Sandboxie Support

Re: Buster Sandbox Analyzer

2016-07-25T07:38:52-04:00

Thread is closed.

Statistics: Posted by Craig@Invincea — Mon Jul 25, 2016 7:38 am

Re: Buster Sandbox Analyzer

2016-07-25T07:38:19-04:00

sfinktah wrote:Okay, we're up to Sandboxie 5.12 now, and Explorer.exe still will not open.

I'm not even sure where one would find version 3.76 anymore, whether it would work in Windows 10 x64, and how many exploits it contains.

If you have the source code for your LOG_APP DLLs, I am happy to take a look at them.

3.76 should not be used. It's deprecated, old, and has been removed. This thread is long since closed and Busters SB Analyzer is the sole property of Buster, who is no longer on this board.

3.76 and anything up to 5.05 will NOT work after the Oct 2015 Windows update (Patch Tuesday).
only v5 and up works with Windows 10.

Statistics: Posted by Craig@Invincea — Mon Jul 25, 2016 7:38 am

Re: Buster Sandbox Analyzer

2016-07-13T09:58:10-04:00

Okay, we're up to Sandboxie 5.12 now, and Explorer.exe still will not open.

I'm not even sure where one would find version 3.76 anymore, whether it would work in Windows 10 x64, and how many exploits it contains.

If you have the source code for your LOG_APP DLLs, I am happy to take a look at them.

Statistics: Posted by sfinktah — Wed Jul 13, 2016 9:58 am

Re: Buster Sandbox Analyzer

2015-09-28T12:29:34-04:00

I run bsa.exe
Start Analysis
I see a window "windows title does not match with LOG_API srting or Sandboxie has running processes"

Sandboxie.ini
InjectDll=C:\bsa\LOG_API\LOG_API32.DLL

why?

Statistics: Posted by exec86 — Mon Sep 28, 2015 12:29 pm

Re: Buster Sandbox Analyzer

2015-09-12T19:41:00-04:00

Buster wrote:
bjm wrote:Hello
Just found Buster Sandbox.
Are the Installation and usage instructions at http://bsa.isoftware.nl/1.88 okay with 4.16
Why no Template
I recommed using Sandboxie 3.76.

Do you anticipate a recommendation of a higher 4+ version anytime in the near future? What's the current reasoning for recommending v3.76?

(I remember you mentioned it's because of some changes to v4+, but can't remember specifics)

Statistics: Posted by Coldblackice — Sat Sep 12, 2015 7:41 pm

Re: Buster Sandbox Analyzer

2015-04-18T13:32:07-04:00

Thank you...interesting = 3.76

Statistics: Posted by bjm — Sat Apr 18, 2015 1:32 pm

Re: Buster Sandbox Analyzer

2015-04-18T09:16:09-04:00

bjm wrote:Hello
Just found Buster Sandbox.
Are the Installation and usage instructions at http://bsa.isoftware.nl/1.88 okay with 4.16
Why no Template

I recommed using Sandboxie 3.76.

Statistics: Posted by Buster — Sat Apr 18, 2015 9:16 am

Re: Buster Sandbox Analyzer

2015-04-18T03:10:48-04:00

Hello
Just found Buster Sandbox.
Are the Installation and usage instructions at http://bsa.isoftware.nl/1.88 okay with 4.16
Why no Template

Statistics: Posted by bjm — Sat Apr 18, 2015 3:10 am

Re: Buster Sandbox Analyzer

2015-03-08T07:57:09-04:00

k123 wrote:I'm not sure I am posting in the right place, so please let me know if I should post this somewhere else. I am using BSA with sandboxie 4.16 on windows 7 x64. I get a high risk alert when opening a Microsoft word docx file, but the strange thing is all the analysis seems to be related to McAfee Site Advisor, which is listed as the . I'm not sure why this is involved in opening a word document.
CODE:
[ General information ]   * File name: C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe   * File length: 155368 bytes   * File type: Unknown   * MD5 hash: 2d94efdd340bbd9de7d5f627b298512d   * SHA1 hash: 7363517c09aa17b3c46ddf8f00bd4e987701db42   * SHA256 hash: a9de485352616a37dfd32270bbb65ca15b34cf26394a9418a5182801569aebcd
I'm not sure if this is a) normal on a computer running McAfee, even when just opening a Word document, b) Something wrong with my BSA/Sandboxie setup or usage, or c) malware.

