Thanks spywar for your test & helping to open RejZoR's eyes, hopefully the last autosandbox skeptic has fallen
.
Autosandbox improvements in v8:User interface wasn't changed (in fact I didn't have idea how to improve it), only detection rates. As you know, autosandbox executes a suspicious process in the sandbox and logs every filesystem/registry operations, attempts to inject to different processes, modify system components, install hooks, network connections, etc etc. Avast has over 1500 generic signatures in VPS up to this day (their prefixes are Dyna:, as you can see in VPS release history). One signature usually identifies various malwares, so one malware is also usually detected by several signatures (e.g. for disabling windows update/firewall, injection, etc). Autosandbox reports 50 000 Dyna infections every day. Our viruslab analyses ~40k unique malwares every day in autosandbox and collect the logs, running on 180 virtual machines in ramdisk for 24hrs a day. In A7, malware attempts to inject itself into different processes were blocked. In A8, we duplicate & sandbox target's process on different desktop and allow injections, so malware isn't stopped early and we continue monitoring activity from the injection payload. Since we started to analyze a lot of malwares in our viruslab, every machine crash is reported to me & fixed. Autosandbox/sandbox should be therefore quite stable in A8.
