sandbox not working right or am i missing something??

[zfactor]

just installed avast is5 and ave been testing it out. fresh machine  from a fresh win7 restore.....no other previous av's installed not even any programs installed yet. i tried a few things in the sandbox 3 to be exact. first was a rouge. selected run sandboxed and i saw the red box around it when it went to run. so i ran it but it ACTUALLY INSTALLED. running procc and all?? even after reboot it was still running and i had to remove the rouge from windows. so it did nothing for me.

second was a freddy variant that i also selected to run sandboxed. ran right through and installed itself in the windows folder and again the procc was running. (avast also missed this where as nis2010 which i installed after removing avast just to see what it would find picked it right up and removed it upon reboot and removed it where avast said the machine was clean and even a boot time went right past it..also the 2 rouges that went untouched by avast were also removed by nis2010 immediately after a reboot no more procc and no more files or rouges they were gone)

third was another rouge again went untouched by avast and yet again selevted to run sandboxed and it also installed.

am i doing something wrong here? id love to honestly figure this out to see im wrong because i actually have always recc avast as my free av to my customers over any others. and i personally really want to like the new is5.

also (and yes i will be submitting them to avast) from my sample sets i have avast missed just over 340 of them out of over 6000. of those after the install of nis2010 it then found over 170 of them and removed those from the scanned folder??

honestly i have been using nis2010 since i get it at a great discount but i would actually buy avast as a long old time user if i can figure this out. any ideas would be great.

thank you

[zone12]

I don't belive it stops installations, although I'm not sure what freddy is. I think the sandbox is ment to enclose viruses such as adware and trojans.

[waking]

I don't belive it stops installations, although I'm not sure what freddy is. I think the sandbox is ment to enclose viruses such as adware and trojans.

Well, it clearly does a little more. Example:

I start IE 6 virtualized. Browse to a page then try these operations:

(1) Use File/Save As to save a copy of the page I'm browsing.

(2) Put the mouse cursor over a link and select Save Target As from
the right-click menu.

For both operations the save appears to be successful.
If I try to repeat the same operations, when the directory
dialog opens to select where to save, in the list of files
already there I can see the file(s) I just saved. Fine.

Now go to another app such as Total Commander or Windows Explorer
and look for the saved file(s). Not there. Nowhere to be found.
File search can't find them. They were only "virtually" saved,
not actually.

[zfactor]

see thats what i thought. my point is the exe's actually installed and were running nis2010 had to clean them because avast missed them. so the sandbox actually let them run and they were put into the running procc's

[lister]

A sandbox should let programs be installed... but ONLY in the sandbox.

Once the sandbox is removed, all the processes started in the sandbox (inc processes started by those processes) plus any files (and registry entries, histories etc.) created should be gone. Otherwise it's not a sandbox.

Are you saying this is not the case?

[zfactor]

correct the things remained AFTERWARDS. thats is my point. it was not held inside the sandbox.

[ace11]

Its very sad situation that after a major program release , the developers (or other official support team) are not super-involved
in the forum questions-problem notes-[early product] confusion ....

[MichaelDay]

I run the free version, so no Avast sandbox. But, I run Sandboxie instead. As other posters have pointed out, programs are allowed to install in the Sandbox. It is only when the Sandbox is deleted that the installed programs disappear. If you did not delete the Sandbox, the installed programs including the virus will remain. That does not mean the virus escaped the sandbox, it only means the sandbox (and therefore the installed programs in it) have not been deleted.