Sandboxie RpcSs: Could not instrument service functions

[exciteduser]

Hello,

I have been using Sandboxie for a few years overall and for roughly 16 months on my Win8.1 machine. It has been working great but since today some hooks and the RPC component don't work anymore. When starting a program in any sandbox, the following messages come up:

SBIE2303 Kein Hook möglich für PowerSettingRegisterNotification (1)
SBIE2204 Der Dienst 'RpcSs (-1)' konnte nicht in der Sandbox gestartet werden

In most cases, a window titled "Sandboxie RpcSs" saying "Could not instrument service functions" appears as well.

I am using Sandboxie 4.20 on Win8.1 with AVG.

If I try to start a program via one of the context menu options (e.g. start program, start browser, start via start menu...), via the explorer integration (start in sandbox) or a program in a folder which has been configured to always run in a sandbox ("Erzwungene Ordner", probably "enforced folders" in english), it does not start at all. Other programs which are installed within a sandbox can be started but crash or hang whilst producing the above messages.

This is the output of the resource monitor:

Code: Select all

(Drive)     \Device\CdRom0
(Drive)     \Device\HarddiskVolume5
(Drive)     \Device\HarddiskVolume6
(Drive)     \Device\HarddiskVolume7
(Drive)     \Device\TrueCryptVolumeZ
Clsid       -------------------------------
File/Key    -------------------------------
Image       -------------------------------
Image       *:\program files\sandboxie\sandboxierpcss.exe
Image       *:\program files\sandboxie\start.exe
Image       c:\program files (x86)\avg\avg2015\avghooka.dll
Image       c:\program files\sandboxie\sbiedll.dll
Image       c:\windows\system32\advapi32.dll
Image       c:\windows\system32\combase.dll
Image       c:\windows\system32\comdlg32.dll
Image       c:\windows\system32\gdi32.dll
Image       c:\windows\system32\imm32.dll
Image       c:\windows\system32\kernel32.dll
Image       c:\windows\system32\kernelbase.dll
Image       c:\windows\system32\msctf.dll
Image       c:\windows\system32\msvcrt.dll
Image       c:\windows\system32\nsi.dll
Image       c:\windows\system32\ntdll.dll
Image       c:\windows\system32\ole32.dll
Image       c:\windows\system32\psapi.dll
Image       c:\windows\system32\rpcrt4.dll
Image       c:\windows\system32\sechost.dll
Image       c:\windows\system32\shcore.dll
Image       c:\windows\system32\shell32.dll
Image       c:\windows\system32\shlwapi.dll
Image       c:\windows\system32\user32.dll
Image       c:\windows\system32\ws2_32.dll
Image       c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.17810_none_34ae2abd958aedeb\comctl32.dll
Ipc         -------------------------------
Ipc         \RPC Control\epmapper
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_3608
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4884
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_RPCSS_SXS_READY
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_Mutex1
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcSs
Ipc      O  \KnownDlls\advapi32.dll
Ipc      O  \KnownDlls\COMDLG32.dll
Ipc      O  \KnownDlls\gdi32.dll
Ipc      O  \KnownDlls\kernel32.dll
Ipc      O  \KnownDlls\kernelbase.dll
Ipc      O  \KnownDlls\MSCTF.dll
Ipc      O  \KnownDlls\MSVCRT.dll
Ipc      O  \KnownDlls\NSI.dll
Ipc      O  \KnownDlls\ole32.dll
Ipc      O  \KnownDlls\PSAPI.DLL
Ipc      O  \KnownDlls\rpcrt4.dll
Ipc      O  \KnownDlls\SHELL32.dll
Ipc      O  \KnownDlls\SHLWAPI.dll
Ipc      O  \KnownDlls\user32.dll
Ipc      O  \KnownDlls\WS2_32.dll
Ipc      O  \RPC Control\SbieSvcPort
Ipc      O  \Sessions\1\Windows\SharedSection
Pipe        -------------------------------
Pipe        \Device\AVGIDS_Ioc2
WinCls      -------------------------------

I tried rebooting without success. The problem only appears to occcur when AVG is enabled. I temporarely disabled AVG and was able to use Sandboxie as usual. I am using AVG 2015.0.6125.

As this seems to be a compatibility issue between AVG and Sandboxie, is there any advise? Do I have to give up either of them? Is this a known problem? Can I do anything to avoid this issue?

Thanks for your time and help!

[Craig@Invincea]

If disabling AVG allows SBIE to work, I'd say that's the issue. We've had success with it in the past, maybe an update could've have done something. We can take a look. I would also have your try v5.02RC to address some of the related issues before you disable / remove AVG and try again.

[exciteduser]

Thank you for the quick answer!

I would also have your try v5.02RC to address some of the related issues before you disable / remove AVG and try again.

The changes in 5.01.11 and 5.01.12 sound very promising. I will try it tomorrow and report here. I guess the builds are stable enough to not think about downgrading later?

[Craig@Invincea]

Thank you for the quick answer!

I would also have your try v5.02RC to address some of the related issues before you disable / remove AVG and try again.

The changes in 5.01.11 and 5.01.12 sound very promising. I will try it tomorrow and report here. I guess the builds are stable enough to not think about downgrading later?

Try the release that was just posted.

[exciteduser]

Thank you for the quick answer!

I would also have your try v5.02RC to address some of the related issues before you disable / remove AVG and try again.

The changes in 5.01.11 and 5.01.12 sound very promising. I will try it tomorrow and report here. I guess the builds are stable enough to not think about downgrading later?

Try the release that was just posted.

I upgraded to Sandboxie 5.03.2 (64-bit) but the problem persists. AVG updated itself to 2015.0.6140 so I guess one of its previous silent updates broke compatibility with Sandboxie. Can I provide any additional debugging information?

[Curt@invincea]

Did you add Program Files\Sandboxie to the list of exclusions in AVG?

[exciteduser]

Did you add Program Files\Sandboxie to the list of exclusions in AVG?

Thank you so much! This actually solved it! Such a simple trick, why didn't I think of it? I guess this is a valid solution, thank you for your support! I am so glad I purchased Sandboxie, your team does not disappoint!