EIS sometimes fails to monitor the file downloaded by browsers running in Sandboxie

[Online_Sword]

When I visit some malicious links with chrome running in SBIE, I find that some downloaded malware samples will not incur any alert from EIS.
This is not incurred by a false-negative detection, since when I manually scan the sandbox folder with EIS, the malware samples can be detected and removed.
I do not think that Emsisoft has a policy that automatically add any process running in SBIE to the white-list of real-time/on-access scanning, since there also exist some malware samples downloaded in SBIE can actually be detected in the real time.
I should say that this problem makes me worry about the monitoring capability of EIS.

 

[Terry Ganzi]

When I visit some malicious links with chrome running in SBIE, I find that some downloaded malware samples will not incur any alert from EIS.
This is not incurred by a false-negative detection, since when I manually scan the sandbox folder with EIS, the malware samples can be detected and removed.
I do not think that Emsisoft has a policy that automatically add any process running in SBIE to the white-list of real-time/on-access scanning, since there also exist some malware samples downloaded in SBIE can actually be detected in the real time.
I should say that this problem makes me worry about the monitoring capability of EIS.

He on over to https://support.emsisoft.com/ & they will sort you out fast.

 

[Online_Sword]

He on over to https://support.emsisoft.com/ & they will sort you out fast.

According to my experience, when I post in the official support forum, there will be at most one stuff reply my thread in each day, and he/she will reply at most once every day, no matter the reply can solve the problem or not.
For me, posting in the support forum and waiting for the reply is just like sending a mail to the support stuff by pigeon...
The long wait is really torture for me...

 

[hjlbx]

When I visit some malicious links with chrome running in SBIE, I find that some downloaded malware samples will not incur any alert from EIS.
This is not incurred by a false-negative detection, since when I manually scan the sandbox folder with EIS, the malware samples can be detected and removed.
I do not think that Emsisoft has a policy that automatically add any process running in SBIE to the white-list of real-time/on-access scanning, since there also exist some malware samples downloaded in SBIE can actually be detected in the real time.
I should say that this problem makes me worry about the monitoring capability of EIS.

Emsisoft does not white-list files in SBIE sandbox folder = you are correct.

I think what you have is a potential bug and should be reported on the Emsi Support Forum.

Yes. Emsi forum can be painfully slow, but the solutions are always of a very high quality. Where else do you have a direct line to the developers???

In past versions, e.g. v. 9.0.0, Emsi always detected downloaded malware using either Chrome or SBIE. Since Emsi just over-hauled their scan engine it could be possible something is amiss... however, if you transfer the file from the sandbox folder to the regular Windows file system - EIS will detect and alert... so the physical system is protected.

In any case, EIS File Guard seems to be not working correctly. In my experience, EIS should detect any malware whether it is within the virtual container or outside.

Really. Despite the slow response, you will help out all other users by reporting the issue on the Emsi forum.

 

[hjlbx]

I had a rootkit infection that was running through svchost processes. I am not sure if its fixed after miracle re install, and scrub of partition. I doubt it. Takes about two weeks then pc will finally lock up a boot after fighting it. I put Spyshelter firewall in with Emsisoft on max settings with behavioural monitoring custom for svc host. Also voodoo shield. You think those custom settings in ems will help?

If that rootkit infection reappears after a partition wipe and clean OS install then something is really wrong...

If you are using EAM + VS that should protect your system - but that combo will not do much if there is already a FUD rootkit already on your system.

I would think you're OK now after all that you have done in sanitizing your system...

 

[Online_Sword]

Emsisoft does not white-list files in SBIE sandbox folder = you are correct.

I think what you have is a potential bug and should be reported on the Emsi Support Forum.

Yes. Emsi forum can be painfully slow, but the solutions are always of a very high quality. Where else do you have a direct line to the developers???

In past versions, e.g. v. 9.0.0, Emsi always detected downloaded malware using either Chrome or SBIE. Since Emsi just over-hauled their scan engine it could be possible something is amiss... however, if you transfer the file from the sandbox folder to the regular Windows file system - EIS will detect and alert... so the physical system is protected.

In any case, EIS File Guard seems to be not working correctly. In my experience, EIS should detect any malware whether it is within the virtual container or outside.

Really. Despite the slow response, you will help out all other users by reporting the issue on the Emsi forum.

Thank you for your suggestion.
Since the malicious link that causes this problem broke down soon after I created this thread, I did not submit this problem to Emsi.
However, currently I am discussing another bug of EIS corresponding to SBIE with Emsi's staff in the forum
https://support.emsisoft.com/topic/...lications-installed-in-sandboxie/#entry133242