Block Process Access

bugmenot · Post by **bugmenot** » Fri Oct 16, 2009 5:21 am

you mean delete
the
InjectDll=C:\some\path\to\antidel.dll

Buster · Post by **Buster** » Fri Oct 16, 2009 5:35 am

bugmenot wrote:you mean delete
the
InjectDll=C:\some\path\to\antidel.dll

You told:

tried to put AntiDel and BlockProcessAccess

I understand you used both at the same time.

Am I right or I didn´t understand correctly?

bugmenot · Post by **bugmenot** » Fri Oct 16, 2009 6:19 am

Can u please check if there is anything wrong with my config.

[GlobalSettings]

Template=ShortKeys
Template=KeyScrambler
FileRootPath=D:\Sandbox\%SANDBOX%

[UserSettings_0BD401EF]

SbieCtrl_UserName=asm@m
SbieCtrl_ReSyncContextMenu=N
SbieCtrl_NextUpdateCheck=1256186976
SbieCtrl_UpdateCheckNotify=Y
SbieCtrl_ShowWelcome=N
SbieCtrl_BoxExpandedView_DefaultBox=Y
SbieCtrl_HideWindowNotify=N
SbieCtrl_BoxExpandedView_TestBox=Y
SbieCtrl_BoxExpandedView_TestingBox=Y
SbieCtrl_WindowLeft=169
SbieCtrl_WindowTop=151
SbieCtrl_WindowWidth=660
SbieCtrl_WindowHeight=450
SbieCtrl_Hidden=Y
SbieCtrl_ActiveView=40021
SbieCtrl_AutoApplySettings=N
SbieCtrl_SettingChangeNotify=Y
SbieCtrl_BoxExpandedView_InstallBox=Y
SbieCtrl_ExplorerWarn=N
SbieCtrl_BoxExpandedView_Apps=Y
SbieCtrl_TerminateNotify=Y
SbieCtrl_TerminateWarn=Y
SbieCtrl_ExplorerNotify=Y
SbieCtrl_EditConfNotify=Y
SbieCtrl_ReloadConfNotify=Y
SbieCtrl_ProcSettingsNotify=Y
SbieCtrl_ShortcutNotify=Y
SbieCtrl_ShouldDeleteNotify=Y
SbieCtrl_ColWidthProcName=250
SbieCtrl_ColWidthProcId=70
SbieCtrl_ColWidthProcTitle=310

[DefaultBox]

ConfigLevel=6
AutoRecover=y
Template=AutoRecoverIgnore
Template=Firefox_Phishing_DirectAccess
Template=LingerPrograms
Template=InternetDownloadManager
Template=ShortKeys
Template=Kaspersky
Template=KeyScrambler
Template=IExplore_Force
Template=IExplore_Favorites_RecoverFolder
Template=Firefox_Force
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
RecoverFolder=%Personal%
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
Enabled=y
LingerProcess=klwtblfs.exe
LingerProcess=RealSched.exe
LingerProcess=RunDll32.exe
LingerProcess=GoogleToolbarNotifier.exe
LingerProcess=GoogleUpdate.exe
LingerProcess=SynCor.exe
LingerProcess=JUSched.exe
LingerProcess=Adobe_Updater.exe
LingerProcess=AcroRd32.exe
AutoRecoverIgnore=.dtapart
AutoRecoverIgnore=.download
AutoRecoverIgnore=.tmp
AutoRecoverIgnore=.dlm
AutoRecoverIgnore=.leechget
AutoRecoverIgnore=.jc!
AutoRecoverIgnore=.part
OpenIpcPath=*\BaseNamedObjects*\__hex30-90__
OpenIpcPath=*\BaseNamedObjects*\KLObj_mt_KLSCRIPTCHECKER_PR_*
OpenIpcPath=*\BaseNamedObjects*\PRObjects*
OpenIpcPath=*\BaseNamedObjects*\PREvent*
OpenIpcPath=*\BaseNamedObjects*\PRCustomProps*
OpenIpcPath=\RPC Control\PRRemote:*
OpenIpcPath=*\BaseNamedObjects*\KSEncStatusEvent
OpenIpcPath=*\BaseNamedObjects*\KSProcEvent*
OpenIpcPath=*\BaseNamedObjects*\KSEncryptionEvent*
OpenIpcPath=*\BaseNamedObjects*\KeyScrambler*
OpenIpcPath=\Device\KeyScrambler
OpenPipePath=\Device\NamedPipe\KSTIPipe*
ForceProcess=iexplore.exe
ForceProcess=firefox.exe
OpenClsid={AC746233-E9D3-49CD-862F-068F7B7CCCA4}
OpenFilePath=firefox.exe,*\urlclassifier*.sqlite*

When i add

InjectDll=C:\Program Files\Sandboxie\AntiDel\antidel.dll

to the last row,
i cannot use the Google toolbar for searching (in Firefox).
Need to click Home and search from www.google.com
And yes, there is a quite small lag when i typed the words especially in search box of forum (like wbb,tvfl)

Next, I'll try

InjectDll=C:\some\path\to\sbieinj.dll

Buster · Post by **Buster** » Fri Oct 16, 2009 6:30 am

AntiDel, as you may know, it´s a library I wrote to don´t allow file deletion.

