Reply to thread

Message

<blockquote data-quote="AtlBo" data-source="post: 713717" data-attributes="member: 32547">Thx for these great details Evjl&#039;s Rain.&nbsp; Does this mean that CCAV will not block hardware/system/driver based malware via the sandbox?&nbsp; If it cannot block the system malware will it sandbox the changes anyway?EDIT:&nbsp; You are saying it blocks, but is the reason the CCAV sandbox is weaker because it records system changes (in the sandbox)?&nbsp; Don&#039;t know the specific difference between user hook and hardware virtualization, but it sounds like CF actually blocks changes to the system by isolated programs.&nbsp; This matches what I have seen as nothing works in CFs sandbox.&nbsp; Would be interesting to see if something might work in CCAV as long as the changes are being recorded so the sandbox can then be emptied etc.I messed around with the 360 sandbox last night.&nbsp; Executables won&#039;t run in the sandbox, except when executed by something in the sandbox.&nbsp; I dropped Autoruns it there and ran it via the manual choice to sandbox an application.&nbsp; It worked perfectly.&nbsp; Seems like a pretty good idea for portable applications.&nbsp; Installing Dexpot to the folder didn&#039;t work out so well, but the test got kind of off kilter.&nbsp; I meant to install to the sandbox Programs folder but installed on the sandbox root.&nbsp; It did run, however, but removing it was a problem, because, a tmp file for unistalling wouldn&#039;t run.&nbsp; Just turned off the sandbox protection of the app, emptied sandbox, reinstalled app and then removed no problem.&nbsp; Think I could get this to work for some applications.Really interesting concept that borders on what ReHIPS is doing.&nbsp; The 360 sandbox is a root sandbox that will record changes system-wide.&nbsp; It just won&#039;t allow .exes in the sandbox to be executed from the outside or via mouse click etc.&nbsp; Wondering if you are saying that CCAV&#039;s sandbox is more this same way.</blockquote>

[QUOTE="AtlBo, post: 713717, member: 32547"] Thx for these great details Evjl's Rain. Does this mean that CCAV will not block hardware/system/driver based malware via the sandbox? If it cannot block the system malware will it sandbox the changes anyway? EDIT: You are saying it blocks, but is the reason the CCAV sandbox is weaker because it records system changes (in the sandbox)? Don't know the specific difference between user hook and hardware virtualization, but it sounds like CF actually blocks changes to the system by isolated programs. This matches what I have seen as nothing works in CFs sandbox. Would be interesting to see if something might work in CCAV as long as the changes are being recorded so the sandbox can then be emptied etc. I messed around with the 360 sandbox last night. Executables won't run in the sandbox, except when executed by something in the sandbox. I dropped Autoruns it there and ran it via the manual choice to sandbox an application. It worked perfectly. Seems like a pretty good idea for portable applications. Installing Dexpot to the folder didn't work out so well, but the test got kind of off kilter. I meant to install to the sandbox Programs folder but installed on the sandbox root. It did run, however, but removing it was a problem, because, a tmp file for unistalling wouldn't run. Just turned off the sandbox protection of the app, emptied sandbox, reinstalled app and then removed no problem. Think I could get this to work for some applications. Really interesting concept that borders on what ReHIPS is doing. The 360 sandbox is a root sandbox that will record changes system-wide. It just won't allow .exes in the sandbox to be executed from the outside or via mouse click etc. Wondering if you are saying that CCAV's sandbox is more this same way. [/QUOTE]

Verification