Thanks for the great tool and any feedback -Danny

You should not have installed software that may interfere with analysis. McAfee would be an example.

Statistics: Posted by Buster — Sun Mar 08, 2015 7:57 am

Re: Buster Sandbox Analyzer

2015-02-21T15:41:31-04:00

I'm not sure I am posting in the right place, so please let me know if I should post this somewhere else. I am using BSA with sandboxie 4.16 on windows 7 x64. I get a high risk alert when opening a Microsoft word docx file, but the strange thing is all the analysis seems to be related to McAfee Site Advisor, which is listed as the . I'm not sure why this is involved in opening a word document.

CODE:

[ General information ]   * File name: C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe   * File length: 155368 bytes   * File type: Unknown   * MD5 hash: 2d94efdd340bbd9de7d5f627b298512d   * SHA1 hash: 7363517c09aa17b3c46ddf8f00bd4e987701db42   * SHA256 hash: a9de485352616a37dfd32270bbb65ca15b34cf26394a9418a5182801569aebcd

I'm not sure if this is a) normal on a computer running McAfee, even when just opening a Word document, b) Something wrong with my BSA/Sandboxie setup or usage, or c) malware.

Thanks for the great tool and any feedback -Danny

Statistics: Posted by k123 — Sat Feb 21, 2015 2:41 pm

Re: Buster Sandbox Analyzer

2015-02-17T11:11:13-04:00

I also have problems with Sandboxie 3.76 and BSA 1.88 rev 4 and log_api64.dll from 2014-05-19.

When running installations (MSI or setup.exe) I get the following error:
"Windows installer service could not be accessed" (error 1603)

If I only use log_api32.dll the installation starts but gives the error 1603 later in the installation process (registration?) but I dont get the "installer service" error text..
(One example is the installation of Attachmate Reflection Pro 2014 (x64) - Evaluation)

If I don't use injectdll the installation complete successfully and BSA can do a report, but I miss the API Call Log....

Just want to give some feedback to the forum. Thanks for the software so far!
Regards
//Sigtrap

Statistics: Posted by sigtrap — Tue Feb 17, 2015 10:11 am

Re: Buster Sandbox Analyzer

2014-09-27T18:41:25-04:00

Buster wrote:
Curt@invincea wrote:If I understand correctly, the only remaining issue with BSA is the SaveAs dialog? Everything else is working?

The problem is this is a Windows dll bug. It is going to require further analysis and we have several higher priority issues right now.
As far as I know there are two remaining issues with BSA:

- The SaveAs dialog crashes.

Maybe meanwhile a final solution can not be provided you could include a workaround at next beta version and avoid DLL injection to duser.dll. What do you think?

- Sandboxie returning path to real folder when using NtQueryInformationProcess API.

This issue is supposed to be fixed in Beta version 4.13.2, right? When is it going to be released?

Any update on this Curt?

Statistics: Posted by Coldblackice — Sat Sep 27, 2014 6:41 pm

Re: Buster Sandbox Analyzer

2014-07-29T04:22:14-04:00

eeeeeeeeeeeeeeeeeeoooooooooooooooooooooooooooooooo!!!

Statistics: Posted by Buster — Tue Jul 29, 2014 4:22 am

Re: Buster Sandbox Analyzer

2014-07-22T05:59:48-04:00

Curt@invincea wrote:If I understand correctly, the only remaining issue with BSA is the SaveAs dialog? Everything else is working?

The problem is this is a Windows dll bug. It is going to require further analysis and we have several higher priority issues right now.

As far as I know there are two remaining issues with BSA:

- The SaveAs dialog crashes.

Maybe meanwhile a final solution can not be provided you could include a workaround at next beta version and avoid DLL injection to duser.dll. What do you think?

- Sandboxie returning path to real folder when using NtQueryInformationProcess API.

This issue is supposed to be fixed in Beta version 4.13.2, right? When is it going to be released?

Statistics: Posted by Buster — Tue Jul 22, 2014 5:59 am

Re: Buster Sandbox Analyzer

2014-07-21T23:11:30-04:00

If I understand correctly, the only remaining issue with BSA is the SaveAs dialog? Everything else is working?

The problem is this is a Windows dll bug. It is going to require further analysis and we have several higher priority issues right now.

Statistics: Posted by Curt@invincea — Mon Jul 21, 2014 11:11 pm