Page 4 of 8

Border Guard and Spyware Doctor

Posted: Mon Dec 08, 2008 11:59 am
by ScottN
You will need to temporarily turn off the Process Guard to install Border Guard. The downside is Border Guard does not start with windows so you will have to run through these steps each time if you want to us. To me, its not worth the hassle.

My hope is this feature becomes part of the Sandboxie program.

Posted: Tue Dec 09, 2008 3:20 pm
by Kissol
Mike wrote:Spyware Doctor stopped the installation and flagged Trojan.Virtumonde as trying to install. Is this a false positive or is there a problem with this?
ScottN wrote:You will need to temporarily turn off the Process Guard to install Border Guard. The downside is Border Guard does not start with windows so you will have to run through these steps each time if you want to us. To me, its not worth the hassle.
It's a false positive. BorderGuard was done with Autohotkey. Some antivirus has that dislike with Autohotkey and AutoIt.

If someone has afraid to use BorderGuard he can run it sandboxed to check...; can use SandboxDiff to monitorize their "suspicious" changes in files/registry also...

After that they can send an "audit report" to Spyware Doctor, Process Guard and others guys. So these guys can to increase their white list... Good luck.

BorderGuard can start with Sandboxie smoothly. It's enough: 1- to use the tzuk'suggestion in post above; 2- to use Micahs'Launcher too. Unlike others, to me it's "worth the hassle". In fact to me "the hassle" is running Sandboxie without BorderGuard... I like it.

Micahs: thanks a lot for this interesting and useful utility. Thanks for to allow Sandboxie'users to enjoy their advantageous feature also. Nice work!

Posted: Tue Dec 09, 2008 6:06 pm
by SnDPhoenix
Actually, you dont even need to send the file to PCtools (makers of Spyware Doctor) to have it "whitelisted", just simply looking through the sourcecode of the app you'd see that it is perfectly safe. :D

Posted: Tue Dec 09, 2008 6:50 pm
by Buster
SnDPhoenix wrote:Actually, you dont even need to send the file to PCtools (makers of Spyware Doctor) to have it "whitelisted", just simply looking through the sourcecode of the app you'd see that it is perfectly safe. :D
Other people may find the tool out of this place, without source code or without the knowledge to understand it, so if it has been whitelisted they will know they are using a safe application.

Posted: Thu Dec 11, 2008 2:31 am
by Guest
As Kissol said, alerts on this program are just false detections. I also agree with Kissol that the greater hassle would be running without BorderGuard. I can't believe such useful and simple functionality is not built into Sandboxie to begin with.

But as far as Spyware Doctor or Process Guard or whatever goes, can't you just tell these programs that BorderGuard is safe and can be ignored? Every security program I've ever used had the ability to be told what is safe and/or could be ignored without completely turning it off. If it can't, perhaps consider switching to another security product... :wink:

So Micahs, any progress with an option to show borders on all running sandboxed windows even if they are not in focus? That would be really useful... :D Thanks!

Posted: Thu Dec 11, 2008 8:22 am
by SnDPhoenix
Anonymous wrote:I can't believe such useful and simple functionality is not built into Sandboxie to begin with.
Haha thats because the Borderguard app posted into this thread is a AHK file. It is a document file that is run through AHK's engine when double clicked so it can/will be executed.

Sandboxie isn't built off AHK though (now that would be interesting...) so therefore, it isn't possible to just "incorporate" this app into Sandboxie, unless it was C++ code... :lol:

Posted: Thu Dec 11, 2008 1:39 pm
by Kissol

Posted: Mon Dec 15, 2008 12:58 pm
by Micahs
Sorry for the lapse. Without the email notifications, it's harder to keep up with this. It seems I've missed a fair amount of action!

Yes, it is a false positive. (But of course you wouldn't take my word for that. :D ) I will recompile and repost. The version of AHK I used may have false detections, but the latest is probably ok. For now! As always, the source is included if you want to peruse or compile. I will do this soon.

As far as the "all windows highlighted" thing: It's percolating. I think I know how to do it. It's just a matter of time.

I have, though, made progress on the launcher. It replaces "Start.exe" and renames it "Start.exe.REDIR.exe", running it to sandbox programs. It also launches any program you have selected for global launch. Then, it looks to see if there are any programs listed to run for this particular exe. When there are no more sandboxed apps, it will kill the stuff it ran (you specify for each one whether it will be shut down or not.)

Some progress is better than no progress, I guess.

Posted: Tue Dec 16, 2008 7:58 am
by tzuk
Michas,

I'm considering adding this feature to Sandboxie.

I've traditionally not wanted to do that because I always thought about painting the borders from within the sandboxed program, and did not want to introduce more differences than how the program would normally run.

But your idea is better, in that the painting is done by some other program.

So I hope you're ok with that, and I wanted you to take that into account when you're considering further development of your own tool.

Posted: Thu Dec 18, 2008 4:59 am
by stisev
tzuk,

It would be wonderful if you added this feature to Sandboxie! I (along with many others) would love it!

Thanks so much for improving SBIE!

Border

Posted: Tue Dec 23, 2008 10:42 pm
by MikeNash
Thanks for adding the border color to the feature list - It will be a huge help to clearly see the browser is sandboxed. This is all I want for Christmas :-)

Posted: Tue Dec 23, 2008 11:04 pm
by MitchE323
I think it's great that a lot of folks like this idea by Micahs. If it makes their usage of Sandboxie better, I am all for it. Just please make it optional. :D

Posted: Wed Dec 24, 2008 12:53 am
by Micahs
Tzuk, it would be cool if this idea was integrated into SandboxIE! What changed your mind?

I will continue to develop this until it's a built-in feature, so that it is available until then. Thanks!

By the way, what happened to the email notifications? Why are they off?

Posted: Wed Dec 24, 2008 3:35 pm
by tzuk
What changed my mind was basically what I said earlier -- your way of doing it from the outside rather than from the inside the sandboxed process.

I disabled email notifications because I don't like the idea that just about anyone can cause my Web server to send out unlimited amounts of email.

Posted: Thu Dec 25, 2008 12:20 am
by Micahs
Makes sense! Thanks!