Symantec / Norton 360 - Unable to launch web browsers

[Barb@Invincea]

Hello all,

I installed Norton Security (trial) 22.10.1.10 on Windows 10 x64 CU.
I set Internet Explorer set as the default browser and I did not experience any issues launching it Sandboxed (either using the "Run Web browser" option, or by dragging IE to Sandboxie).

Can you please try creating a new Sandbox with default settings and see if the issue occurs there as well? (If not, delete the contents of your Sandbox and re-try).

Also, try re-setting your Norton settings to default:
Open Norton, go to "Settings" ---> Firewall Settings, hit "Use Defaults" at the top right.
Do the same for all of the other settings, reboot and re-try opening IE in a new Sandbox.

Regards,
Barb.-

[Thomas.Weinreich]

Hi Barb.-,
without time today, i quick tried two things:

1. Workarround of "deugniet" (Norton Exploit Prevention-setting. Turned it OFF ) - Result = IE and FF works fine in SB.
2. Setting everything in Norton Security to Firewall Default settings with reboot = This does not work

I will test on the weekend more....

Regards
Tom

[stonerd]

My workaround worked for 2 days, then firefox stopped launching again.

Disabled that norton firewall setting, posted on the previous page, browser is currently working again, no idea if it'll last.

[deugniet]

Did some further testing. Two laptops with the same software (IE11/Firefox 55.0.3/Sandboxie 5.20/Win10 1703 build 15063.608 x64/Norton Security v22.10.1.10): laptop A no problems sandboxing browsers with Norton Exploit Prevention ON and laptop B sandboxing browsers only works with Norton Exploit Prevention OFF.

[Thomas.Weinreich]

Make today a Norton Security Online "Live Update" and get after this a Norton Security Online patch. After i make a reboot and enable after the reboot Norton Exploit Prevention-settings - but it still does'nt work.

-> Disable Norton Exploit Prevention-settings again and all works fine

[Barb@Invincea]

Hello,

I am still unable to reproduce the issue. Did you try setting everything to default and re-testing in a new Sandbox? (not just Firewall, but every other setting).

I applied the live update (which included a patch), I rebooted the computer and ensured that Exploit Prevention was still set to "On" under Firewall --> Intrusion and Browser Protection. I launched IE as well as Firefox without issues.

Can I please get you to re-enable the Exploit Prevention option and post the results of the Resource Access Monitor? (Use the "</>" button to format it).
https://www.sandboxie.com/ResourceAccessMonitor

Also, please provide a copy of your Sandboxie configuration file: Configure--> Edit configuration
Copy-Paste the contents in your post (use the "</>" to format it).

Regards,
Barb.-

[stonerd]

