Problem with RegHive while deleting sandbox contents

[bz-mof]

Hello!

I use Sandboxie 3.56 on WinXP SP3 32-bit with Firefox 3.6.18. No changes made to the Default Sandbox.

When I try to delete the contents of this Sandbox, it takes some seconds to think abount and than throws me an "Sandboxie Start [some text] System error: Access Denied (5)" and does not change anything.

While trying to delete the sandbox manually I figured out, that the RegHive is still in use. MS's Process Explorer shows me, that RegHive is used be "System (ID 4)". A restart does not change anything. After I unload this Hive manually (via regedit, "Unload Hive" on HKEY_USERS\Sandbox_Def...), Sandboxie can delete the Sandbox.

But when I start the Default Sandbox again, it raises several error messages, i.e. "Could not initialise WinSock" and "SBIE2204 RpcSs(-1) could not be startet in sandbox". A manual restart of the Sandbox Service does not change anything, only a complete restart of my system helps.

Any ideas?

[tzuk]

Usually that kind of a problem is due to a conflict with some other software which prevents Sandboxie from unmounting the registry hive when it needs to. It's hard to identify which software it is because, as you've noted, the owner of the reghive is always the "System".

[bz-mof]

Addendum:
Today a reboot stashed the "Access Denied (5)" message away. Directly after boot-up I started Sandboxie Control and could delete the contents of the mentioned sandbox.

@tzuk:
As I have not much software/services running (mainly drivers and indexing service (Sandbox folder excluded), but even no graphics control center or office/acrobat fast starters), I guess it must be my antivir, Sophos. Although I disabled it for testing, it could have installed a hook (or something similar) that is not compatible with Sandboxie.

[Buster]

From time to time I have the same "Access Denied (5)" problem but I am unable to reproduce it consistently.

I do not have any software that may prevent Sandboxie from deleting sandbox folder contents. I would say there is some strange situation where Sandboxie itself does not free the lock on RegHive.

[bz-mof]

Hi!

I now solved this problem and can delete the contents of my Sandbox every time with the following steps:


(pre-condition: "access denied (5) error appeared during revious try to delete the contents)

1) Close all programs in the Sandbox
2) Start regedit
3) Navigate to HKEY_USERS
4) Find folder named "Sandbox_<username>_<Sandbox name>" and select it (i.e. if username is "mof" and the name of the Sandbox shown in Sandboxie Control is "Sandbox temp" this would be "Sandbox_mof_temp"
5) File -> Unload Hive (Struktur Entfernen)
6) Close Regedit
7) Delete Contents of Sandbox within Sandboxie Control
8) Create a new Folder within your Sandboxie path called "<Sandbox name>" (i.e. "temp" like above)
9) Create a new Hive within this folder by creating a new empty file and naming it "RegHive." (no file extension)
10) Start Regedit again and load this file as a hive into HKEY_USERS, name it the same as it was before like "Sandbox_<username>_<Sandbox name>", i.e. "Sandbox_mof_temp"
11) Start a program in your sandbox. If no WinSock error appears, everything was made correct.

[RandomBloke]

I've installed yourfreedom and openvpn.Then, I ran them with sandboxie. Not long after, I couldn't run any program with sandboxie.

After looking for a solution the whole day, I finally found the answer for SBIE2204 and Couldn't Initialize Winsock.

Needless to say, bz-mof's solution works like a charm!

There's another alternative to do this, it might be redundant though.

Instead of going through the regedit and the unload hive technique,

One can go to the "Sandbox_<username>_<Sandbox name>" e.g Sandbox_Adam_DefaultBox which would be located in C:\Sandbox\Adam\DefaultBox and delete the RegHive file directly.

In addition, you can check the problematic file by checking the date created and modified. e.g, my sandboxie had problem today so I discriminated the out dated created file and focus on the current date.

Thus allowing me to keep the Contents of Sandbox within Sandboxie Control.

Last but not least, thank you bz-mof, tzuk and the others(sorry don't know all of you ) that have contributed in the progress of sandboxie.
Keep up the good work!

[bz-mof]

Just for the archives: In the recent versions of Sandboxie this problem seems to be fixed, at least it does not occur anymore since at least a year now. I am using 5.06 at the moment.

P.S.: Very late, but thank you, RandomBloke, for the compliment!

[Craig@Invincea]

Just for the archives: In the recent versions of Sandboxie this problem seems to be fixed, at least it does not occur anymore since at least a year now. I am using 5.06 at the moment.

P.S.: Very late, but thank you, RandomBloke, for the compliment!

Thanks. However, this issue was never addressed. The most current stable version is 5.10 for the past 6 months.