Sandboxie and DefenseWall

[Bellzemos]

Is anyone using Sandboxie or DefenseWall with Avast anti-virus? Any comments, pros, cons etc. are welcome.

[majoMo]

Using Avast + Sandboxie here. I don't use any other security applications anymore. For some actions I use Returnil also.

Since Sandboxie allows a bigger protection when online with my browser Maxthon, I disable Web Shield in Avast - that gives me a better speed when online.

[Bellzemos]

I'm using Firefox for internet surfing. All other security software I use is in my signature. I've been thinking for a long time about Sandboxie and DefenseWall, but can't decide to start using them. Have you had any bad experience with Sandboxie? Which programs do you run Sandboxed? Is it resource hungry? Can malware "escape" from Sandboxie's space into the system? Thank you!

[majoMo]

- Have you had any bad experience with Sandboxie?
No. I'm very happy with it.
- Which programs do you run Sandboxed?
My browser ever. Suspicious files and downloaded files; some app. (installers) to try them (I use Returnil also to do that).
- Is it resource hungry?
No indeed.
- Can malware "escape" from Sandboxie's space into the system?
In fact and in general no.

[Bellzemos]

Wow, I'm very pleased with your answers, it seems that Sandboxie is a great security application. Thank you!

[micky77]

Wow, I'm very pleased with your answers, it seems that Sandboxie is a great security application. Thank you!

I answered this question for you last year. SB at default is very easy, just create icons for programs ( eg browsers, email, ) or right click on a program and choose run sandboxed. You can have several boxes,set your main one to auto delete. Run new programs sandboxed before recovering them onto your real system.

With the paid version you can force applications to run SB'ed, they have no choice.
I have mine set so that only certain programs can run in the box,and only certain programs can access the net. I  even force D and E drive ( for flash drives/ cd's ) I am notified when  a program not allowed to do these things is trying to.
Also Avast and any other real time protection can see in the box and alert you.
If you need to scan the box, go to C\sandbox and scan it that way

Heres some videos, for SB and DW. In my opinion SB is much easier to use,

http://www.youtube.com/watch?v=GueXMq-Vyi8&feature=channel

http://www.youtube.com/watch?v=Kspwf0yPV0A&feature=channel

[Sesame]

Heres some videos, for SB and DW. In my opinion SB is much easier to use,

http://www.youtube.com/watch?v=GueXMq-Vyi8&feature=channel

http://www.youtube.com/watch?v=Kspwf0yPV0A&feature=channel

Thanks for the links.  I cannot but notice both videos are by Mrizo.  Also, the OP is right at that he is comparing Sandboxie and Defense Wall, despite the latter calling itself HIPS.  Defense Wall seems to prevent intrusions by sandboxing untrusted applications.

Also, I understand why Mrizo doesn't seem to appreciate conventional AV applications.  His view is indeed biased but, he is practical.  He knows how the majority of the users don't know about how the computer works.  In fact, including myself, I feel quite many people began to be eager to find good sandbox applications.  They became much handier in these days and the concept is simple.  Once users turn them on, they can forget about routine tasks such as scanning/updating databases and they tend to be right on resources.  The users even don't need to know if the sandboxed part is infected or not since the part can be flushed like a toilet at their will.

More learned users may be able to avoid threats by dealing with various applications and their resources (both their time and systems).  Some users are eager to submit malware and their efforts shouldn't be taken rightly and, probably, they are contributing to strengthen one of the layers of protections.  However, practically speaking, considering the cost-effect balance, there is no wonder end users began to appreciate good sandbox applications.

[Bellzemos]

I personally would never use a sandbox application if I had an anti-virus whose definitions would be able to catch ALL malware that could I get from the internet. That is not possbile of coures, so I'm thinking about a sandbox program, but want to know it it's really effective, invulnerable, easy to use and light on resources. Thank you all for your comments and suggestions. I also want to ask if Sandboxie can be used only on demand and when I want (eg. only for surfing the internet via Firefox or IE) and not start with Windows, because I need my system resources for other demanding programs I work with. Again, thank you.

[Sesame]

I personally would never use a sandbox application if I had an anti-virus whose definitions would be able to catch ALL malware that could I get from the internet. That is not possbile of coures, so I'm thinking about a sandbox program, but want to know it it's really effective, invulnerable, easy to use and light on resources.

Of course, they are just another layer of application but quite many people find these ease of use sandbox applications effective.

I also want to ask if Sandboxie can be used only on demand and when I want (eg. only for surfing the internet via Firefox or IE) and not start with Windows, because I need my system resources for other demanding programs I work with. Again, thank you.

Have you watched the video micky77?  In any case, it is not necessarily started at the startup of Windows.  Also, considering your purpose, I think Sandboxie is one of the best options for you.

[micky77]

I also want to ask if Sandboxie can be used only on demand and when I want (eg. only for surfing the internet via Firefox or IE) and not start with Windows

If you don't want SB to start with windows, open the SB window by double clicking on the tray icon,click configure,then windows shell intergration , then untick the box ( see diagram )

[Alan Baxter]

I'm thinking about a sandbox program, but want to know it it's really effective, invulnerable, easy to use and light on resources.

From http://www.sandboxie.com/index.php?PrivacyConcerns
(Bolding is mine.)

The guiding principle of Sandboxie is to isolate and contain any actions taken by programs that Sandboxie supervises, for the purpose of keeping your computer and operating system in a clean and healthy state.

It's not invulnerable as far as privacy is concerned.  In Sandboxie's default configuration, a keylogger or otherwise malicious program can access any readable data on your system and phone it home over the Internet.  A software firewall and Sandboxie's non-default settings can help prevent that.

Edit: http://www.sandboxie.com/index.php?FrequentlyAskedQuestions#KeyLoggers

[Sesame]

I guess micky77 is more concrete.    However, Bellzemos, you can find answers to these basic questions in their FAQ, including this one  :How to configure Sandboxie for only an occasional use?.

Alan Baxter, too, got the source from their site.  They have got quite a lot of information and even forums, so, I recommend Bellzemos visiting their site for more detailed information.

[Bellzemos]

Have you watched the video micky77?  In any case, it is not necessarily started at the startup of Windows.  Also, considering your purpose, I think Sandboxie is one of the best options for you.

Yes, I watched the video, but when the reviewer installs Sandboxie the program needs to disable all protection and reboot the PC which tells me that it integrates (installs into) Windows OS. That's why I'm concerned about sys. resources. Is it difficoult to uninstall Sandboxie then? And why I'm asking this here? Because this is one of the most helpful forums on whole internet, and you guys will tell me the truth.  

Thank you all for help!

[Alan Baxter]

Sandboxie is light on resources, even in its default configuration which installs a Windows service, SbieSvc.exe, and a startup program, SbieCtrl.exe.

BTW, Sandboxie does not ask you to "disable all protection" while installing.  That's unnecessary.

Edit: On my XP box,
SbieSvc.exe is using 2440 K of memory.
SbieCtrl is using 6224 K.

[BRANDONN2008]

Is it true Sandboxie has 64 bit now? I was reading online but can't find a definite answer. I would probably wait for GesWall 3.0 but I'm getting impatient.