Unable to delete contents, object in use

[bo.elam]

captnamerca, Terminate all programs before running FA.

Bo

[captnamerca]

captnamerca, Terminate all programs before running FA.

Bo

It hasn't worked so far, but I'll certainly try it again when I get home.

Any suggestions for a program that can backtrack what process has this RegHive file open?

[captnamerca]

No success whatsoever in Terminating Programs. I can get everything out of the DefaultBox folder, except that stubborn RegHive file.

I downloaded an unlocking app called DeadLock. No luck there either.


The file appears in Locked status, and it won't show me what processes are using it, just "Access Denied"

Sandboxie Error22.PNG (20.39 KiB) Viewed 812 times

Using the Unlock function appears to work, at first. The status changes to "Successfully Unlocked".

Sandboxie Error23.PNG (11.89 KiB) Viewed 812 times

If it's Unlocked, I should be able to remove it, right? Wrong.

Sandboxie Error24.PNG (108.17 KiB) Viewed 812 times

This is one stubborn file. I've tried turning off all AM/AV programs, including MBAM, MBAE, Avira, CCleaner, Windows Defender, and even PIA VPN just in case. Absolutely no difference in the RegHive file.

I'm at a loss. We still don't even know what process is using the RegHive file.

[opera]

I have now started to receive the exact same reghive error as you captnamerica.

So what do we have in common on our machines?

Windows 10 Pro 64bit 1607 (OS Build 14393.321)
Sbie 5.14 SeaMonkey 2.40
Emsisoft Anti-Malware and VoodoooShield (both paid)
I have Ccleaner but monitoring is off.

The difference is I can delete the entries after a cold boot. I cannot delete them after closing the browser in the same Windows session.

I have Fast Start DISABLED

I shut down my machine. Then a minute later I start it up.

When desktop is loaded I right-click on Sbie taskbar icon and select my default box.

Then the Sbie window comes up and all the non deleted files and folders load.

I then press delete and it does.

This is so strange.

[captnamerca]

We have the same build of Windows 10, Sandboxie, and just CCleaner.

My other AV/AM software is Malwarebytes Anti-Malware and Anti-Exploit (Paid), Avira AM, and Windows Defender.

I also have Foxit PDF reader installed. I read that earlier versions may have had problems. Do you have Foxit?

I have not been able to delete the sandbox under any circumstances, so I'd like to see if I can replicate your issue.

What do you mean, exactly, by a cold boot? And what is fast start?

[Syrinx]

a cold boot is a boot process in which the computer starts from a powerless state.

/yay wiki?

With Windows this also (to me) means a standard boot process (eg no hiberfile.sys). The 'fast startup' option of 8/10 is similar here as it saves some parts in a file and instead of a true boot it 'loads' these elements from a file then continues to process the rest. Hybrid is the word used here [in many cases] but for your situation, it might be an issue but to my limited knowledge an actual reboot would still resolve those. Hitting shutdown may however result in such a situation. yay for complicating things MS?

Anyway, I expect a boot into safe mode would resolve your problems and allow the box to be well and truly cleared but I also understand that you want to figure out what is going on!

As for ideas, I don't have many others but if you want to use teamviewer and let a drunken ***hole on your system [to pwn if of course] and test some random stuff I'm open to that idea at this point...just don't blame me if your pc takes over the world after! /itwasntme

[opera]

Hi captnamerica,

Can I suggest you turn off fast startup, reboot and then follow the steps I mentioned above to delete the files and see if that works for you?

http://www.howtogeek.com/243901/the-pro ... rtup-mode/

You can always turn fast startup back on afterwards if you want. ( Personally I prefer it turned off.. less problems and it only takes a couple of seconds extra to boot)

[captnamerca]

Ha HA! SUCCESS!

I turned off Fast Start, and rebooted. It took a lot longer than usual to start up, but once it did, I was able to right click on the Sandboxie icon, and delete contents. The RegHive file was deleted, and the sandbox it was in.


I have no idea what caused it, but at least I have a workaround.

Thanks everyone, for all the suggestions. I'm sure it will happen again, I'll try to delete the sandbox more often to narrow it down. At least this can be a reference for anyone else having the problem.

[opera]

Glad to hear what worked for me worked for you too

Perhaps in the ''pretend'' shutdown (Fast Start) the reg hive cannot be unloaded.

Turning off Fast Start can solve a lot of issues.

[captnamerca]

It's weird because for seven months, SB worked fine, with no issues with the Fast Start.

I'm glad it worked. I think I'm going to reinstate Fast Start and see if it causes the same issue with the RegHive file, or if not, watch for a program or application that triggers it.

[opera]

If you do re-instate fast start to try and find the cause, the only thing I have a vague memory of is having notepad still open with stuff copy and pasted from a sandboxed browser.

But as you know, it could be millions of other things !!!

[captnamerca]

If you do re-instate fast start to try and find the cause, the only thing I have a vague memory of is having notepad still open with stuff copy and pasted from a sandboxed browser.

But as you know, it could be millions of other things !!!

I may have used Notepad during the time period in question. I don't use it that often, so that's a good lead to follow up on.