Official site is:
http://bsa.isoftware.nl
And the tool can be downloaded from:
http://bsa.novirusthanks.org/downloads/bsa.rar
http://www.woodmann.com/virusbuster/bsa.rar
Actual version: 1.88
MD5: 32d92812f399da48e61ca810b09f11fc
Version: 1.88 Update 4 [Released 24/04/2014]
http://www.woodmann.com/virusbuster/bsa ... date_4.rar
--- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x --- x ---
Hi.
As commented already I decided to change the name of my tool because the purpose of it changed.
The tool will now be named Buster Sandbox Analyzer or BSA to short it.
The main goal of the tool will be to analyze the behaviour of sandboxed processes and decide if the the changes made to system may be malware suspicious.
It can also be used just to check what changes (files and registry) were made in the system.
Instructions to run BSA:
Of course, in order to run BSA Sandboxie must be installed and running properly.
BSA does not require installation. Just create a folder and copy BSA.EXE and BSA.DAT inside.
When you run BSA you can see this:
To start working with the tool you just need to specify with what Sandbox folder you will work. You must specify the complete path to the sandbox folder. e.g. for the DefaultBox would be something like:
C:\Sandbox\ExampleUser\DefaultBox
You only will have to specify the sandbox path one time. When you close BSA the program automatically will remember the used sandboxes. This information will be stored under \CONFIG folder with the name BSA.INI.
The sandbox folder must exist and must be empty. BSA will check that both conditions are accomplished and if any of them is not BSA will warn about it.
When you are ready to start working with the tool press "Start" button. If the sandbox folder exists and the folder is empty BSA will be ready for next step.
After pressing "Start" two buttons get enabled.
Now it´s the moment to sandbox whatever you want.
If you are interested in getting port differences press "Check Ports" button if not just skip it.
When you are done terminate all sandboxed processes and then click "Find Differences".
If Sandboxie is still in use BSA will warn about that.
At this point if you are only interested in getting the changes made to system you can quit BSA. You will find FileDiff.TXT, RegDiff.TXT and PortDiff.TXT (when available) at BSA´s folder.
You can open those files with any text editor because they are in plain text.
If you are interested in the malware analysis click the button.
BSA will perform several checks to the changes made to system looking for malware behaviour.
At the moment some of the checks are not available.
When you close malware analyser results of the analysis will be saved to ANALISIS.TXT.
On next message I will explain the exclusion list, the BSA.DAT format and the file differences format.