Code: Select all

(Drive)     \Device\CdRom0
(Drive)     \Device\CdRom1
(Drive)     \Device\CdRom2
(Drive)     \Device\HarddiskVolume22
(Drive)     \Device\HarddiskVolume4
(Drive)     \Device\HarddiskVolume5
Clsid       -------------------------------
Clsid       {DCB00C01-570F-4A9B-8D69-199FDBA5723B} NetworkListManager
Clsid    O  {A47979D2-C419-11D9-A5B4-001185AD2B89} Network List Manager
File/Key    -------------------------------
Image       -------------------------------
Ipc         -------------------------------
Ipc         \BaseNamedObjects\__ComCatalogCache__
Ipc         \BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
Ipc         \BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
Ipc         \BaseNamedObjects\C__Program Files_Norton 360_NortonData_22.9.3.13_Definitions_IPSDefs_20170913.001
Ipc         \BaseNamedObjects\CINJR
Ipc         \BaseNamedObjects\RotHintTable
Ipc         \BaseNamedObjects\SC_AutoStartComplete
Ipc         \RPC Control\actkernel
Ipc         \RPC Control\epmapper
Ipc         \RPC Control\keysvc
Ipc         \RPC Control\OLEAE8AA6A917D6F3799BFB57C113FF
Ipc         \RPC Control\OLED986FB0670703024A841B2C7C437
Ipc         \Sessions\1\BaseNamedObjects\__ComCatalogCache__
Ipc         \Sessions\1\BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
Ipc         \Sessions\1\BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
Ipc         \Sessions\1\BaseNamedObjects\C__Program Files_Norton 360_NortonData_22.9.3.13_Definitions_IPSDefs_20170913.001
Ipc         \Sessions\1\BaseNamedObjects\CINJR
Ipc         \Sessions\1\BaseNamedObjects\ComPlusCOMRegTable
Ipc         \Sessions\1\BaseNamedObjects\DbgEng_SqmUpload_Mutex
Ipc         \Sessions\1\BaseNamedObjects\DbgEngEvent_0000110C
Ipc         \Sessions\1\BaseNamedObjects\ebad916a-992f-11e7-83ca-448a5bee0cab
Ipc         \Sessions\1\BaseNamedObjects\ef06b8b3-ab2c-11e5-82f1-448a5bee0cab
Ipc         \Sessions\1\BaseNamedObjects\RotHintTable
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_10148
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_2652
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4364
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_6908
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_7700
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_RPCSS_SXS_READY
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceCrypto_Mutex1
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_cryptsvc
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_DcomLaunch
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_Mutex1
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcEptMapper
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcSs
Ipc         \Sessions\1\BaseNamedObjects\SboxSession
Ipc         \Sessions\1\BaseNamedObjects\SC_AutoStartComplete
Ipc         \Sessions\1\BaseNamedObjects\ScmCreatedEvent
Ipc         \Sessions\1\BaseNamedObjects\WERReportingForProcess10148
Ipc         \Sessions\1\BaseNamedObjects\WERReportingForProcessComplete10148
Ipc         \Sessions\1\BaseNamedObjects\windows_shell_global_counters
Ipc      O  \BaseNamedObjects\CGSCE
Ipc      O  \BaseNamedObjects\CNDIE
Ipc      O  \BaseNamedObjects\CSECE
Ipc      O  \BaseNamedObjects\IDS_STORAGE_MUTEX
Ipc      O  \KernelObjects\LowMemoryCondition
Ipc      O  \KernelObjects\MaximumCommitCondition
Ipc      O  \KernelObjects\MemoryErrors
Ipc      O  \KnownDlls\advapi32.dll
Ipc      O  \KnownDlls\CRYPT32.dll
Ipc      O  \KnownDlls\gdi32.dll
Ipc      O  \KnownDlls\IMM32.dll
Ipc      O  \KnownDlls\kernel32.dll
Ipc      O  \KnownDlls\kernelbase.dll
Ipc      O  \KnownDlls\MSASN1.dll
Ipc      O  \KnownDlls\MSCTF.dll
Ipc      O  \KnownDlls\MSVCRT.dll
Ipc      O  \KnownDlls\NSI.dll
Ipc      O  \KnownDlls\ole32.dll
Ipc      O  \KnownDlls\OLEAUT32.dll
Ipc      O  \KnownDlls\PSAPI.DLL
Ipc      O  \KnownDlls\rpcrt4.dll
Ipc      O  \KnownDlls\SHELL32.dll
Ipc      O  \KnownDlls\SHLWAPI.dll
Ipc      O  \KnownDlls\SspiCli.dll
Ipc      O  \KnownDlls\user32.dll
Ipc      O  \KnownDlls\WLDAP32.dll
Ipc      O  \KnownDlls\WS2_32.dll
Ipc      O  \RPC Control\{2E1A49C3-61E6-4493-86DB-0E758189CBD1}
Ipc      O  \RPC Control\{99BC7C43-4E11-4904-9A1E-07B1A08754A0}
Ipc      O  \RPC Control\dhcpcsvc
Ipc      O  \RPC Control\dhcpcsvc6
Ipc      O  \RPC Control\DNSResolver
Ipc      O  \RPC Control\lsapolicylookup
Ipc      O  \RPC Control\LSARPC_ENDPOINT
Ipc      O  \RPC Control\lsasspirpc
Ipc      O  \RPC Control\SbieSvcPort
Ipc      O  \RPC Control\senssvc
Ipc      O  \Security\LSA_AUTHENTICATION_INITIALIZED
Ipc      O  \Sessions\1\Windows\ApiPort
Ipc      O  \Sessions\1\Windows\SharedSection
Ipc      O  \Sessions\1\Windows\Theme1309429082
Ipc      O  \Sessions\1\Windows\ThemeSection
Ipc      O  \ThemeApiPort
Ipc      O  \Windows\Theme2301680200
Pipe        -------------------------------
Pipe        \Device\ccSet_{0C55C096-0F1D-4F28-AAA2-85EF591126E7}
Pipe        \Device\CNG
Pipe        \Device\Harddisk0\DR0
Pipe        \Device\HarddiskVolume4
Pipe        \Device\KsecDD
Pipe        \Device\MountPointManager
Pipe        \device\namedpipe\samr
Pipe        \Device\Ndis
Pipe        \Device\NDMP146
Pipe        \Device\NDMP151
Pipe        \Device\NDMP153
Pipe        \Device\SYMEFASI
Pipe     O  \Device\Afd
Pipe     O  \Device\NetBT_Tcpip_{2E445583-A4A0-417D-8A86-3AF7C399B97D}
Pipe     O  \Device\NetBT_Tcpip_{585591AA-E04D-4E5C-8139-0767DD4D1448}
Pipe     O  \Device\NetBT_Tcpip_{773F96FA-7DBE-4A20-9C08-D06656E15E47}
Pipe     O  \Device\Nsi
WinCls      -------------------------------
WinCls   O  Shell_TrayWnd
WinCls   X  Progman

