Hello,
Shadow Defender is great software.
It protects my system from permanent infection.
However, I have one warning.
Remember this - if you download malware and tinker with it - meaning allow it to run without any type of restriction, then it will perform all of its malicious activities during Shadow Mode. Plus if you are signed in as Administrator, then the malware will be able to run with same privileges. Shadow Mode is a fully virtualized environment that does not prevent malware from running nor stop it once it is executed!
So if the malware is designed to grab data and transmit it back to a C&C server, then it will do so. If its a cryptolocker variant it is going to encrypt files, if it's a virus it is going to replicate, etc, etc, etc.
There are things you can do while running in Shadow Mode to ensure solid security:
1. Use Guest Account
2. Use Microsoft's DropMyRights
3. Use Sandboxie
4. Once you download and run malware, then disable network/block connections
5. Use Blue Network's AppGuard (if use Sandboxie need special configuration; with Shadow Defender/Emsisoft no special configuration needed).
NOTE: Configuring AppGuard not so easy. If not done correctly will cause big headache.
6. Use Windows Parental Controls as an anti-executable (requires configuring some folders)
7. Always use your AV/Firewall in Shadow Mode
I allow malware to run in Shadow Mode with Administrator privileges (my system is completely exposed, but actions by malware are reversible - except, perhaps, for rootkits - jury is still out on that one), but once it is done downloading and installing, then I turn AV to Offline Mode - which blocks all network connections via firewall. This option to block network connections either globally or on a per application basis is available with most AV nowadays.
I do not recommend what I do. Proceed with caution and be prepared for the (unintended) consequences.
hjlbx
Shadow Defender is great software.
It protects my system from permanent infection.
However, I have one warning.
Remember this - if you download malware and tinker with it - meaning allow it to run without any type of restriction, then it will perform all of its malicious activities during Shadow Mode. Plus if you are signed in as Administrator, then the malware will be able to run with same privileges. Shadow Mode is a fully virtualized environment that does not prevent malware from running nor stop it once it is executed!
So if the malware is designed to grab data and transmit it back to a C&C server, then it will do so. If its a cryptolocker variant it is going to encrypt files, if it's a virus it is going to replicate, etc, etc, etc.
There are things you can do while running in Shadow Mode to ensure solid security:
1. Use Guest Account
2. Use Microsoft's DropMyRights
3. Use Sandboxie
4. Once you download and run malware, then disable network/block connections
5. Use Blue Network's AppGuard (if use Sandboxie need special configuration; with Shadow Defender/Emsisoft no special configuration needed).
NOTE: Configuring AppGuard not so easy. If not done correctly will cause big headache.
6. Use Windows Parental Controls as an anti-executable (requires configuring some folders)
7. Always use your AV/Firewall in Shadow Mode
I allow malware to run in Shadow Mode with Administrator privileges (my system is completely exposed, but actions by malware are reversible - except, perhaps, for rootkits - jury is still out on that one), but once it is done downloading and installing, then I turn AV to Offline Mode - which blocks all network connections via firewall. This option to block network connections either globally or on a per application basis is available with most AV nowadays.
I do not recommend what I do. Proceed with caution and be prepared for the (unintended) consequences.
hjlbx
Last edited by a moderator:
