KB4058258/KB4074588 -Win 10 FCU x86 --dllhost.exe / sbiedll.dll initialization fail [Fixed in beta 5.23.6]

[VitsKip]

Receive today pop-up error box:

Header:
dllhost.exe - DLL Initialization Failed

Content:
Initialization of the dynamic link library C:\Program Files\Sandboxie\SbieDll.dll failed. The process is terminating abnormally.

I suspect this possible is caused by a windows update, flash player update, antivirus update or similar as Sandboxie have been working for many years without any problems.

My OS is Windows 10 Pro and I use Avast antivirus.

I have tried disable Avast and have also installed newest Sandboxie Beta 5.23.5

The error box appear every time Sandboxie / a program needs to use dllhost.exe

Any advice ?

[Barb@Invincea]

Hello VitsKip ,

Are you using any restrictions (especially anything blocking program for starting in the sandbox)?
Have a look at this thread:
viewtopic.php?f=17&t=24994&hilit=dllhost.exe

Otherwise, please let us know if the issue follows you to a new Sandbox with default settings.

Regards,
Barb.-

[VitsKip]

No restrictions at all.

The problem appeared out of nowhere using official release of sandboxie for many years.
I have tried doing full removal of sandboxie and installed beta 5.23.5 with all settings default (all programs should be allowed to both access the internet as well as start and run)

I can run all kinds of programs sandboxed, but as soon as any of them need to use dllhost.exe the error box pops up (often need to close the box many times) and then programs continue to run)

I dont have any special programs on my PC other than fully updated windows defender, Avast free antivirus and spybot search & destroy.

I suspect a recent update (windows, flash player, java or similar ?) may be the cause but of course I can't rule out other possible causes like if something have happened to my windows installation ?

[Barb@Invincea]

Hello VitsKip,

I found another thread that might help you:
viewtopic.php?f=11&t=22347

If the issue persists, try removing your security software. If no difference, please provide the results of running Res. Acc. Monitor, as well as a copy of your configuration file.
Resource Access Monitor:
https://www.sandboxie.com/ResourceAccessMonitor
Copy/paste the output.
Highlight it and click on the "</>" button to format it in the forums.

Config File:
Configure --> Edit configuration
Copy/paste contents
Highlight contents and click on the "</>" button to format it in the forums.

Also, please provide the exact repro steps so that I can test this.

Regards,
Barb.-

[VitsKip]

Easiest way to reproduce is to rightclick on wmedia player and make it run in Sandboxie as media player apparently is trying to use dllhost.exe. Any other program that try to use dllhost.exe will produce same result but we all have media player


output from ressource monitor:

