in a Drive other than C:\ . To make things even more complex I have an External Drive (G:\)for Backups , and also often use a Usb Flash drive, with portable Apps.
I have tried running Firefox portable so things like added Bookmarks are not deleted after a virtual system session, as it's running from a USB flash drive. Some quirky things have gone on, as I mentioned AV updating not retained, Bookmarks and updates to browser. Is this to be expected ?
Should using a Flash Drive with a portable browser benefit, as changes to that browser can be retained and transferred to my "System" browser ?

Scenario: Say I check my Email, while Returnil is Enabled, will the Email be gone when I reboot ?

When browsing, do all my cache, cookies, offline content, Temp files disappear ? If so do I need to run a AntiVirus progran at all with Returnil "ON", if all changes, and maybe even Malware are deleted after rebooting ?

Sorry for the Rant, ( I wont even touch on the Virtual partition, and what it is, there's always tomorrow ) and asking so many questions, I've been chasing this Forum since CC's went down and love the idea, but a newby.
I'd rather get advice from other Users rather than pre-suppose from reading a Help manual, which doesn't seem to address these issues. Any feedback on any issue I mentioned much appreciated,
Cheers

 

I am by no means an expert and have actually been using the program for a shorter time than you have but I think most of your concerns can be addressed by upgrading to the paid version (which I did after a week of using the free one). With the paid version you can save individual files or the entire state of the PC so that you don't lose things at reboot. This is handy for your situation with bookmarks and AV updates but also in case you are testing new software and decide you like the program you tested. With the free version you would have to reinstall the software and then set it up again. With the paid version you could just tell Returnil to save everything and when you reboot the program will still be there. Now I must say I have not used the program in this way but this is my understanding of how things work and is one of the reasons I have upgraded,,,,that and I feel that any company that has produced such a fine, trouble free product deserves to get paid for doing so. If everyone simply used the free version the company would some go out of business. I think that would be a real shame.

As to the AV running when the PC is virtualised I guess you are correct, its not strictly necessary but there is no reason I can see to not do so. AS a matter of fact if I am worried about the sites I am visiting I not only run the PC virtualised but I also run my browser sand-boxed. You can't be too careful as far as I am concerned. Also, if I am browsing virtualised I would just as soon not have my browsing interrupted by a virus attack so I would not turn of the AV etc even when the PC is virtualised. As to you losing AV updates I believe that any updates that are lost on reboot would be replaced the next time there is an update. This seems to be the case with my AV (Trend Micro). Perhaps a note to your AV publisher is a good idea to confirm the situation.

 

Hello Purplexity and welcome

Can you describe "...and gets confused" in greater detail?

Outside of your reply to this question you should not have to worry about your definition (signature or database) updates while RVS protection is on as the AV will update as expected. What you may see however is that the AV database reverts to the version installed at the time you turned protection/session lock on when you restart your computer. During the time you were virtualized, the database will be current (assuming automatic updating is activated).

If you want to use RVS with protection on at all times, you may want to explore something like a "maintenance day" where you turn the protection off to install Microsoft updates, set a base version for your AV signatures, install new programs you are confident of, and/or adjust program/OS configurations.

No, the reason there is a disk cache is because you selected the disk cache method rather than the memory caching method when you installed the software. 512MB of RAM is sufficient if we are discussing Win XP. For Vista this is obviously insufficient...

No you are not missing anything, but you may be stressing over the wrong things. Returnil is there to help ensure that your system remains clean and enforce that state by reverting your computer to the time when you turned protection on when you restart the computer. It allows you to do anything you would do without RVS installed except allowing those changes to remain (default setting).

If you want to make "permanent" changes (those changes that will remain following a restart), you should turn RVS protection off while the changes are made. This also includes disk defragmentation and integrity checking (EX: Check Disk).

Yes, this is to be expected as those changes are usually saved within specific profiles placed on the system partition by default. You can:

1) Alter the default save location for your user profiles on an alternate drive or partition

2) Export a copy of your session bookmarks (a copy of your bookmarks as they are at that moment rather than at the time you turned RVS protection on) and then import the copy you want to use on a more permanent basis on your "maintenance day"

It depends on your needs. If you are constantly moving between computers (Ex: you have a test lab or a home network with common settings) then having an exported copy of your current working list of bookmarks is of great benefit...

A) POP3 mail: Yes
B) IMAP mail: No

If you are using POP, you should familiarize yourself with where the program saves your mails and then adjust the program's default save location(s) to those that are more convenient for you.

This is determined by your strategy and experience. But like the old addage "If you need to ask how much something costs, you can't afford it", if you ask whether or not to use an antivirus, chances are you do not have the experience required to run "naked" and as a result should include AV in your security strategy.

What strategy you use however does not need to be complicated or über paranoid. For the most part you should first determine what risks you are likely to encounter and then develop the most simple line-up that addresses these risks with little overlap between your layers. A basic approach:

1) Prevention: Software firewall (Windows FW will suffice for most) for control of communications within your home/business network and a hardware firewall on your connection between your internal network and the outside world (Router with firewall for example). This can be refined to include a content filter and/or parental controls if they are needed or wanted.

Most modern browsers either contain the latter functionality or allow it through browser plugins/add-ins so you may not need to install specialized programs for these functions...

2) Detection: This is where your AV or HIPS solution comes into play. While no scanner will ever be able to detect 100% of all malware or unwanted content, having some form of feedback on the efficacy of your strategy is important.

3) Removal and long term cure: Time to removal of malicious content and long term assurance of a clean working state are critical and this is where Returnil comes into play. While your AV may not detect something and even more commonly, not remove what is detected properly, you are reasonably assured that with RVS protection on, a simple reboot will remove any harmful or unwanted changes to the system partition even if there is no overt detection of something wrong or bad.

No problem, the Virtual Partition is nothing more than a very large file with special properties that forces Windows to see it as another partition on your hard drive. It is a convenience for those who only have a single partition on their computers (Ex: purchased a new Dell desktop and it comes with a single hard drive with one partition = C:\ ).

As you have described a more advanced configuration where you have a data partition and frequently make use of USB stick and drive backups, you do not need to use it.

Also be aware that the protection and VP features are independent, meaning that you do not need one for the other to work properly.

Mike