New Update Sandboxie-Plus v1.6.6

[bjm_]

Sandboxie Plus v1.6.6 - Latest
https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.6.6
Improved trace log and fixed a few bugs.

You can support the project through donations, any help will be greatly appreciated.
If you have issues with an update installation, just uninstall the previous version keeping the sandboxie.ini and reinstall the new build.

Release Release v1.6.6 / 5.61.6 · sandboxie-plus/Sandboxie

Improved trace log and fixed a few bugs. You can support the project through donations, any help will be greatly appreciated. If you have issues with an update installation, just uninstall the pre...

github.com

As far as I'm aware. DavidXanatos does not monitor MalwareTips.
Maybe, post over on Wilders - Sandboxie-Plus v1.6.6

Also for improved reliability you can check the downloads on the project homepage: Downloads | Sandboxie-Plus where only known good builds are posted about a week or two after the github release.

Sandboxie-Plus Migration Guide
https://github.com/sandboxie-plus/sandboxie-docs/blob/main/Content/PlusMigrationGuide.md

 

[zkSnark]

I downloaded Sandboxie-Plus v1.6.6 from Github. While installing, Emsisoft did not let it install and quarantine as shown in screenshot below. I can manually allow to install but why is Emsisoft blocking this?

 

[harlan4096]

False Positive...

 

[zkSnark]

False Positive...

Seems like @Emsisoft has more false positives than Kaspersky (as I was using this earlier). I downloaded a program from Microsoft Store and Emsisoft did not let it install too.

 

[upnorth]

Enterprise version, wouldn't surprise me is the reason but is there some issues to exclude those downloads?

 

[bjm_]

FWIW ~ OSArmor blocks 1.6.6 tmp files because they're not signed.
Maybe, Emsisoft has similar internal rule.

Process: [11120]C:\Users\bjm\AppData\Local\Temp\is-B5TN5.tmp\Sandboxie-Plus-x64-v1.6.6.tmp
Process Size: 2.87 MB (3,014,144 bytes)
Process MD5 Hash: D3DB824399FF824208F538ADC536A7F7
Parent: [11228]C:\Users\bjm\Desktop\1.6.6\Sandboxie-Plus-x64-v1.6.6.exe
Parent Process Size: 17.64 MB (18,499,984 bytes)
Rule: BlockUnsignedProcessesAppDataLocal
Rule Name: Block execution of unsigned processes on Local AppData

Maybe, Emsisoft Behavior Blocker is on the job.
To stop new and emerging threats, Emsisoft Anti-Malware Home continuously monitors the behavior of all active processes and immediately raises an alert if suspicious activity is detected.

 

[zkSnark]

FWIW ~ OSArmor blocks 1.6.6 tmp files because they're not signed.
Maybe, Emsisoft has similar internal rule.

Process: [11120]C:\Users\bjm\AppData\Local\Temp\is-B5TN5.tmp\Sandboxie-Plus-x64-v1.6.6.tmp
Process Size: 2.87 MB (3,014,144 bytes)
Process MD5 Hash: D3DB824399FF824208F538ADC536A7F7
Parent: [11228]C:\Users\bjm\Desktop\1.6.6\Sandboxie-Plus-x64-v1.6.6.exe
Parent Process Size: 17.64 MB (18,499,984 bytes)
Rule: BlockUnsignedProcessesAppDataLocal
Rule Name: Block execution of unsigned processes on Local AppData

Emsisoft says

Behavior Blocker detected suspicious behavior "HiddenInstallation" of C:\Users\King\AppData\Local\Temp\is-N5ETA.tmp\Sandboxie-Plus-x64-v1.6.6.tmp (SHA1: FBA85962F6C6AA2E0B193035639BB86D63A1B2DE)

A notification message "Suspicious behavior has been found in the following program: C:\Users\King\AppData\Local\Temp\is-N5ETA.tmp\Sandboxie-Plus-x64-v1.6.6.tmp" has been shown

 

[bjm_]

Emsisoft says

Maybe, detection is reputation based. Maybe, after Emsisoft gathers more telemetry. Sandboxie-Plus tmp files will be allowed. IDK. The temp folder is a prime target for malware.

 

[Azure]

Seems like @Emsisoft has more false positives than Kaspersky (as I was using this earlier). I downloaded a program from Microsoft Store and Emsisoft did not let it install too.

View attachment 272228

You can report a “False detection” on the Quarantine tab, if you so desire to do.