Running Suspicious Applications in a Sandbox
Every now and than I get an application I want to check, but I'm worried that it might harm other processes on my machine, or block my memory if they suffers from a memory leaks.
Sometimes I get files from people which contains viruses, but still I need to have a look at them (what if the RAR file, with all the pictures from that trip, also has a virus in it?).
For all of the above (and maybe some others) the perfect solution is some kind of a sandbox.
For quite a while I was using a virtual PC, running the same OS as the host machine, as a sandbox.
I copied the files there, checked them for viruses, cleaned them, and/or just had a look at them, ignoring all the virus alerts, and then coping a fresh copy of that VPC.
A few weeks ago I found Sandboxie (www.sandboxie.com). An application that creates a sandbox on your operating system and allowing you to run anything you want in a controlled environment, separated then the OS it self.
It runs in an isolated memory range, and controls all the interaction to you hard drive, memory, etc.
Installation is fast and easy, it is a "next-next-next" installation.
Besides the application itself, the installation installs a system level driver, which controls the memory and hard-disk access.
After installation, you'll have a small icon in the system tray, and on your desktop.
The desktop icon runs Internet Explorer in a sandbox (very good for checking sites that you don't know or don't trust).
The window's title changes, and is surrounded by "[#]" to indicate that the browser is in sandbox mode now:
The load time doesn't seem to be effected, nor does any other browser functionality. The page looks the same with, and without the sandbox control (On the left - IE with sandbox, on the right, without sandbox. Click to enlarge) :
The tray icon allows to see the currently active sandboxes, to monitor them, etc.
The application add a context menu entry, allows you to start every application inside a sandbox. This is how it looks like when you right click a folder:
And this is the folder, when it opened within a sandbox:
Note the "[#]" signs in the window's title, same as in IE. The folder content looks just the same and work the same as before. And here's the cool thing: if I'll open one of the images in my image viewer, the image viewer application will start inside the sandbox just as well!
The Sandboxie window, displays all the processes that currently runs inside a specific sandbox. You can have as many sandboxes as your memory allows.
Dragging an application executable or even a shortcut to that window, will open the application inside the sandbox it was dropped on.
This is how Sandboxie window looks like, with all the processes I've run for this post opened:
Summarizing everything said, this is a very nice application no matter what you'd use it for. You don't have to keep it in memory, you can just start it when you need it. If you're just checking unknown web sites, or un-trusted ones, every now and then. If you have to check applications here and there. Or even if you just want to run your own code in an isolated environment, Sandboxie will suit you.
It is free to try and to run, but it will show you some nag screens after 30 days, which you can avoid if you buy a license (30$). Buying the application will give you a life time license including future releases.