The effects of not allowing a program to delete files may have are unknown. Sometimes it will not have any effect and others... a lag typing.

If you don´t like the effects AntiDel produces in a program I suggest you don´t use AntiDel with that program.

bugmenot · Post by **bugmenot** » Fri Oct 16, 2009 6:50 am

Its sure is AntiDel bugs.

as after i remove it from Sandboxie.ini and add

InjectDll=C:\Program Files\Sandboxie\BlockProcessAccess\sbieinj.dll

these problem doesnt occur.

So how to exclude Firefox from using AntiDel while other programs still use it?

Guest10 · Post by **Guest10** » Fri Oct 16, 2009 9:30 am

bugmenot wrote:Can u please check if there is anything wrong with my config.

After your questions are addressed, concerning the use of InjectDll and AntiDel, would you like to discuss the rest of your configuration for DefaultBox?
No, I'm not saying that there's anything wrong with it.
It's just that you have a great many duplicated settings.

To name just a couple of them:

Template=IExplore_Force
Template=Firefox_Force

Those lines are fine, so you really don't need these lines:
ForceProcess=iexplore.exe
ForceProcess=firefox.exe

Your configuration file could be greatly simplified, by removing duplicated settings - settings that are added by Templates, but are also listed in the other lines in your configuration file.
We could do it via private messages, if you don't want to take up space in this thread.

Buster · Post by **Buster** » Fri Oct 16, 2009 9:53 am

bugmenot wrote:Its sure is AntiDel bugs.

Do you mean AntiDel has a bug?

About how to exclude Firefox. You could modify source code and allow FireFox.exe process to delete.

bugmenot · Post by **bugmenot** » Fri Oct 16, 2009 10:53 am

Guest10 wrote:
bugmenot wrote:Can u please check if there is anything wrong with my config.
After your questions are addressed, concerning the use of InjectDll and AntiDel, would you like to discuss the rest of your configuration for DefaultBox?
No, I'm not saying that there's anything wrong with it.
It's just that you have a great many duplicated settings.

To name just a couple of them:

Template=IExplore_Force
Template=Firefox_Force

Those lines are fine, so you really don't need these lines:
ForceProcess=iexplore.exe
ForceProcess=firefox.exe

Your configuration file could be greatly simplified, by removing duplicated settings - settings that are added by Templates, but are also listed in the other lines in your configuration file.
We could do it via private messages, if you don't want to take up space in this thread.

Maybe u can teach me something

Buster wrote:
bugmenot wrote:Its sure is AntiDel bugs.
Do you mean AntiDel has a bug?

About how to exclude Firefox. You could modify source code and allow FireFox.exe process to delete.

And how to do that?

Buster · Post by **Buster** » Fri Oct 16, 2009 1:12 pm

bugmenot wrote:And how to do that?

Reply my question, please.

Guest · Post by **Guest** » Fri Oct 16, 2009 9:04 pm

Excuse my ignorance, but is this tool purely focused on preventing a privacy issue or is it for security?

Buster · Post by **Buster** » Fri Oct 16, 2009 9:35 pm

Anonymous wrote:Excuse my ignorance, but is this tool purely focused on preventing a privacy issue or is it for security?

Do you mean Sandboxie?

Guest · Post by **Guest** » Sat Oct 17, 2009 1:50 pm

No, I meant the Sandiff add-on.

Buster · Post by **Buster** » Sat Oct 17, 2009 1:57 pm

Anonymous wrote:No, I meant the Sandiff add-on.

Sandiff does not prevent anything. I don´t know what you talk about.

Could you be more specific?

Guest · Post by **Guest** » Sat Oct 17, 2009 6:02 pm

Wraithdu described the sandiff tool as a way to block sandboxed processes frm readin unsandboxed process memories and from EXECUTING unsandboxed processes...(at least thats what I read on the first page) So is Sandiff for more security or just for more privacy. If security, can Tzuk incorporate the code in a new release of SB itself? That would make it easier for users to activate and customize.

Buster · Post by **Buster** » Sat Oct 17, 2009 6:33 pm

Anonymous wrote:Wraithdu described the sandiff tool as a way to block sandboxed processes frm readin unsandboxed process memories and from EXECUTING unsandboxed processes...(at least thats what I read on the first page) So is Sandiff for more security or just for more privacy. If security, can Tzuk incorporate the code in a new release of SB itself? That would make it easier for users to activate and customize.

Read again because you are wrong. It´s wraithdu´s Block Read Access DLL who block sandboxed processed from reading unsanboxed process memories, not Sandiff.

Sandboxie Support

Block Process Access

Who is online