^This is what I see in the Resources Access Monitor, when the norton setting is re-enabled, and the browser fails to launch.

I can PM you my sandboxie configuration if you like as well. (its massive). However my firefox box has no special settings (force firefox and utorrent, and auto-delete box when processes terminate).... Only time I touch the configuration myself, is to specify locations of sandboxes on other drives (not browsers).

I also tried disabling addons (ad blocker, youtube downloader) but it made no difference.

[Barb@Invincea]

Hello stonerd,

Please do provide the sandboxie configuration file, I am not seeing anything specific in the Res. Acc. Mon.
Also, are you using the Norton templates in Sandboxie? (if yes, remove them, if no add them and see if that helps).

I just re-tested and still did not receive any problems.

Regards,
Barb.-

[deugniet]

@Barb

Do you want a WER.tmp.dmp of a failed sandboxed IE11?

MERGED POST
If so DM me your mail.

[Barb@Invincea]

Hello deugniet (and all) ,

Please provide the info I requested above (Sandboxie config file as well as the Res. Acc. Mon output) so that I can compare the results.

If possible, add a PML log to the mix:.
Download procmon.exe from https://docs.microsoft.com/en-us/sysint ... ds/procmon
Start procmon and reproduce the issue, then save the log and provide us the link (you will have to upload it to a file hosting website as they tend to be big files).
If you do not want to post the link here, you can send it to support@sandboxie.com

For the rest of the required information, please either post it in your response, or send me a PM.

Regards,
Barb.-

[deugniet]

Sent you a mail via support@sandboxie.com. PML-logfile is 14 megabyte. Hope this helps.

[Barb@Invincea]

deugniet,

Thank you for your PMs and emails, the devs have been reviewing them and would like to request the wer.tmp file now (you can send it to support@sandboxie.com if you do not want to post it here).

The specific file/location they want is:
Drive:\Sandbox\<username>\DefaultBox\user\all\Microsoft\Windows\WER\Temp\WERDDA1.tmp.dmp

We are still unable to reproduce the issue so any additional information will be appreciated.

Also, if anybody gets a chance to reinstall Norton and see if that helps, it would be appreciated.

Regards,
Barb.-

[deugniet]

@Barb

Reinstalled NS v22.10.1.10. For now I can sandbox both browsers (Firefox 55.0.3 and IE11) with Norton Exploit Protection ON. Sandboxie v5.21.2.

[wanghong01]

Hello,

I am still unable to reproduce the issue. Did you try setting everything to default and re-testing in a new Sandbox? (not just Firewall, but every other setting).

I applied the live update (which included a patch), I rebooted the computer and ensured that Exploit Prevention was still set to "On" under Firewall --> Intrusion and Browser Protection. I launched IE as well as Firefox without issues.

Can I please get you to re-enable the Exploit Prevention option and post the results of the Resource Access Monitor? (Use the "</>" button to format it).
https://www.sandboxie.com/ResourceAccessMonitor

Also, please provide a copy of your Sandboxie configuration file: Configure--> Edit configuration
Copy-Paste the contents in your post (use the "</>" to format it).

Regards,
Barb.-

Hello, sorry I do not speak English, I am using Google Translator:

My SEP also appeared on this issue, I found the problem is SEP updated the latest "LiveUpdate" after the emergence of this problem, only the common browser can not open, the other can.

[deugniet]

@Barb

I have another laptop with the same problem. So two laptops affected and one works fine. Maybe caused by (a corrupted?) Norton LiveUpdate? I'll reinstall NS asap.