Code: Select all

(Drive)     \Device\CdRom0
(Drive)     \Device\HarddiskVolume1
(Drive)     \Device\HarddiskVolume2
Clsid       -------------------------------
Clsid       {0358B920-0AC7-461F-98F4-58E32CD89148} Wininet Cache task object
Clsid       {204810B9-73B2-11D4-BF42-00B0D0118B56} UPnPRegistrar
Clsid       {2735412A-7F64-5B0F-8F00-5D77AFBE261E} Microsoft IMAPI v2, Standard Data Writer
Clsid       {2735412D-7F64-5B0F-8F00-5D77AFBE261E} Microsoft IMAPI v2, CD DVD Device Object
Clsid       {2735412E-7F64-5B0F-8F00-5D77AFBE261E} Microsoft IMAPI v2, Disc Master
Clsid       {499C0C20-A766-11CF-8011-00A0C90A8F78} ?
Clsid       {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} http: Asychronous Pluggable Protocol Handler
Clsid       {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} ftp: Asychronous Pluggable Protocol Handler
Clsid       {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} https: Asychronous Pluggable Protocol Handler
Clsid       {BCDE0395-E52F-467C-8E3D-C4579291692E} MMDeviceEnumerator class
Clsid    O  {A47979D2-C419-11D9-A5B4-001185AD2B89} Network List Manager
File/Key    -------------------------------
Image       -------------------------------
Ipc         -------------------------------
Ipc         \BaseNamedObjects\[CoreUI]-PID(6712)-TID(4860) 17adbd12-fe6d-48a2-a769-414c70af7b7e
Ipc         \BaseNamedObjects\[CoreUI]-PID(6852)-TID(8960) 5a69c056-be54-4b32-ab27-9033792fddd7
Ipc         \BaseNamedObjects\__ComCatalogCache__
Ipc         \BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
Ipc         \BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
Ipc         \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db
Ipc         \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
Ipc         \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
Ipc         \BaseNamedObjects\F932B6C7-3A20-46A0-B8A0-8894AA421973
Ipc         \BaseNamedObjects\RotHintTable
Ipc         \BaseNamedObjects\SC_AutoStartComplete
Ipc         \BaseNamedObjects\windows_shell_global_counters
Ipc         \RPC Control\actkernel
Ipc         \RPC Control\epmapper
Ipc         \RPC Control\LRPC-553aaf08fa84f3fe9f
Ipc         \RPC Control\OLE7C510D1C5062AE14263ECCE43581
Ipc         \RPC Control\OLEA0D61F01BEEC779AB3ED40391701
Ipc         \RPC Control\webcache_{031b98cf-4a69-4c31-ab42-fd9b3c199407}_S-1-5-21-115431126-765937789-4043556584-1001
Ipc         \Sessions\2\BaseNamedObjects\__ComCatalogCache__
Ipc         \Sessions\2\BaseNamedObjects\{0ec23520-8d2b-11e4-87b0-806e6f6e6963}_-4718593_-77978
Ipc         \Sessions\2\BaseNamedObjects\{0ec23520-8d2b-11e4-87b0-806e6f6e6963}_-4718593_-77978:splk:6852
Ipc         \Sessions\2\BaseNamedObjects\{0ec23520-8d2b-11e4-87b0-806e6f6e6963}_-4718593_-77978:x
Ipc         \Sessions\2\BaseNamedObjects\{680adfff-e9f8-451c-bd30-50e24ff7f19b}:sqlce_se_lck:1
Ipc         \Sessions\2\BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
Ipc         \Sessions\2\BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
Ipc         \Sessions\2\BaseNamedObjects\{E72B51CA-7724-4CDF-8783-9997DF5B01B8}
Ipc         \Sessions\2\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db
Ipc         \Sessions\2\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
Ipc         \Sessions\2\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
