Returnil Premium is a program that can emulate the operating system in a sandbox – a virtual environment – so that changes have no effect on the system itself but only to the sandboxed copy of it. It does not require lots of computer knowledge to run, the only thing that’s out of the ordinary is the (optional) creation of a virtual partition that will be used to store data when the sandbox is active. Here are the steps on how to use the security software:

• Installation: You get some options here most notable to run the system on the hard drive or computer memory. There is also the optional setting to create a virtual partition on the computer system to store data. An alternative would be to use online storage space.
• Running Returnil: You can start Returnil after a restart. Once Returnil is started it will redirected access to the virtual system so that the actual computer system will not be harmed. You can then use whatever application you like. Keep in mind that any changes that have been made to the computer system will be undone after a restart as they have only been made in the virtual system and not the actual one. Here is an example:

  If you bookmark a page while Returnil is running it will show up in the bookmark manager. It will however be gone after a restart of the system.

• Stopping Returnil: The only way to stop Returnil is to reboot the computer system.
• Saving Data: Two ways to save data. The first is to use the virtual partition to store the data on as it will not be erased after a reboot on that partition. The second is by utilizing online storage space. You can sync bookmarks online, save files there, edit Word documents and basically do most things online.

How does Returnil work?

It is obvious that Returnil cannot mirror dozens of Gigabytes of data in the sandboxed environment. There is actually no need to clone the whole system. All that needs to be done is to keep track of the changes to the system and act as a proxy between the computer system and the virtual system.

What are the differences between the free and the premium version of Returnil?

The premium version of Returnil adds quite a few features that make it interesting. The user can choose to cache data in the computer memory or on the hard drive, save sessions to continue working with them at a later point, relocate system folders, to browse and move files between the real hard drive and the virtual drive, shell integration and free customer support.

Returnil Premium adds much needed features to the virtualization software that are missing in the free version. The main benefit of both versions is the simplicity of usage. You only need to press one button to turn the protection on once it has been configured the way you want.

Remember, you can request your Returnil Premium key by following the link on top. Would be still nice to tell us what you think of it.

Related posts

• Software Virtualization With SafeSpace (10)
• Free Returnil Virtual System Premium Edition (0)
• Xenocode Web Browser Sandbox (0)
• Ulteo Virtual Desktop (10)
• System Virtualization With MokaFive (6)

The software has been designed to discover communication patterns that are typical for malware infected computers. While Bothunter has been designed as a network security software that can analyze the traffic of the network it can also be used to analyze a single computer or basic home network.

Bothunter is supplied as a Linux or Windows version. The Linux version comes as a installation but also in form of a live CD that can be used from any computer that is capable of booting from CD and compatible with Ubuntu Linux.

Bothunter needs some configuration in the beginning. Most home users will only need to enter the local network IP which they can discover this way:

Click the Windows desktop Start Menu, Control Panel, Network Connections. Find the local area connection that is “Connected”. Double click the connected network icon. Click the Support Tab. Your IP address will be listed.

Optional data like the IP address of SMTP servers or DNS servers can be entered if they are used in the computer network. Home users usually leave these information blank. The only other information needed is the network adapter that should be used to scan and analyse the computer network.

Once that is done the network security software will scan the computer network in two minute intervals and display any potential bot infection in the interface.

Related posts

• Computer Security Software ESET SysInspector (3)
• Windows Vulnerability Scanner (4)
• Windows Process Blocker SPKiller (1)
• Windows Process Blocker (9)
• Use Wireshark to track your network behavior (3)

ESET SysInspector does that by scanning the computer’s hard drive and Registry. It assigns a risk level to every item that has been analyzed which ranges from fine (1) to risky (9) with three always bundled together. Risk levels 1 to 3 are assigned to files that have passed the check, 4-6 for unknown files and 7-9 for files that have been identified as being risky. The different levels are also colored differently (from green to red) to make identification as quickly as possible.

The computer security software will build a report that provides access to eight different categories including Running Processes, Network Connections or Important Registry Files. Each category is displayed in the color of the item with the highest risk level that it contains. That’s excellent for identifying the highest risks with one glance without having to look at the actual items at that time.

Opening a category can reveal subcategories or items. Each item is (again) listed in a color that depicts its risk level. Some categories can contain dozens of items and the risk level slider at the top helps reducing the amount of items displayed by selecting a minimum risk level to be displayed. Every item with a lower risk level will be hidden from the display so that the system administrator can concentrate on the higher risk items.

A higher risk level does not necessarily mean that an item is dangerous. That would be subject to further analysis. ESET SysInspector is providing some tools and shortcuts for this. A right-click on an item will open a context menu with options to open the path in the Windows Registry or to open the file’s location on the computer’s hard drive. There is also the possibility to perform an online search using the default web browser and the Google search engine.

A set of reports can be created that contain various level of information. One interesting feature is the ability to compare logs which can give additional clues on system changes in a time period.

Related posts

• Secure Windows Services Configuration (2)
• Ghacks Christmas Giveaway: Sandboxie (123)
• Windows Registry Watcher (5)
• Windows Process Blocker SPKiller (1)
• Windows Process Blocker (9)