shadowdefender vs returnil

Discussion in 'sandboxing & virtualization' started by johnottawa12, Dec 8, 2009.

Thread Status:
Not open for further replies.
  1. demoneye

    demoneye Registered Member

    Joined:
    Dec 30, 2007
    Posts:
    1,356
    Location:
    ISRHell
    i use same method but instead SD i use CTM , so after a rollback all DW reg gone and i always got it clean :)

    cheers
     
  2. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    Thanks Tony, I'll give that a try.
     
  3. LenC

    LenC Registered Member

    Joined:
    Jul 25, 2006
    Posts:
    846
    Location:
    CT, USA
    How do StorageCraft's products - ShadowSurfer and ShadowUser - compare to Shadowdefender and Returnil? (For starters, I know StorageCraft's products are not free.)

    According to the documentation on ShadowUser, you can maintain a ShadowMode session accross reboots, which I think is a very valuable feature.
     
    Last edited: Dec 13, 2009
  4. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi LenC,
    See these older threads started by Blue:

    https://www.wilderssecurity.com/showthread.php?t=196103&highlight=BlueZannetti Light virtualization

    https://www.wilderssecurity.com/showthread.php?t=230459&highlight=BlueZannetti Light virtualization

    HTH
    Mike
     
  5. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    Since Returnil only shadows the system partition, that seems like it leaves a pretty big hole in the protection. What am I missing?
     
  6. LoneWolf

    LoneWolf Registered Member

    Joined:
    Jan 2, 2006
    Posts:
    3,625
    The same way as Tony has posted, work's nice. :D

     
  7. BlueZannetti

    BlueZannetti Registered Member

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    Not really, at least on a standard configuration.

    Automated links to execution will flow through the system partition, regardless of where the content is stored. These will be eliminated/broken on a restart from a virtualized state. In addition, if the basic antiexecute facility is enabled, execution won't occur during the virtualized session.

    That only leaves the possibility of manual execution or decidedly pathological exceptions (example - autostart entry in an unprotected location that is replaced by malware) following exit from the virtualized state. I could probably create a hypothetical vulnerability, but I really can't create a pragmatically realistic scenario in which there is one, at least one that does not depend explicitly on operator initiated execution from a user based non-system location.

    Blue
     
  8. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    Thanks Blue. I did not realize that Returnil had an anti-execute function. I was concerned about malware executing during the virtual session and corrupting my data drive.

    I'll give this a try for a few days.
     
  9. BlueZannetti

    BlueZannetti Registered Member

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    It's a little hidden under the Virus Guard feature (see screenshot).

    RVSAE.png

    Naturally, there are other approaches that can be used to accomplish similar ends (implement a standard SRP for example). Each approach has advantages.

    Blue
     
  10. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    Thanks for the screenshot, I was just looking for that option.
     
  11. raakii

    raakii Registered Member

    Joined:
    Sep 1, 2008
    Posts:
    593
    I s there any feature that is present in returnil and is not present in SD.
    I am using SD for a long time now.
     
  12. BlueZannetti

    BlueZannetti Registered Member

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    There's a few....
    • A free version is available (the File Manager is the absent)
    • The antiexecute facility mentioned above
    • Embedded F-Prot based AV (I know, good for some, a negative for others)
    • Wipe virtual session information (i.e. overwrite virtual session content)
    • Virtual disk
    • Dynamic ability to access real disk/registry during virtualized session
    Those come to mind at the moment. The main functional difference is system partition only (RVS currently) vs selectable partitions (ShadowDefender). One can make a reasonable case for either approach.

    Blue
     
  13. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    5,173
    Location:
    Milan and Seoul
    I agree Returnil is more and more moving in the direction of suites, stand alone applications, Shadow Defender is a pure virtualizer which needs to be used in conjunction with at least another application (my case I use SD + AE from Faronics which seem to complement each other perfectly).
     
  14. Huupi

    Huupi Registered Member

    Joined:
    Sep 2, 2006
    Posts:
    2,024
    I'd like to keep it simple and transparent hence SD+Sandboxie,work flawless.
     
    Last edited: Dec 20, 2009
  15. raakii

    raakii Registered Member

    Joined:
    Sep 1, 2008
    Posts:
    593
    Thanks .:-*
     
  16. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi Ed_H,
    In addition to what Blue said, we are working on integration of Multi-partition virtualization and file/folder exclusions in the RVS Labs version (see the applicable thread in our Betas forums). The feature sets are scheduled to be included in an engine upgrade for the main line products early next year (Q1).

    In addition to this, we are in the late development stages for a new multi-state restore feature that still needs work, but should be ready for public testing in a similar time frame (ref: a type of virtual session across restarts...)

    Mike
     
  17. Ed_H

    Ed_H Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    662
    Location:
    Chicago, IL
    Thanks for the reply Mike. Sounds like some great enhancements are coming soon!
     
  18. Huupi

    Huupi Registered Member

    Joined:
    Sep 2, 2006
    Posts:
    2,024
    It would be a milestone in the light virt.world.
    It sound akin to VMWare snapshot ability !!
     
  19. mike21

    mike21 Registered Member

    Joined:
    Jun 1, 2006
    Posts:
    416
    Very interesting topic. When I tried returnil there was not an AV feature, so I considered SD superior as it shadows all discs. Now after Blue's post with the picture, I see that and other drives are protected. Does this have an impact on CPU comparing with SD?
     
    Last edited: Dec 25, 2009
  20. Huupi

    Huupi Registered Member

    Joined:
    Sep 2, 2006
    Posts:
    2,024
    I guess any additional module will add to the total amount of cpu cycles and memory space used by the application,so it becomes more heavy on resources.
    I hope that on the other end SD will stay the way it is now,not bloated and tranparant and very light on resources.
     
  21. daray

    daray Registered Member

    Joined:
    Dec 21, 2009
    Posts:
    15
    I currently have licenses to both Shadow Defender and RVS 2010 (Home Lux with that free giveaway).

    For what I use it for, Shadow Defender wins hands down. It is lighter, simpler, faster, more stable and does exactly what it should do (without trying to do other stuff like AV/AS).

    The key "feature" that made the decision for me (even though I had the free license of RVS at the time), was the ability in Shadow Defender to exclude a list of files and folders (which RVS didnt have at the time, and afaik still does not). This was particularly useful since I tend to run in shadow mode the majority of the time (only exiting shadow mode to run any updates). Slightly less important was the ability to also protect other drives (I have a dual boot system with XP).
     
  22. mike21

    mike21 Registered Member

    Joined:
    Jun 1, 2006
    Posts:
    416
    ^^ You are right. I love the right-click feature.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.