SBI 1304 Blocked Fake Keyboard Or Mouse

[TerryWood]

I am using SBoxie 3.00.09 WinXPSP2 and sometimes when I shut down Firefox or boot up firefox I get the following message:

"SBIE 1304 Blocked Fake keyboard or mouse input by process Firefox.exe"

Any ideas what this means please. Only seen it since I installed this Sboxie version.

I use the keyscrambler firefox addon, and if it is this that is causing the problem I never had it before.

Anyone suggest a solution?

Thanks

Terry

[Paul_K]

I've never seen this message with the Key Scrambler program (Pro version), Firefox 2.0.0.6 and SB 3.00.10 (just upgraded from 3.00.09), so I doubt it's Key Scrambler.
You could try turning-off Key Scrambler when Firefox is running, to see if the error message occurs. Or use Firefox's Tools/Add-ons to temporarily disable Key Scrambler so that it doesn't even startup with Firefox.

[SnDPhoenix]

Or if you're feeling lazy, you could just go to your ini and change BlockFakeInput=y to BlockFakeInput=n

[TerryWood]

Hi

Thanks for your input. I am not saying it is KeyScrambler. It was the only thing I could think of remotely connected with keyboard or mouse input.

I am loath to start blocking things until I understand why!

Is there a keylogger involved? Scans with Avira, AVG A/Spy, protection with snoopfree, Cyberhawk, Spyware Terminator says no, BUT...

Thanks


Terry

[elvis]

Same message!

I am using Sandboxie 3.00.08 XP sp2, KeyScrambler(just updated to 1.3.2 today), Comodo Firewall Pro(2.4.18.184), Cyberhawk, Snoopfree, Spybot TeaTimer, Vidalia bundle(tor, privoxy, vidalia), nod32(full version).

I got: SBIE 1304 Blocked Fake keyboard or mouse input by process 'firefox.exe'

First time I got this message.

Only things I changed: KeyScrambler just updated about 4 hours ago. Spybot updated roughly same time.

[tzuk]

It is KeyScrambler. It's faking special keystrokes, I think that's how the component inside the IE.exe/Firefox.exe process is talking to the KeyScrambler driver. But this is just a guess, I haven't really tried to understand it.

In my opinion the best approach in this case is for users of KeyScrambler to hide the message, rather than Sandboxie trying to be extra smart and guess when the faked keystroke are a result of KeyScrambler.

Edit the GlobalSettings section in your Sandboxie.ini to include:

HideMessage=1304

[TerryWood]

Hi Tzuk

Thanks for your reply.

Your solution does not work.

Still get the original error message 1304. Just to show you, here is part of my config file after your reply.

HideMessage=1304
BlockDrivers=y
BlockFakeInput=y

The ONLY THING THAT BLOCKS THE MESSAGE IS TO MAKE BlockFakeInput=n

Over to you

Terry

ps yes I did reload the config file

[dlguild]

Tzuk worked on Keyscrambler issues per this thread: http://www.sandboxie.com/phpbb/viewtopic.php?t=1851 and released version 3.00.13 to correct some compatibility issues. Make sure you are using the latest Sandboxie version and have added the following to sandboxie.ini:

OpenPipePath=\Device\NamedPipe\KSTIPipe*
HideMessage=1304

Note the debugger on my system indicated I needed to open the named pipe 'KSTIPipeDan'. I suspect 'Dan' is actually the current user, as this is my login name (or a coincidence?). However, I tried replacing it with '*' and it seems to work as well.

These settings work for me using Keyscrambler v1.3.2 under XP Pro SP2.

[TerryWood]

Thanks for that. I can confirm I am on the latest version of SBoxie. I did not have the extra bit of ini setting as below

OpenPipePath=\Device\NamedPipe\KSTIPipe*

Have now included it and will report back

Thanks again for your trouble

Terry

[TerryWood]

dlguild

I just noticed from your other thread that you also have in your ini:

BlockFakeInput=n

Currently I have this set at Y

Should I change it to N?

Thanks

Terry

[SnDPhoenix]

dlguild

I just noticed from your other thread that you also have in your ini:

BlockFakeInput=n

Currently I have this set at Y

Should I change it to N?

Thanks

Terry

Err, dude, i made the suggestion in this thread to change it to BlockFakeInput=n, i guess you just dont trust me. But yeah, i'd probably just change it to BlockFakeInput=n, as that seems to be the only (working?) fix.

[tzuk]

Your solution does not work.
Still get the original error message 1304. Just to show you, here is part of my config file after your reply.

I just tried HideMessage and it works fine. Please double-check spelling and location: HideMessage is part of the GlobalSettings section at the top of the file.

[TerryWood]

To Tzuk

Thanks for your reply. As usual you picked up on something I missed. my HideMessage was in the wrong location so I have moved it to the top of the ini file.


What I need to know is this should the ini setting BlockFakeInput be set as Y or N. a number of posts have suggested that the only workable solution is to set it to N.

But I dont think those comments took account of your HideMessage suggestion.

I just want to be sure!!

At the moment KeyScrambler 1.3.2 appears to be working OK
in that the Scrambles text is shown at the top of my web page and the input into login boxes is in English.

So is it Y or N for the record.

Thanks

Terry

[tzuk]

BlockFakeInput=Y is recommended.

With the recent mention of anti-key-logger software, I'd like to point out that BlockFakeInput is not trying to protect you from key loggers, but protect your computer from malicious software.

Its purpose is to stop malicious programs from being able to circumvent Sandboxie by broadcasting fake keystrokes, such as "Ctrl+Esc" to open the start menu, then "R" to open a folder, possibly a folder inside the sandbox, then "Ctrl+C" to copy some file from that folder, and later "Ctrl+V" to paste it somewhere else, possibly outside the sandbox.

This means that if HideMessage is enough to solve your pop up message problem, it's a good idea to keep the protection afforded by BlockFakeInput=Y.

[TerryWood]

Tzuk

Thats exactly what I was getting at.

Thanks very much a very clear reply. I think it will help others in the forum.

I will revert back to confirm if the modified ini is working OK and SBoxie is without error message 1304

Terry