+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: The Lounge (https://sinister.ly/Forum-The-Lounge)
+--- Thread: How do you download and run programs (/Thread-How-do-you-download-and-run-programs)
How do you download and run programs - prevent - 03-02-2019
I know I'm not the only anti-virus freak, but what do you guys do? VMware? Sandbox? I never download files, but being apart of forums people like to share files and would like to know how you guys protect yourself.
RE: How do you download and run programs - NullData - 03-02-2019
I do a scan with the following
virustotal
spyralscanner
Malwarebytes
Bitdefender
then if its not "User friendly" i will run in via sandbox
RE: How do you download and run programs - prevent - 03-02-2019
I can't understand sandboxie I haven't looked much into it I'd rather much just use an RDP tbh
RE: How do you download and run programs - NullData - 03-02-2019
sandbox is as simple as a Right Click / Run Sandboxed
RE: How do you download and run programs - prevent - 03-02-2019
is it completely protected tho? And can I run files that require installation?
RE: How do you download and run programs - NullData - 03-02-2019
What is Sandboxie and how is it different than other solutions?
Think of your PC as a piece of paper. Every program you run writes on the paper. When you run your browser, it writes on the paper about every site you visited. And any malware you come across will usually try to write itself into the paper.
Traditional privacy and anti-malware software try to locate and erase any writings they think you wouldn't want on the paper. Most of the times they get it right. But first the makers of these solutions must teach the solution what to look for on the paper, and also how to erase it safely.
On the other hand, the Sandboxie sandbox works like a transparency layer placed over the paper. Programs write on the transparency layer and to them it looks like the real paper. When you delete the sandbox, it's like removing the transparency layer, the unchanged, real paper is revealed.
![[Image: PaperAnimation.gif]](https://www.sandboxie.com/images/PaperAnimation.gif)
How safe would I be, by using Sandboxie?
You would be quite safe using Sandboxie. It should be noted that, from time to time, people are able to find some vulnerability in Sandboxie, an open hole through which malicious software can still infiltrate the system.
This is extremely rare and is quickly resolved by closing the hole that is the attack vector.
Thus it's a good idea to have more traditional anti-malware software.
yes you can install in a sandbox
RE: How do you download and run programs - mothered - 03-02-2019
I have VMs running as a Guest OS on a couple of "dedicated (Host) systems" segregated from the network, for the purpose of downloading and executing files.
There are no account logins, nor any sensitive activity performed- solely for testing purposes. If deemed safe, the files are transferred (using dedicated clean USB sticks) to It's respective PC. VMs are not fail-safe so If malicious content escapes the virtual environment, no big deal, there's no critical data on the physical machines. A clean Installation of Windows and an hour later, I'm up and running.
Also, backups are kept of all VHDs (In their original state) so If they're Infected, It only takes a couple of minutes to mount the VHD on the VM. Snapshots have failed me at the best of times, so I no longer waste my time with that.
RE: How do you download and run programs - titchyyyy - 03-02-2019
I don't download anything basically.
RE: How do you download and run programs - simbitos - 03-04-2019
RDP Windows or VmWare, never run them on your original of environment
RE: How do you download and run programs - reGEN - 03-05-2019
(03-02-2019, 07:59 AM)prevent Wrote: I can't understand sandboxie I haven't looked much into it I'd rather much just use an RDP tbh
Basically, Sandboxie creates its own directory structure and "emulates" them such that they look legit to the running application. Basically, imagine it as a proxy, but for the operating system. If the application writes to disk, Sandboxie will intercept the file path and modify it, e.g. if it writes to C:\Users\%username%\Desktop, it will be written to C:\Some\Sandboxie\Base\Directory\Users\%username%\Desktop (this is an example path, not the actual path). When the application requests the same file, it will do the reverse (read from the Sandboxie directory) to make the application think it's the same. This is the same with registry keys and perhaps services too. I'm not entirely sure how it handles inter-process communication. So, any file or registry keys/values written will actually touch your OS until you decide to delete them.
To achieve this, they employ a kernel-mode driver to ensure that they capture all file/registry/etc. activity, so it may be impossible for the user application to trick Sandboxie into doing something unintended unless there is some exploit such as a sandbox escape. However, Sandboxie also uses a user-mode DLL injected into the application's memory space (probably to capture more API since drivers cannot and may not see all API calls unless they hack up the OS' SSDT which is protected by KPP/Patchguard on 64-bit Windows). Because of this, applications may detect the presence of Sandboxie and modify their behavior as opposed to when executed normally.