2

I want to try out dubious software on my windows 10 computer.

(Bold parts are keywords for the TL/DR fraction)

What is the state of the art precaution to do this most likely safely today?

The software I want to install requires admin rights to install. I did some research and it was conflicting, so I decided to not share it to not influence the answers.

To make this specific.

  1. Is a sandbox like sandboxie sufficient when I use my computer with admin rights and uac.
  2. Is a virtual environment like virtualbox sufficient when I use my computer with admin rights and uac.
  3. Should I create another user without admin rights?
  4. Should I try to remove the admin requirements from the exe and go to 1-3?

What are best practises today?

  • If it's not big, try virustotal.com. If it has virus, just don't try to run it. – Aria Jul 31 '16 at 10:24
  • @Aria virustotal just detects the most common malware. If the software is new, I need a different approach. Also, false positive are common for virustotal. – Vitalis Hommel Jul 31 '16 at 10:28
  • If it's not big, one can try to decompile it. If it's .NET, one can try .NET Reflector. – Aria Jul 31 '16 at 11:32
  • 2
    buy a $100 computer and test it there – dandavis Aug 1 '16 at 3:02
  • 1
    @dandavis Where do you get $100 computers and how would I know that something is safe just because it seems safe? – Vitalis Hommel Aug 3 '16 at 14:19
1

It depends how thoroughly you'd like to try them out. I'm going to assume that you're not looking to understand everything about how the application works, but are more interested in taking it for a spin without cryptolockering yourself.

My suggestion would be to use a non-networked VM. VirtualBox or Hyper-V are both free, and you can download trial versions of Windows here.

If you wanted to get a bit more thorough, you could look at outbound DNS queries from your VM for shady domains.

|improve this answer|||||
0

I will give you different solutions, from the most secure (and most expensive) to the less secure (but simplest).

  1. use a dedicated hardware machine. In corporate environments, it is common to have have some old machines waiting for being thrown to bin. Disconnect it from the network, do your tests and reinstall. At most the software was terrible and managed to physically harm the machine, but it is quite uncommon

  2. use a virtual machine with no network connection. It is almost the same as previous use case, except for 2 threats:

    • if it could harm the hardware, your real hardware was damaged, but as a virtual machine normally present virtual hardware the risk is low
    • if it contains malware directly targetted to the virtualizer that you use, anything can happen. But here again the risk is low
  3. Use a mere sandbox as sandboxie. The problem here, is that sandboxie will let you run the application in a protected environment, but as the installation has to write something to the disk, you cannot use the sandbox for the install part. That means that if the installation program installs a malware in addition to the program, you have lost

  4. Just... pray and install without further precaution. Well a bit joking, but plenty of users only do that or at best rely on last saved data.

My advice would be 1 if you can afford it, or 2. As I have seen more programs installing malware beside them than actually containing it, I would not make that difference between 3 and 4

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.