Ipc         \Sessions\2\BaseNamedObjects\C:*Users******AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000042.db
Ipc         \Sessions\2\BaseNamedObjects\C:*Users******AppData*Local*Microsoft*Windows*Caches*cversions.1.ro
Ipc         \Sessions\2\BaseNamedObjects\c:/users/john/appdata/local/microsoft/media player/wmp-wmc/playerevent
Ipc         \Sessions\2\BaseNamedObjects\ComPlusCOMRegTable
Ipc         \Sessions\2\BaseNamedObjects\ComTaskPool:228
Ipc         \Sessions\2\BaseNamedObjects\HWNDInterface:207ca
Ipc         \Sessions\2\BaseNamedObjects\HWNDInterface:20812
Ipc         \Sessions\2\BaseNamedObjects\HWNDInterface:307a2
Ipc         \Sessions\2\BaseNamedObjects\HWNDInterface:307da
Ipc         \Sessions\2\BaseNamedObjects\HWNDInterface:407be
Ipc         \Sessions\2\BaseNamedObjects\MICROSOFT_WMDM_MUTEX
Ipc         \Sessions\2\BaseNamedObjects\Microsoft_WMP_70_CheckForOtherInstanceMutex
Ipc         \Sessions\2\BaseNamedObjects\RotHintTable
Ipc         \Sessions\2\BaseNamedObjects\SBIE_BOXED_DummyEvent_228
Ipc         \Sessions\2\BaseNamedObjects\SBIE_BOXED_DummyEvent_3540
Ipc         \Sessions\2\BaseNamedObjects\SBIE_BOXED_DummyEvent_6852
Ipc         \Sessions\2\BaseNamedObjects\SBIE_BOXED_DummyEvent_7700
Ipc         \Sessions\2\BaseNamedObjects\SBIE_BOXED_RPCSS_SXS_READY
Ipc         \Sessions\2\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_DcomLaunch
Ipc         \Sessions\2\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_Mutex1
Ipc         \Sessions\2\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcEptMapper
Ipc         \Sessions\2\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcSs
Ipc         \Sessions\2\BaseNamedObjects\SboxSession
Ipc         \Sessions\2\BaseNamedObjects\SC_AutoStartComplete
Ipc         \Sessions\2\BaseNamedObjects\ScmCreatedEvent
Ipc         \Sessions\2\BaseNamedObjects\SM0:228:168:WilStaging_02
Ipc         \Sessions\2\BaseNamedObjects\SM0:228:168:WilStaging_02_p0
Ipc         \Sessions\2\BaseNamedObjects\SM0:228:64:WilError_01
Ipc         \Sessions\2\BaseNamedObjects\SM0:228:64:WilError_01_p0
Ipc         \Sessions\2\BaseNamedObjects\SM0:3540:168:WilStaging_02
Ipc         \Sessions\2\BaseNamedObjects\SM0:3540:168:WilStaging_02_p0
Ipc         \Sessions\2\BaseNamedObjects\SM0:6852:168:WilStaging_02
Ipc         \Sessions\2\BaseNamedObjects\SM0:6852:168:WilStaging_02_p0
Ipc         \Sessions\2\BaseNamedObjects\SM0:6852:64:WilError_01
Ipc         \Sessions\2\BaseNamedObjects\SM0:6852:64:WilError_01_p0
Ipc         \Sessions\2\BaseNamedObjects\SM0:7700:168:WilStaging_02
Ipc         \Sessions\2\BaseNamedObjects\SM0:7700:168:WilStaging_02_p0
Ipc         \Sessions\2\BaseNamedObjects\SM0:7700:64:WilError_01
Ipc         \Sessions\2\BaseNamedObjects\SM0:7700:64:WilError_01_p0
Ipc         \Sessions\2\BaseNamedObjects\SyncRootManager
Ipc         \Sessions\2\BaseNamedObjects\UrlZonesSM_****
Ipc         \Sessions\2\BaseNamedObjects\windows_shell_global_counters
Ipc         \Sessions\2\BaseNamedObjects\WindowsMediaStoreMutex
Ipc         \Sessions\2\BaseNamedObjects\ZonesCacheCounterMutex
Ipc         \Sessions\2\BaseNamedObjects\ZonesLockedCacheCounterMutex
Ipc      O  \...\{0ec23520-8d2b-11e4-87b0-806e6f6e6963}_-4718593_-77978:sqlce_se_ver
