You are alerting on the first condition you described being met.  It also sounds like in this case, you want to use OR, not AND since someone could pick the tool = box but not the URL, and vice-versa.  If the url is the type of URL you may need to force it to a string before using the indexOf function - can't hurt in any event, and this also accounts for 'box' in any case:

function onSubmit() {
    if (g_form.getValue('select_the_tool') != 'box' || g_form.getValue('url_of_file_sharing_site_zscaler').toString().toLowerCase().indexOf('.box.') == -1) {
        alert('Make sure the URL to unblock is related to Box or select the tool as "Other" to proceed.');
        return false;
     }
}

If it's still not working the way you are expecting, verify the field/variable names and values are exactly correct and alert on the two getValues to find out why each condition is or is not being met with your test case.