SBIE 2

2008-07-06T21:22:00.000-07:00

There are some errors in the INI file, it seems like < > is not supported.
If in doubt, please ask.

SandboxIE

2008-07-06T15:46:00.000-07:00

So, I'll jump some steps ahead and will write about SandboxIE (or SBIE) .
Official website: http://www.sandboxie.com

This is a great app for protecting your computer. It's a program that belongs to the HIPS (Host Intrusion Prevention System) family, under the sandbox category. More specific: a virtualization sandbox.

If you start to see terminology you don't know, don't worry, I'll explain it all in later posts. Lets focus on sandboxes. In simple words, a virtualizating sandbox creates a space in your computer where programs can do anything they want, except get out of that sandbox. This means that if a virus runs on the sandbox, it can't do no real harm, since it only can live inside that sandbox. It can't screw up your files, or delete settings, etc.

I myself always run my web browser sandboxed. This way, everything I download lands in the sandbox. If I accidentally pick up a virus or a trojan, it stays there. When I decide so, I can delete all contents on the sandbox.

For more about sandboxes and sandboxie, go to the official website or visit Wilders Security Forum.

------------------------------------------

Now, for those who already know about SBIE, I'll explain how I use it. Please feel free to ask questions or suggest changes that might give even a higher level of protection.

First of all, I have different sandboxes (I believe this can only be done with the paid version, since the free version only allows one sandbox):

-Internet Explorer Sandbox
-Firefox Sandbox
-Media Players Sandbox
-Received Files Sandbox
-Test Sandbox

The named are pretty much self explainatory, and the settings are almost the same for each sandbox.

For Explorer and Firefox sandboxes, these programs are forced to always run sandboxed. Also, nothing else in the sandbox can run, so if I ever accidentally download a trojan or a keylogger, it will be impossible for it to run and achieve it's evil task. Also sensible data folders are locked, so there's absolutely no access to them from within the sandbox: no read, no write, no deletion.

Received Files sandbox forces apps that are in "received files" folders (msn and uTorrent) to run sandboxed. No access to sensible data folders and no access to the internet.

Media Players folder is self explainatory. Also no internet access and data folders locked. Used to prevent fake mp3's that are malware in reality.

Test Sandbox is used for 2 purposes: test malware and open unknown programs that are downloaded or come in USB drives. Everything that comes from F: and G: drives (usually where usb drives are mounted) is forced to run sandboxed, to prevent worms from jumping to my computer. No access to the whole data partition (D:), no internet access.

I added some registry keys protection for all sandboxes (mainly to block boot start folders and keys). finally, all the sandboxes are automatically erased when the programs in it are closed.

The only downside this is application updating. Specially with firefox and it's add-ons. To deal with this, every now and then, I start the applications unsandboxed and update. Takes under 2 minutes of my valuable time, a real bargain when you think how long it can take to clean an infected system.
---------

If you wonder how my SBIE ini file looks, here it is:

[GlobalSettings]

ProcessGroup=,firefox.exe
ProcessGroup=,iexplore.exe
ProcessGroup=,firefox.exe,PDFXCview.exe,sandboxiedcomlaunch.exe,sandboxierpcss.exe,start.exe
ProcessGroup=,DivXsm.exe,mplayerc.exe,winamp.exe,wmplayer.exe,sandboxiedcomlaunch.exe,sandboxierpcss.exe,start.exe
ProcessGroup=,iexplore.exe,sandboxiedcomlaunch.exe,sandboxierpcss.exe,start.exe

[MediaPlayers]