Ipc      O  \...\0:{0ec23520-8d2b-11e4-87b0-806e6f6e6963}_-4718593_-77978:sqlce_se_lks
Ipc      O  \...\0:{0ec23520-8d2b-11e4-87b0-806e6f6e6963}_-4718593_-77978:sqlce_se_mem
Ipc      O  \...\0:{0ec23520-8d2b-11e4-87b0-806e6f6e6963}_-4718593_-77978:sqlce_se_mem_ext
Ipc      O  \BaseNamedObjects\CoreMessagingRegistrar
Ipc      O  \BaseNamedObjects\msctf.serverDefault2
Ipc      O  \KernelObjects\MaximumCommitCondition
Ipc      O  \KnownDlls\advapi32.dll
Ipc      O  \KnownDlls\bcryptPrimitives.dll
Ipc      O  \KnownDlls\cfgmgr32.dll
Ipc      O  \KnownDlls\clbcatq.dll
Ipc      O  \KnownDlls\combase.dll
Ipc      O  \KnownDlls\COMDLG32.dll
Ipc      O  \KnownDlls\coml2.dll
Ipc      O  \KnownDlls\CRYPT32.dll
Ipc      O  \KnownDlls\gdi32.dll
Ipc      O  \KnownDlls\gdi32full.dll
Ipc      O  \KnownDlls\IMAGEHLP.dll
Ipc      O  \KnownDlls\IMM32.dll
Ipc      O  \KnownDlls\kernel.appcore.dll
Ipc      O  \KnownDlls\kernel32.dll
Ipc      O  \KnownDlls\kernelbase.dll
Ipc      O  \KnownDlls\MSASN1.dll
Ipc      O  \KnownDlls\MSCTF.dll
Ipc      O  \KnownDlls\msvcp_win.dll
Ipc      O  \KnownDlls\MSVCRT.dll
Ipc      O  \KnownDlls\NSI.dll
Ipc      O  \KnownDlls\ole32.dll
Ipc      O  \KnownDlls\OLEAUT32.dll
Ipc      O  \KnownDlls\powrprof.dll
Ipc      O  \KnownDlls\profapi.dll
Ipc      O  \KnownDlls\PSAPI.DLL
Ipc      O  \KnownDlls\rpcrt4.dll
Ipc      O  \KnownDlls\sechost.dll
Ipc      O  \KnownDlls\Setupapi.dll
Ipc      O  \KnownDlls\SHCORE.dll
Ipc      O  \KnownDlls\SHELL32.dll
Ipc      O  \KnownDlls\SHLWAPI.dll
Ipc      O  \KnownDlls\ucrtbase.dll
Ipc      O  \KnownDlls\user32.dll
Ipc      O  \KnownDlls\win32u.dll
Ipc      O  \KnownDlls\windows.storage.dll
Ipc      O  \KnownDlls\WINTRUST.dll
Ipc      O  \KnownDlls\WS2_32.dll
Ipc      O  \RPC Control\AudioClientRpc
Ipc      O  \RPC Control\Audiosrv
Ipc      O  \RPC Control\DNSResolver
Ipc      O  \RPC Control\LRPC-553aaf08fa84f3fe9f
Ipc      O  \RPC Control\lsapolicylookup
Ipc      O  \RPC Control\lsasspirpc
Ipc      O  \RPC Control\SbieSvcPort
Ipc      O  \Security\LSA_AUTHENTICATION_INITIALIZED
Ipc      O  \Sessions\2\BaseNamedObjects\CTF.AsmListCache.FMPDefault2
Ipc      O  \Sessions\2\BaseNamedObjects\MSCTF.Asm.MutexDefault2
Ipc      O  \Sessions\2\Windows\ApiPort
Ipc      O  \Sessions\2\Windows\DwmApiPort
Ipc      O  \Sessions\2\Windows\SharedSection
Ipc      O  \Sessions\2\Windows\Theme1477668656
Ipc      O  \Sessions\2\Windows\ThemeSection
Ipc      O  \ThemeApiPort
Ipc      O  \Windows\Theme552885497
Pipe        -------------------------------
Pipe        ?
Pipe        \Device\00000020
Pipe        \Device\AvAswIDS_Ioc2
Pipe        \Device\CNG
Pipe        \Device\HarddiskVolume1
Pipe        \Device\HarddiskVolume2
Pipe        \Device\HarddiskVolume3
Pipe        \Device\KsecDD
Pipe        \Device\MountPointManager
Pipe        \Device\Ndis
Pipe        \Device\NDMP10
Pipe        \Device\NDMP11
Pipe        \Device\NDMP2
Pipe        \Device\NDMP3
Pipe        \Device\NDMP4
Pipe        \Device\NDMP5
Pipe        \Device\NDMP6
Pipe        \Device\NDMP7
Pipe        \Device\NDMP8
Pipe        \Device\NDMP9
Pipe     O  \Device\Afd
Pipe     O  \Device\Nsi
WinCls      -------------------------------
WinCls   O  #32768
WinCls   O  Shell_TrayWnd
WinCls   O  Type32_Main_Window
WinCls   X  ApplicationManager_DesktopShellWindow
WinCls   X  'MSITPro::EventQueue

