[Auto-Sandbox] Ability to Whitelist Programs Opened by Another Program(Steam)

[sniperfodder]

So, I love avast, except for the part where it decides a good chunk of my steam games are suspicious and sandboxes them. Sure, I can go through and whitelist them all, Or, you can give me an option to whitelist the executable that launches those games (Steam) so that avast doesn't ask each time. Otherwise, I'm going to go completely bonkers each time I reformat my PC and have to re-whitelist everything.... again...

Sure, I reformat once in a great while, but that doesn't mean I want to keep whitelisting games I constantly add to my steam library...

[swrain]

I don't think that's possible, though I may be wrong.

Try going to your File-System Shield settings > AutoSandbox and add "C:\Program Files (x86)\Steam\Steam.exe" to the exceptions. (64-bit and Steam Express install only)

If that isn't where you installed Steam, browse for your copy and then add it.

If that doesn't work, then I don't think you can do that. You're just going to have to add each game individually.

[Cast]

What i do is add the folder C:\Program Files\Steam\steamapps\common\* in the file system shield because i dont want avast scanning the game files while playing them to increase performance of the game, and because the file system shield is the shield that controls how the autosandbox works, though it might also work if you add the same exception to just the auto sandbox exclusions if you dont want to lose more protection. It works well and I've never had avast! alert me about autosandboxing the games i play.

[swrain]

What i do is add the folder C:\Program Files\Steam\steamapps\common\* in the file system shield because i dont want avast scanning the game files while playing them to increase performance of the game, and because the file system shield is the shield that controls how the autosandbox works, though it might also work if you add the same exception to just the auto sandbox exclusions if you dont want to lose more protection. It works well and I've never had avast! alert me about autosandboxing the games i play.

Wow, I didn't think about that.

Thanks!

[sniperfodder]

I don't think that's possible, though I may be wrong.

Try going to your File-System Shield settings > AutoSandbox and add "C:\Program Files (x86)\Steam\Steam.exe" to the exceptions. (64-bit and Steam Express install only)

If that isn't where you installed Steam, browse for your copy and then add it.

If that doesn't work, then I don't think you can do that. You're just going to have to add each game individually.

I'll try that when I get home.

 

What i do is add the folder C:\Program Files\Steam\steamapps\common\* in the file system shield because i dont want avast scanning the game files while playing them to increase performance of the game, and because the file system shield is the shield that controls how the autosandbox works, though it might also work if you add the same exception to just the auto sandbox exclusions if you dont want to lose more protection. It works well and I've never had avast! alert me about autosandboxing the game
s i play.

I'm loath to do that. I could try it, sure, but I only want to whitelist the games launched by steam, because some maleware could decide to install itself in that folder. Unlikely ? Sure. Possinle? Most definantly.

[swrain]

I don't think that's possible, though I may be wrong.

Try going to your File-System Shield settings > AutoSandbox and add "C:\Program Files (x86)\Steam\Steam.exe" to the exceptions. (64-bit and Steam Express install only)

If that isn't where you installed Steam, browse for your copy and then add it.

If that doesn't work, then I don't think you can do that. You're just going to have to add each game individually.

I'll try that when I get home.

 

What i do is add the folder C:\Program Files\Steam\steamapps\common\* in the file system shield because i dont want avast scanning the game files while playing them to increase performance of the game, and because the file system shield is the shield that controls how the autosandbox works, though it might also work if you add the same exception to just the auto sandbox exclusions if you dont want to lose more protection. It works well and I've never had avast! alert me about autosandboxing the game
s i play.

I'm loath to do that. I could try it, sure, but I only want to whitelist the games launched by steam, because some maleware could decide to install itself in that folder. Unlikely ? Sure. Possinle? Most definantly.

I'm not sure, but if you add that to the exceptions in the File-System Shield, that means it will ignore it only when you open it. I think it still detects it in the scan.

Then again, I'm not an avast! expert

[DavidR]

The autosandbox process is controlled in the first instance by the file system shield (FSS), the suspect.exe file is scanned before it is allowed to run. If it were infected, it could/should be detected by the FSS, so one reasonable thing in its favour is it hasn't had a definitive detection.

So I rather doubt it would be picked up in the regular on-demand scan as the autosandbox isn't saying it is infected or the FSS would alert rather than it hand it off to the autosandbox.

@ sniperfodder:
Avast can't do what you ask as that wuld be excluding a programs actions, all files that it loads; as you have already mentioned why it isn't advisable to exclude the whole steam folder and this is kind of the same.

~~~~
What you could do is record the reason given in the autosandbox window why it was blocked, probably 'file prevalence/reputation is low.' If that is the case for most of these notifications, you might consider unchecking that option, this does obviously carry a risk as it would apply to other files.

####
You could also change the default option of the autosandbox mode from Auto, to Ask. This gives you greater interactive control and you are able to make decisions on the fly (as you say), as soon as an application triggers the autosandbox, you can make a decision to Open Normally and select 'Remember my answer for this program' and that is it done.

[sniperfodder]

I've tested adding Steam.exe to the auto-sandbox whitelist, and it does not affect whether or not avast sandboxes a program launched by steam.

@ DavidR:

I honestly don't see what the problem with adding that feature. You can already whitelist entire folders from the FSS using the Exception List. This is just a little more secure. We're doing a check instead of an ignore. We are saying, "Okay, was this program launched by a white listed program? Yes? Run it without sandbox. | No? Sandbox it.". Where as let's say I add an exception to the FSS instead, there is no checking. It's just ignoring anything in that folder/sub-folders.

And I'm not saying that if I whitelist steam.exe, that there is infinite inheritance down the line. For instance, let's say I tell steam to launch my game. My game goes to launch a secondary '.exe'. My game isn't whitelisted to launch other exe's, so avast can go ahead and check to see if it wants to sandbox it as well, or even opt to try and sandbox the first exe. I'm sure the logic behind that would be more complex than what I'm saying, but you get the idea.

On-top of that, if I'm adding an exception to Avast concerning a program to whitelist, I'm already taking the risk and responsibility if there is malicious code. I generally trust the content in my steam folders. Steam put it there (Most of the time). If avast is sandboxing a game, there is a high probability I'm just going to ignore the sandbox warning anyways unless I don't recognize the URL or game.

So, Yes while I'm lowering my security by placing trust in a program (steam.exe) and looking for convenience, I don't want total lack of security either. I'm looking for a balance between some sense of protection and not having to whitelist every game I install off of steam.

So, the moral of this entire thread? I'm lazy as hell.

[RejZoR]

Yeah, it's not very intelligent that avast! is constantly sandboxing stuff on Steam which i don't think can ever hold any malware.

[sniperfodder]

Yeah, it's not very intelligent that avast! is constantly sandboxing stuff on Steam which i don't think can ever hold any malware.

Wrong attitude to have. All it takes is some maleware to replace a valid executable and bam, your whole day is ruined. Files downloaded directly from steam are a whole different matter, but again, it doesn't prevent maleware from replacing files within a game's folder.