Difference in behavior on XP Pro and Home

[Unknown_User_733]

I run Sandboxie on my XP Pro and XP Home boxen and am quite happy with it.

I've noticed that when you open IE on the XP Pro box that RpcSc.exe and DcomLaunch.exe remain sandboxed even after shutting down IE. This isn't the case on my XP Home box. The contents of the sandbox are empty after shutting down IE or Firefox, which I normally use. I don't guess they are quite the security hazard they were with Win98, but it's still nice they are sandboxed.

Also, on the XP Pro box devldr32.exe remains in the sandbox while it's running, and usually has to be shut down manually when rebooting the machine even if I shut down Sandboxie first. Again this isn't the case on my XP Home box. devldr32.exe doesn't even appear in that sandbox.

Any clue as to why? It's not a problem, just a curiosity.

Thanks,
jitte

[SnDPhoenix]

hmm, im running xp pro sp2 and those 2 processes close as soon as there are no processes running anymore in the sandbox. when you close internet explorer or firefox, does they hang? cause they might be lingering processes.

[tzuk]

Yep, I agree with SnDPhoenix, probably a lingering process problem.

Lingering processes and what to do about them:

http://www.sandboxie.com/index.php?LingerProcess

[Unknown_User_733]

Thanks for your answers.

To be more specific it was SandboxieDcomLaunch.exe, SandboxieRpcSs.exe, and devldr32.exe which were the Lingering Processes. I added them to the LingerProcess section of the .ini file, rebooted, and that took care of the problem. Once other programs were shut down they disappeared from the sandbox, leaving it empty.

Thanks again,
jitte

[tzuk]

Don't put SandboxieDcomLaunch.exe and SandboxieRpcSs.exe on the LingerProcess list.

They're the ones who actually go around deleting the other lingering processes.

If you put them on the list, they may delete themselves too soon.

[Unknown_User_733]

OK, thanks for telling me.

They were still in the folder and I removed them from the .ini file.

jitte

[Unknown_User_733]

I removed SandboxieDcomLaunch.exe and SandboxieRpcSs.exe from the .ini file but left devldr32.exe listed. Now when I shut down Yahoo IM, or whatever, no other processes remain in the sandbox.

The issue seems to have resolved itself and everything is copasetic.

jitte