My config file:

Code: Select all

[GlobalSettings]

Template=7zipShellEx
Template=WindowsRasMan
Template=Avast_Antivirus
Template=WindowsLive
Template=Microsoft_MSMQ
Template=OfficeLicensing

[DefaultBox]

ConfigLevel=7
AutoRecover=y
BlockNetworkFiles=y
Template=qWave
Template=WindowsFontCache
Template=BlockPorts
Template=LingerPrograms
Template=Chrome_Phishing_DirectAccess
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
BorderColor=#00FFFF,ttl
Enabled=y
CopyLimitKb=196618

[UserSettings_086E01B0]

SbieCtrl_UserName=john
SbieCtrl_BoxExpandedView=DefaultBox
SbieCtrl_NextUpdateCheck=1518550511
SbieCtrl_UpdateCheckNotify=n
SbieCtrl_ShowWelcome=n
SbieCtrl_AutoApplySettings=n
SbieCtrl_WindowCoords=376,268,1237,632
SbieCtrl_ActiveView=40021
SbieCtrl_TerminateWarn=n
SbieCtrl_HideWindowNotify=n

[Hasuki]

The same problem appeared after last update KB4058258 (maybe it is a problem, maybe not):

Message

SbieDll failed.PNG (9.5 KiB) Viewed 2810 times

Config + Res. Acc. Monitor: http://leteckaposta.cz/792488752
Windows 10 Pro, 1709, 32 bit, Windows Defender only, SB 5.22.

[Barb@Invincea]

Hasuki,

I was able to reproduce using KB4058258. I confirmed that removing that KB allows Sbie to work.
I have made the devs aware.

VitsKip,

Can you verify if you also have that KB installed, and that you are using a 32 bit version of Windows 10?

Regards,
Barb.-

[VitsKip]

Yes I am using Windows 10 Pro 32 bit and indeed KB4058258 was installed on my PC on february 9.

I have just removed KB4058258 and can confirm that Sandboxie now again works without any problems.

Thnx for identifying the cause so fast.

[missoula1300]

Will there be a patch to allow KB4058258 to operate?

[Hasuki]

There was new update today for Win 10, 1709, 32 bit: KB4074588
Check please if it has some influence on Sbiedll initialization. (I still didnt uninstal KB4058258, I still dont use SB for browsing. I use Internet Expolrer 11.)

[Barb@Invincea]

Hello Hasuki,

Thanks for the update.
That KB is a security update and does not change the behavior (you would still receive the error). This issue is still under investigation.

Regards,
Barb.-

[TimRude]

In my case, it was KB4074588 that had to be uninstalled in order to eliminate the dllhost.exe error message.

[Barb@Invincea]

UPDATE ---

Looks like KB4074588 is an update to KB4058258. If I install KB4074588 , KB4058258 disappears from my installed list.
Upon removal and a reboot, x258 comes back, and the issue persists.

I manually removed KB4058258 (after 588 was gone), and the issue resolved. I then ran a Windows update, which only installed KB4074588 and the issue came back. So looks like if you do an update now, you get KB4074588 which will also trigger the issue due to the above explained (and explains why I did not see a difference when I manually got both).

------------------------X --------------------------------

Hello TimRude,

Thanks for the update. I will re-test and update this thread soon.

Regards,
Barb.-

[rkpx1]

Is a fix for this issue in progress? I am experiencing the sbiedll.dll initialization fail on both 5.23 and 5.22 Sandboxie versions, and uninstalling the x588 update also only temporarily resolves the issue.

[chrisgruen]

Hello,

I also get this initialization fail when I want to start my Firefox (portable).

I tried to deinstall KB40745588, and now it works again.

But I feel no good to deinstall this update. Is there a solution soon?

Christian