www.sandboxie.com :: Post a reply

www.sandboxie.com Forum Index » Contributed Utilities » Post a reply

Post a reply

Username

Subject

Message body

Emoticons





View more Emoticons

Font colour: Font size:

Close Tags

[quote="Buster"]I edit the first post to include information about where to download the tool.

Official site is:

http://bsa.isoftware.nl

And the tool can be downloaded from:

http://bsa.isoftware.nl/bsa.rar

--- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x ---

Hi.

As commented already I decided to change the name of my tool because the purpose of it changed.

The tool will now be named [b]Buster Sandbox Analyzer[/b] or BSA to short it.

The main goal of the tool will be to analyze the behaviour of sandboxed processes and decide if the the changes made to system may be malware suspicious.

It can also be used just to check what changes (files and registry) were made in the system.

[i]Instructions to run BSA[/i]:

Of course, in order to run BSA Sandboxie must be installed and running properly.

BSA does not require installation. Just create a folder and copy BSA.EXE and BSA.DAT inside.

When you run BSA you can see this:

[img]http://img413.imageshack.us/img413/292/38465994.jpg[/img]

To start working with the tool you just need to specify with what Sandbox folder you will work. You must specify the complete path to the sandbox folder. e.g. for the DefaultBox would be something like:

C:\Sandbox\ExampleUser\DefaultBox

You only will have to specify the sandbox path one time. When you close BSA the program automatically will remember the used sandboxes. This information will be stored under \CONFIG folder with the name BSA.INI.

The [b]sandbox folder must exist and must be empty[/b]. BSA will check that both conditions are accomplished and if any of them is not BSA will warn about it.

When you are ready to start working with the tool press "Start" button. If the sandbox folder exists and the folder is empty BSA will be ready for next step.

After pressing "Start" two buttons get enabled.

Now it´s the [b]moment to sandbox whatever you want[/b].

If you are interested in getting port differences press "Check Ports" button if not just skip it.

When you are done [b]terminate all sandboxed processes[/b] and then click "Find Differences".

If Sandboxie is still in use BSA will warn about that.

At this point if you are only interested in getting the changes made to system you can quit BSA. You will find FileDiff.TXT, RegDiff.TXT and PortDiff.TXT (when available) at BSA´s folder.

You can open those files with any text editor because they are in plain text.

If you are interested in the malware analysis click the button.

BSA will perform several checks to the changes made to system looking for malware behaviour.

At the moment some of the checks are not available.

When you close malware analyser results of the analysis will be saved to ANALISIS.TXT.

On next message I will explain the exclusion list, the BSA.DAT format and the file differences format.[/quote]

Options
HTML is OFF
BBCode is ON
Smilies are ON

Disable BBCode in this post
Disable Smilies in this post

If you are visually impaired or cannot otherwise read this code please contact the Administrator for help.

Confirmation code: *
Enter each of the characters that you see.

All times are GMT

Topic review