SBUE2101 AlpcConnectPort / SBIE 2314 Cancl'g proc Start.exe

[ashlaj]

I cannot find this error in the Forum:
I cannot get past the SBIEctrl.exe main window to run anything "as sandboxed", without this error:

SBIE2101 Object name not found: , error AlpcConnectPort (C0000022) access=001F0001 initialized=1
SBIE2314 Canceling process Start.exe [97580 / 7]
SBIE2314 Canceling process Start.exe [97580 / 7]

Sandboxie was running fine a month or so ago. I did reboot from patches and Adobe/Java, etc updates last week.
Running WIndows 7 32-bit, Same problem from older v4,14 and the upgrade to 5.14. I even uninstalled and reinstalled.
I have Trend Micro products, MBAM/MBAE running, but never interfered before.

This would point to an error in sbieDrv.sys perhaps?
I can't find any registry entry or anything in the .ini for SBIE or templates.ini about this and am not sure where this configuration setting may be missing or in error.
The sbiesvc.exe and sbiectrl.exe are running as is the SBIEsvc service

I have created a second Sandbox and get the same errors 2101 / 2314.

[Syrinx]

Most of the search results for NTAlpcConnectPort seem to be related to rootkits or Anti-Virus software.
I've not heard of a conflict with SBIE & Trend Micro (that I recall) before but I suppose it isn't impossible one has developed. I hear good things about it so I'd be surprised if it was due to a rootkit getting past it (especially if MBAM is also in the mix) but I don't use it myself. I'll see if I can reproduce it in a VM with a trial of TrendMicro MAX and MBAM 2.x.

Initial testing done with a non-updated Win7 x86 SP1 VM.

Trend Micro Max is at version 11.0.1186
Malwarebytes Anti Malware is at version 2.2.1.1043
Malwarebytes Anti Exploit is at version 1.09.1.1261
Sandboxie is at version 5.14

Apps tested, Internet Explorer 8 and Wordpad. No issues or crashes. Haven't reproduced so far. Currently working on installing windows updates (this may take a while!) to see if anything changes after that... =(

[Syrinx]

Went through the first stage of updates already, KB3020369, KB3138612 & roll up kb3125574 but for some reason it's still taking HOURS to continue. It looks like I won't have an answer to if an update might be involved tonight. Sorry =(

As I'd be surprised to see an update being involved (and not already known) I wonder if a procmon log might be more helpful here? Or perhaps a FRST log?

[sysinfo]

After updating TM OfficeScan to version 11.0.6125 SP1 AV blocks every program launched by Sandboxie.

I had add all .exe files in Sandboxie folder in the Truster Program List of AV, but still get:

SBIE2101 Object name not found: , error AlpcConnectPort (C0000022) access=001F0001 initialized=1
BIE2314 Canceling process........

[cornflake]

I just got this error when Firefox crashed, here is what it said:
SBIE2101 Object name not found: , error AlpcConnectPort (C0000022) access=001F0001 initialized=1
SBIE2314 Canceling process crashreporter.exe [6220 / 7]

Sandboxie 5.14
Windows 7 x64

[Barb@Invincea]

Cornflake,

Which AV are you running?

All,

Does SBIE work if you disable your AV protection? Have a look at these Known Conflicts to help you set up your AV:
https://www.sandboxie.com/index.php?Kno ... 0tool-bars

http://forums.sandboxie.com/phpBB3/view ... 11&t=21539

You can try adding the following files to your AV exclusion list:
Start.exe""License.exe""SandboxieBITS.exe""SandboxieCrypto.exe""SandboxieDcomLaunch.exe""SandboxieRpcSs.exe""SandboxieWUAU.exe""SbieCtrl.exe""SbieIni.exe""SbieSvc.exe"

Regards,
Barb.-

[sysinfo]

Solved (AV issue):

I added all the .exe files (Sandboxie folder) in "Behavior Monitoring Settings" -> "Exceptions" -> "Approved Programs".

Then I removed the same .exe files previously added to the "Truster Program List" (useless)

Thank you!