Enabled=y
ConfigLevel=4
AutoRecoverIgnore=.part
AutoRecoverIgnore=.jc!
RecoverFolder=%Desktop%
RecoverFolder=%Personal%
AutoDelete=y
NeverDelete=n
ForceProcess=winamp.exe
ForceProcess=mplayerc.exe
ForceProcess=wmplayer.exe
ClosedFilePath=\Device\RawIp
ClosedFilePath=\Device\Ip*
ClosedFilePath=\Device\Tcp*
ClosedFilePath=\Device\Afd*
ClosedFilePath=%Personal%EII\
ClosedFilePath=%Personal%8525 BACKUP\
ClosedFilePath=%Personal%Contraseñas\
ClosedFilePath=%Personal%My Chat Logs\
ClosedFilePath=%Personal%varios\
ClosedFilePath=C:\AUTOEXEC.BAT
ClosedFilePath=C:\boot.ini
ClosedFilePath=C:\ntldr
ClosedFilePath=C:\NTDETECT.COM
ClosedFilePath=!,*
ClosedIpcPath=!,*
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

[IEXPLORER]

Enabled=y
ConfigLevel=4
AutoRecover=y
AutoRecoverIgnore=.jc!
AutoRecoverIgnore=.part
RecoverFolder=%Favorites%
RecoverFolder=%Personal%
RecoverFolder=%Desktop%
AutoDelete=y
NeverDelete=n
ForceProcess=iexplore.exe
ClosedFilePath=%Personal%varios\
ClosedFilePath=%Personal%My Chat Logs\
ClosedFilePath=%Personal%Mis archivos recibidos\
ClosedFilePath=%Personal%Contraseñas\
ClosedFilePath=%Personal%Completed Torrent Downloads\
ClosedFilePath=%Personal%8525 BACKUP\
ClosedFilePath=!,\Device\RawIp
ClosedFilePath=!,\Device\Ip*
ClosedFilePath=!,\Device\Tcp*
ClosedFilePath=!,\Device\Afd*
ClosedFilePath=C:\AUTOEXEC.BAT
ClosedFilePath=C:\boot.ini
ClosedFilePath=C:\ntldr
ClosedFilePath=C:\NTDETECT.COM
ClosedFilePath=!,*
ClosedIpcPath=!,*
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

[FIREFOX]

Enabled=y
ConfigLevel=4
AutoRecover=y
AutoRecoverIgnore=.jc!
AutoRecoverIgnore=.part
RecoverFolder=%Desktop%
AutoDelete=y
NeverDelete=n
OpenFilePath=firefox.exe,%AppData%\Mozilla\Firefox\Profiles\*\places*
OpenFilePath=firefox.exe,%AppData%\Mozilla\Firefox\Profiles\*\bookmark*
OpenProtectedStorage=y
ForceProcess=firefox.exe
ClosedFilePath=%Personal%Completed Torrent Downloads\
ClosedFilePath=%Personal%8525 BACKUP\
ClosedFilePath=%Personal%Mis archivos recibidos\
ClosedFilePath=%Personal%My Chat Logs\
ClosedFilePath=%Personal%varios\
ClosedFilePath=%Personal%Contraseñas\
ClosedFilePath=!,\Device\RawIp
ClosedFilePath=!,\Device\Ip*
ClosedFilePath=!,\Device\Tcp*
ClosedFilePath=!,\Device\Afd*
ClosedFilePath=C:\AUTOEXEC.BAT
ClosedFilePath=C:\boot.ini
ClosedFilePath=C:\ntldr
ClosedFilePath=C:\NTDETECT.COM
ClosedFilePath=!,*
ClosedIpcPath=!,*
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

[TESTBOX]

ConfigLevel=4
AutoRecoverIgnore=.part
AutoRecoverIgnore=.jc!
Enabled=y
AutoDelete=y
NeverDelete=n
ForceFolder=C:\Documents and Settings\Propietario\Escritorio
ForceFolder=F:\
ForceFolder=G:\
DeleteCommand=C:\Archivos de programa\Eraser\Eraserl.exe -folder "%SANDBOX%" -subfolders -method Random 3
ClosedFilePath=%Start Menu%\Programas\Inicio\
ClosedFilePath=%Personal%
ClosedFilePath=\Device\Afd*
ClosedFilePath=\Device\Tcp*
ClosedFilePath=\Device\Ip*
ClosedFilePath=\Device\RawIp
ClosedFilePath=C:\AUTOEXEC.BAT
ClosedFilePath=C:\boot.ini
ClosedFilePath=C:\ntldr
ClosedFilePath=C:\NTDETECT.COM
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

