MANY programs don't run: error 0xc00000e5

[AlphaUMi]

Since a fresh installation of Windows 10 in a new computer, I'm not being able to run MANY programs sandboxed. Not all, but the majority. Main example is Explorer.exe (I don't mean Internet Explorer, I mean Explorer.EXE: yes, I can't open a single window in a sandbox!). Notepad is affected too, and MANY others. Some other programs work correctly. I always get a Windows error 0xc00000e5. This happened with Sandboxie 5.08 and keeps occurring with 5.10. I want to narrow down this strange problem and understand what's causing it.

Please, could you take a look at my Process Monitor log (link below)? It captured 5 seconds of disk activity, with no other programs opened, just the time to open Explorer and reproduce the error (from Sandboxie Control, right click on DefaultBox --> Open sandboxed --> Open Explorer).

Thanks in advance!

Please, download the log from here:
https://drive.google.com/file/d/0BwWcbC ... sp=sharing

[Craig@Invincea]

Are you using antivirus and/or related products?

[Craig@Invincea]

Well, from a brief look @ your procmon, you have Comodo running. Have you done what's mentioned here to make sure SBIE will work with Comodo? http://forums.sandboxie.com/phpBB3/view ... 11&t=21539

Windows error 0xc00000e5 is a Windows OS error, usually with the registry also.

Are you having any other issues? slowness? Blue screens? etc?

[Curt@invincea]

You should have gotten a large "software compatibility" warning dialog box from Sandboxie as soon as it detects Comodo. Did this not occur?

[AlphaUMi]

Hi Craig, thank you for answering & support. As you have seen, I have Comodo Firewall installed. And I have set Comodo according to the instructions in the post you mentioned. In fact, before doing so the situation was even worse: Start.exe immediately closed, no sandboxing operation at all. After being instructed by that post, I am now able to run some applications, some installers, but the majority of programs still won't run and return that error code.

Keep in mind that Comodo is set up so that only Firewall is active. No Defense+, no Auto-sandbox (from Comodo), no VirusScope. But as you already know this matters only for a little extent, since these modules are running in the background anyway. Why otherwise should I have had to set up Defense+ with exceptions if the entire module was already disabled?

No other issues at all, no slowness, no bsod, nothing. I've installed and run some old'n' good games, some programs.... If it works, it works perfectly. If it doesn't work... 0xc00000e5!

-------------------

Hi Curt! To answer to your question briefly, no, it didn't, neither with 5.08, nor with 5.10.
???

[AlphaUMi]

Are you using antivirus and/or related products?

Besides Comodo Firewall, I have avast! free. Only File System and Web shields are enabled. All others "extra" protectons modules are disabled. I have Malwarebytes' Antimalware installed, but without real-time protection.

[Curt@invincea]

What do you see when you run Configure->Software Compatibility from SbieCtrl?

[Craig@Invincea]

I bet the Comodo FW has a different GUID than the A/V. So, that might explain why it wasn't flagged.

What happens when you have the Firewall totally off...inactive?

[AlphaUMi]

What do you see when you run Configure->Software Compatibility from SbieCtrl?

[+] Windows and Office Licensing Services
[+] Windows Live
[+] avast! Antivirus
[+] Comodo Internet Security / Antivirus / Firewall

Everything is checked by the plus sign.

By the way, I'm running Windows 10 x64 Home Edition.

I bet the Comodo FW has a different GUID than the A/V. So, that might explain why it wasn't flagged.

What happens when you have the Firewall totally off...inactive?

Just tried disabling firewall, received alerts from windows but etc..., Comodo tray icon is a red square with X... but unfortunately, nothing has changed! Damn!

[AlphaUMi]

Hello! Today I tried to narrow down the problem and got some interesting news: first, the bad ones. I thought that avast! Hardware Virtualization and Intel Virtualization Technology could have somewhat something to do with the issue... but nothing: I've disabled both avast! HV in Options --> Troubleshooting and Intel Virtualization Technology in BIOS, but to no avail. So, let's forget it.

BUT

I've fount that the ONLY programs that don't work (with error x00000e5) are x64 programs. More in general, all my x32 programs works, all my x64 programs do NOT work. This is why even Explorer and Notepad don't work. I have Windows 10 x64 v1511. So now, please, any ideas?

I thought that It could be a matter of permissions, but I never touched the C:\Program Files persmissions.

[Craig@Invincea]

Hello! Today I tried to narrow down the problem and got some interesting news: first, the bad ones. I thought that avast! Hardware Virtualization and Intel Virtualization Technology could have somewhat something to do with the issue... but nothing: I've disabled both avast! HV in Options --> Troubleshooting and Intel Virtualization Technology in BIOS, but to no avail. So, let's forget it

Would not affect SBIE.

Question, This "Fresh" install of Win 10...Was it an upgrade from a previous OS? OR was it a straight no previous OS?

I'd also recommend totally removing SBIE.

Download SBIE, Double click to install, select UNINSTALL and DONT copy settings.

After it uninstalls, reboot.

Install SBIE.

Try programs again.

[Curt@invincea]

0xc00000e5 = STATUS_INTERNAL_ERROR. Which is obviously not one of the most helpful error msgs (Sbie does not return this error anywhere).

I would suspect that the error is coming from some AV conflict. Have you tried removing Comodo?

Also, Craig is right about the Intel hardware virtualization stuff. Everyone at Invincea has that enabled because it is required for VMWare which we use for testing. It does not affect Sbie.

[sdfidsk]

Just got the exact same problem. Wasted hours of my life.
A horribly unworkable solution (for notepad.exe and possibly all 64-bit apps to run) was to apparently enable COMODO's "Detect shellcode injections", and then add exclusions for every program you'll ever run individually or do so collectively (such as just adding C:\ as a folder exclusion).

Disabling HIPS was not enough. Disabling "Detect shellcode injections" was not enough. For whatever reason the latter option had to be ENABLED (and the former option was irrelevant) and then exclusions had to be specifically added.

[sdfidsk]

Actually just tested again. The value of the "Detect shellcode injections" apparently doesn't matter either. As long as the exclusions specifically exist in the list (even though the entire functionality should otherwise technically be disabled), I can get programs to run.

[Craig@Invincea]

Actually just tested again. The value of the "Detect shellcode injections" apparently doesn't matter either. As long as the exclusions specifically exist in the list (even though the entire functionality should otherwise technically be disabled), I can get programs to run.

Did you follow the tips listed in the thread regarding AV Working or not that specifically details the problems w/ Comodo and what to ?
http://forums.sandboxie.com/phpBB3/view ... o&start=30
Original Sticky that's always updated: http://forums.sandboxie.com/phpBB3/view ... 11&t=21539