Steps to take before running a program locally
Everyone knows that before running a program you downloaded from the net, you should
1. Do your research (check out what people are saying about the software on google groups etc)
2. Read the EULA (End User License Agreement) with the help of Javacool’s Eulalyzer.
3. Download from a trust worthy source, check site reputation using services like SiteAdvisor (or free alternatives)
4. Scan the executable with not just your local antivirus but also get second and third options with various Online malware Scanners, particularly multiple engine scanners like VirusTotal (or alternatives). Advanced users should scan with sandboxing type scanners like Anubis or PC Tools Threat Expert (or alternatives).
But these methods aren’t foolproof , but what other defenses are there to ensure recovery if the programs turns out to be malicious or bad?
Using installation monitors
How they work - These tools monitor changes made during installation of a program. This is achieved by creating a mini-snapshot of the entries in the file system, registry (typically it is not 100%) before the installer is run, followed by another run after the installer is run to capture any changes (some may require reboots to capture all changes).
Examples (freeware unless otherwise indicated) - Inctrl , Total Uninstall 2.35 (last freeware version) and ZSoft Uninstaller .
Pros - Simple to use and understand. No time limits for which the trial program can be installed. Can be used to monitor programs that require reboots.
Cons - Not accurate as other methods. Before and after differences might capture changes made by other programs and not just the installer. Captures only changes made during installation. For example the program might make registry changes only after the nth use (a typical tactic used by shareware) and will not be captured by the installation monitors. Malware programs might do the same.
Using Sandboxing with file/registry virtualization
How they work - Run the installer or program sandboxed and every file and registry change made by the process (and usually child processes) is tracked in real time. The changes are shunted to a virtualized sandbox (an alternative location), but work normally otherwise. After installation, the program can then be run sandboxed, this ensures *every* change is being monitored in real time unlike using installation monitors.
Examples (freeware unless otherwise indicated) -Sandboxie , Bufferzone, Virtual Sandbox , Altiris Software Virtualization Solution (this one works quite differently).
Pros - Every change made by the sandboxed program is tracked and can be reversed. Program can be tested over several sessions and can be cleared just by clearing the sandbox. Strong security, most sandboxes prevent potentially dangerous activities like installing drivers.
Cons - Many programs will not install in sandboxes because of restrictions. Programs that require reboots (generally those that install drivers and services) will not work either. Some changes might leak and not be tracked.
Note: Altiris Software Virtualization Solution differs from the usual sandbox in that it does not do security restrictions. It uses different layers which can be mounted or unmounted separately.
Using parition virtualization
How they work - They are kissing cousins of rollback and disk imaging software, except that they record changes made only during a session (protected mode/shadow mode etc) and automatically clear it after a reboot. This can be done very quickly as compared to reimaging the whole disk.
Examples (freeware unless otherwise indicated) - Returnil Virtual System Personal Edition , Windows SteadyState(allows changes to survive reboot) .
Pros - Every change made by the program you are trialling (and everything else in fact) is tracked and is reversed on reboot. While it does not protect you during the session, you are assured that nothing nasty is left behind on reboot.
Cons - Most of these software clear everything on reboot (exception Windows SteadyState that allow you to keep changes for a period of time), so programs that require reboots to install cannot be tested with this.
Multiple Snapshot/rollback virtualization
How they work - A subset of partition virtualization, but allows storing of multiple snapshots, which can be restored very rapidly using incremental backups. Many also offer advanced features of “data anchoring” (where certain files/folders are left untouched) etc.
Examples (freeware unless otherwise indicated) - Mostly commercial or enterprise products. Rollback RX (non-freeware) , FirstDefense-ISR
Pros - Combines the advantages of VMware snapshot facility, with testing on your production machine.
Cons - Despite improvements in incremental backup technology, multiple snapshots are going to require quite a lot of disk space compared to other methods.
Using Virtual machines
How they work -Uses software to completely simulate a new machine.
Examples (freeware unless otherwise indicated) - Virtual PC2007 , VMware server , VirtualBox .
Pros - Complete security, nothing can leak to your real machine. Everything is removed when the virtual machine snaphot is deleted. Allows installation of almost all types of programs (some games that require graphic cards might not work).
Cons - Virtual machines require a seperate OS license. Host machine needs to have sufficient RAM. A few malware will detect vm and act accordingly. Unless you take pains to setup your virtual machine exactly like your real production machine, software that works in the former might not work well in the later due to software conflicts.
Misc
Windows System Restore - Restores mostly system files.
Conventional Backup or disk imaging. - Examples include DriveImage XML ,Acronis TrueImage, Norton Ghost. Whether the backups are in actual archived files or in disk images, provides full restore, but restoration is relatively slow
[ via link ]