[RECEIVEDFILES]

Enabled=y
ConfigLevel=4
AutoRecoverIgnore=.part
AutoRecoverIgnore=.jc!
RecoverFolder=%Desktop%
RecoverFolder=%Personal%
AutoDelete=y
NeverDelete=n
ForceFolder=D:\Mis archivos recibidos
ForceFolder=D:\Completed Torrent Downloads
DeleteCommand=C:\Archivos de programa\Eraser\Eraserl.exe -folder "%SANDBOX%" -subfolders -method Random 3
ClosedFilePath=%Personal%Mi música\
ClosedFilePath=%Personal%Mis imágenes\
ClosedFilePath=%Personal%varios\
ClosedFilePath=%Personal%My Chat Logs\
ClosedFilePath=%Personal%8525 BACKUP\
ClosedFilePath=%Personal%Contraseñas\
ClosedFilePath=\Device\Afd*
ClosedFilePath=\Device\Tcp*
ClosedFilePath=\Device\Ip*
ClosedFilePath=\Device\RawIp
ClosedFilePath=%Personal%EII\
ClosedFilePath=%My Video%\
ClosedFilePath=C:\AUTOEXEC.BAT
ClosedFilePath=C:\boot.ini
ClosedFilePath=C:\ntldr
ClosedFilePath=C:\NTDETECT.COM
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

[UserSettings_38A404AF]

SbieCtrl_UserName=propietario
SbieCtrl_ShowWelcome=N
SbieCtrl_NextUpdateCheck=1555555555
SbieCtrl_UpdateCheckNotify=N
SbieCtrl_HideWindowNotify=N
SbieCtrl_WindowLeft=560
SbieCtrl_WindowTop=295
SbieCtrl_WindowWidth=660
SbieCtrl_WindowHeight=450
SbieCtrl_Hidden=Y
SbieCtrl_ActiveView=40021
SbieCtrl_BoxExpandedView_DefaultBox=Y
SbieCtrl_AutoApplySettings=Y
SbieCtrl_SettingChangeNotify=N
SbieCtrl_BoxExpandedView_IEXPLORER=N
SbieCtrl_BoxExpandedView_FIREFOX=N
SbieCtrl_BoxExpandedView_SKYPE=Y
SbieCtrl_ReloadConfNotify=N
SbieCtrl_EditConfNotify=N
SbieCtrl_ColWidthProcName=250
SbieCtrl_ColWidthProcId=70
SbieCtrl_ColWidthProcTitle=310
SbieCtrl_BoxExpandedView_ArchivosRecibidos=Y
SbieCtrl_BoxExpandedView_Winamp=Y
SbieCtrl_BoxExpandedView_MediaPlayers=Y
SbieCtrl_BoxExpandedView_Internet=Y
SbieCtrl_BoxExpandedView_TESTBOX=N
SbieCtrl_BoxExpandedView_RECEIVEDFILES=Y

readme.txt

2008-07-06T15:29:00.000-07:00

Welcome to my Security Blog.

I don't like blogs. I don't like Web2.0.
But I want to help people to understand how they computers works, fight malware and protect their data, so I'll make a little sacrifice.

While I don't consider myself an expert (there are tons of more qualyfied people out there), I do think I have an above average computer knowledge. I started formally using computers back in 1992 or 1993. Old 386 machines running DOS and Win 3.1. Since then I've used Win 3.11, Win95, Win98, Win Me and finally Win XP.

Over the years I went from being a kid who had no idea of what he what doing -once I typed "deltree windows" in DOS because there was an error in the windows folder-, to someone with a reasonable knowledge and who has cleaned lots of infected computers.

But my knowledge has grown exponentially over the last year, after I joined Wilders Security Forum. If you are really interested in learning about security, you must go there. Lots of friendly people, all willing to help and share their knowledge.

So, I'm here to share some of that knowledge with you, and help as much as I can.

PS: My native language is not English, so please forgive if I make some errors in my writing.

HURST's Security Blog

SBIE 2

SandboxIE

readme.txt