Icon Alert On New App

[MitchE323]

I am thinking of a feature request - basically the SandboxIE tray icon flashes everytime a new application starts in your current sandbox. Or really in any sandbox. So let’s say you are in Internet Explorer and you go on a site that needs WMP - so you click the video and you see the icon flash which you completely expect to happen. That may not be possible as WMP is a child-process in that case. But if that is possible then great.

But say you are just surfing along not really doing anything and you pick up a nasty and it starts and is either recording keystrokes or whatever - you see the icon flash and now you are alerted and say WTH? - open SandboxIE Control to see what it is that is running and make a decision.

I am hoping that the app would show in SandboxIE Control, and since you can access that through the tray icon - maybe it is possible to connect the dots.
mitche323

[SnDPhoenix]

Actually, that is a great idea.
But take it a step forward.

Instead of having that small icon blink, (which you might not notice), how about instead, having a tooltip bubble popup above the system tray saying something like "A new program has been sandboxed" or something like that.

Then you'll be like, "What? What could have just started sandboxed?", so then you open sandboxie control (or better yet, have sandboxie control open when you click the tooltip) and then tadaa!

[tzuk]

I also think it's very a nice idea. (Nice in an 'I-may-actually-do-it-one-day' sort of way.)

[MitchE323]

haha COOL. That reminds me of my built in excuse around the house -"It's on my list of things to start thinking about".... I have already learned the value of waiting around here.

[MitchE323]

I also realized that I neglected to state the need. It is to help us know if a keylogger/other started in one of our less hardened sandboxes.
mitche323

[tzuk]

Well, keyloggers, but viruses and malware in general. Popping up the occasional (optional) notification could give the impression that Sandboxie is actually doing something behind the scenes...

[SnDPhoenix]

Popping up the occasional (optional) notification could give the impression that Sandboxie is actually doing something behind the scenes...

How though?
You mean like when Sandboxie launches its start.exe as well as the other 2 files? Then you might recieve alerts about those 3 processes?

[tzuk]

So are we designing this feature now? Like I said I like the concept, but it'll take a while before I get around to it. Remember dlguild's old suggestion about a 'leader' process in the sandbox, sort of like the opposite of a linger process? I still want to add that, too. My point is, discussing specifics is way too early.

[SnDPhoenix]

So are we designing this feature now? Like I said I like the concept, but it'll take a while before I get around to it. Remember dlguild's old suggestion about a 'leader' process in the sandbox, sort of like the opposite of a linger process? I still want to add that, too. My point is, discussing specifics is way too early.

Yeah, true, much too early.
Btw, not that you mention him, whatever happened to DLGuild??
But yeah, I remember that thread now, though I had forgotten all about it!

[tzuk]

I don't know. I hope he's fine. Anyway, I'm off, ttyl!