How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER]

How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Computers (https://sinister.li/Forum-Computers)
+--- Forum: Antivirus & Protection (https://sinister.li/Forum-Antivirus-Protection)
+--- Thread: How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] (/Thread-How-To-Use-Sandboxie-To-Know-Whether-A-tools-Is-Backdoored-Or-Not-FOR-BEGINNER)

Pages: 1 2 3

How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - -1CE- - 01-21-2013

before we start, you should have a sanDboxiE wIth you
download link:
http://www.sandboxie.com/index.php?DownloadSandboxie

lets understand a litle thing right now..
1)not all program that is not detected by AV as virus has got no virus in it(the virus could be crypted FUD)
2)not all program that is detected by AV as virus is actually a harmful virus(it could be false positive)
------------------------------------------------------------------------------------------------------------------------------------------------
let say you are downloading a stuff(in my case i am downloading utorrent setup),the download is complete and the AV didnt make noise at all.
you would think it is not backdoored..well it could be backdoored, if the virus binded with actual utorrent file is crypted FUD.

SO HOW TO USE SANDBOXIE TO PREVENT THIS:
1)once the download is complete, dont run the file.
2) open the folder contaning the file, drag and drop intothe sandboxie control.if permission is asked by PC, just press ok..
a normal file should like this:

[Image: image.png]

if the file is backdoored by another crypted program(in my case crypted RAT server), it would like this:

[Image: image.png]

if you see in the picture: there is another process is running behind the utorrent setup.this proofs that the file you have downloaded is backdoored..

A LITTLE DECLARATION:
1)the utorrent example is just an example.in real life it is not backdoored.
2)some tools have another process running behind it that lets it to open links for you when you click.that is safe..(not backdoored)
3)THE PICTURE IS EDITED FOR BETTER UNDERSTANDING
~SO WITH THAT I HOPE YOU WILL LEARN TO PROTECT YOURSELF FROM BACKDOORED STUFF.RUN ANYTHING IN SANDBOX FIRST TO CHECK!!~

RE: How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - The Alchemist - 01-21-2013

Well done. Thanks for sharing this. Very nice tutorial.
I'll start using sandboxie efficiently now.

Also, thread moved to white hat section.

RE: How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - -1CE- - 01-21-2013

(01-21-2013, 04:01 PM)The Alchemist Wrote: Well done. Thanks for sharing this. Very nice tutorial.
I'll start using sandboxie efficiently now.

Also, thread moved to white hat section.

thank you for the comment..and sorry for the wrong section posting.. Biggrin

RE: How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - Deque - 01-21-2013

Good to give that hint of using sandboxes for additional protection.
I want to add a warning to users reading this: Some (more sophisticated) malware is able to detect whether it is run in a virtual environment and behaves differently then. So it is still possible (but a bit more unlikely) that you have a piece of malware, that sandboxie declares as clean. Just be careful.
Thanks for your post, 1CE.

RE: How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - Coder-san - 01-21-2013

(01-21-2013, 04:39 PM)Deque Wrote: Good to give that hint of using sandboxes for additional protection.
I want to add a warning to users reading this: Some (more sophisticated) malware is able to detect whether it is run in a virtual environment and behaves differently then. So it is still possible (but a bit more unlikely) that you have a piece of malware, that sandboxie declares as clean. Just be careful.
Thanks for your post, 1CE.

Yes, all we have to do is use the GetModuleHandle API.
In VB.Net, something like:-

Code:
If GetModuleHandle("SbieDll.dll") = 0 Then 'Not Sandboxed, PARTEH!

RE: How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - Synchro - 01-23-2013

Very nice and easy understandable tutorial

RE: How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - dontmessme - 01-28-2013

a great tutorial

thnx buddy for the info

RE: How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - freshx - 01-28-2013

Thanks bro , very nice tutorial! Keep up the good work!

RE: How To Use Sandboxie To Know Whether A tools Is Backdoored Or Not [FOR BEGINNER] - eagle.eye131 - 03-29-2013

Very Nice Tutorial .........keep it up to sharing these kind of beautiful things.......thanks for share Biggrin