Buster Sandbox Analyzer: Installation and configuration.

http://www.youtube.com/watch?v=MXASXoq5akc

Buster: Kobayashi: I miss the Buster Sandbox Analyzer reports.

Yes, you are right !
After a big infection of my computer I changed some settings of it.
I do not run in admin account anymore as before with user account control turned off, but instead I run in a standard user account and turned on again user account control.
Then I started to get I/O error 32
I have not yet solved this problem.

I sent you a mail.

Released Buster Sandbox Analyzer 1.49.

Changes:

+ Added support for XML reports
+ Added support for TLS hooks detection
+ Improved PDF Statistics
+ Updated LOG_API verbose versions to include FindFirst/NextFile support
+ Updated support for new VirusTotal web service
+ Fixed several bugs

The problem was that "DefaultBox" folder was created from an account with admin rights. When BSA runs from a standard user account it will not have the rights to access folder contents, so it will not run fine.

The solution is deleting "DefaultBox" folder from the account having admin rights and switching to standard user account, so when Sandboxie creates the folder, BSA will have the rights to access the contents.

Released Buster Sandbox Analyzer 1.50.

Changes:

+ Added multi-language support
+ Updated LOG_API
+ Fixed several bugs

If anyone translates BSA to other language it would be cool if he sends me it so I include it in the package.

Released Buster Sandbox Analyzer 1.51.

Changes:

+ Added a custom driver to hide Sandboxie´s processes
+ Removed Hide Driver from package
+ Included new malware behaviour
+ Added File Renamer feature to utilities section
+ Updated LOG_API

HideDriver has been removed from package. I have included a custom driver to hide Sandboxie´s processes. This driver can be installed and started by Buster Sandbox Analyzer on demand or automatically.

In order to get the driver working, Buster Sandbox Analyzer must have admin rights.

The driver (BSA.SYS) can be renamed for security purposes to any name.

At least one antivirus vendor detects as malicious the driver. I would be grateful if you submit the driver to those vendors detecting the driver so they remove the false positive.

If anyone has any questions about this or any of the new features (File Renamer) just post a message.

Released Buster Sandbox Analyzer 1.52.

Changes:

+ Added support for HTML reports
+ Added a feature to remove sandbox folder contents automatically in manual mode
+ Included new malware behaviour
+ Updated LOG_API
+ Fixed several bugs

Here there is the complete list of antivirus that reports this file as malware:
https://www.virustotal.com/file/fc3dec19ba7387874099565192fd3ec28aeb396fc33f18275ac9c3d306237a1e/analysis/

Currently I submitted detailed false positive reports to: AntiVir, AVG, Microsoft, Comodo, Fortiguard, VirusBuster.

Hello,

Is it possible to include accessed resources (i.e. read files/registry entries) in the reports or would that crowd the report too much?

As you say, that would crowd the report too much, so when I designed the tool I decided I would not include that stuff.

Anyway you could use the verbose version of LOG_API.DLL and get readed registry entries from LOG_API.TXT. And if you want I could make a special LOG_API version that also logs readed files for you. With such LOG_API.DLL version would be easy to make a program that parses LOG_API.TXT and produces a file logging readed files/registy entries.

Yes, it would be excellent to have an alternative for files and registry entries that a sandboxed application reads. Thank you!

Unrelated: just thought I should mention, if a user has a 2 screens setup, with the primary screen to the right side, BSA positions itself offscreen (only half of the BSA GUI is visible on the main screen). That's not an issue nor an annoyance for me as I can use a window manager to automatically position BSA centered on my main screen at startup, but I don't know about others.

No problem, I will make a custom version for you.

Do you want the 32 or the 64 version of the DLL?



Place BSA in the position you prefer and then enable:

Options > Program Options > Remember Window Position