sbiesvc.exe use more than 100M memory

[Unknown_User_866]

Hi,

The sbiesvc.exe process in my computer use more than 100M memory when I use IE and firefox, is this normal?
I use sandboxie 3.0

[SnDPhoenix]

Well its not necessarily normal but with 3.00 it is common, lately alot of ppl have been having high memory useage with 3.00.

[Unknown_User_866]

Thanks!

[tzuk]

It may be common, or at least happening for some people, but it's also probably a bug in SbieSvc. My running SbieSvc uses only 3M. But just saying 100M is not too helpful, I'm afraid.

[Unknown_User_866]

I read some post and do some test.
I use sandboxie under windows 2003 SP2, I test the sandboxie without antivirus or firewall.

After a reboot, I found
Memory usage increase observably when I open a new application
Memory usage almost doesn't increase when I open an application second time.
Memory usage increase very slack when no new application launch.
Memory usage doesn't decrease after I close all applications.

I tested software include
MSN messenger 8.5b
google talk
firefox
IE7
emule
bitcomet
After open all the application and use about half an hour the memory usage about 160M
I found the IE7 is very observably increase the sbiesvc.exe memory usage.

Wish these information can help

[tzuk]

I use sandboxie under windows 2003 SP2, I test the sandboxie without antivirus or firewall.

That statement prompted me look into SbieSvc again from another angle, and I found (and fixed) a bug that can certainly result in increased use of resources. Let's hope the next update to Sandboxie makes things better in this respect. I will release it soon.

[tzuk]

Please try download Sandboxie again (from the same place, the Download link above), you should get version 3.00.04, which fixes this problem in SbieSvc.

[Unknown_User_866]

Hi

The new version significant improve the memory usage of sbiesvc.exe
I test firefox with 7 process open more than 60 tabs and about 10 other programs, the memory usage is not exceed 10M
The 3.00.01 version will use 50-60M memory under this situation.

But the IE7 seem no improve. Open a new tab will cause the sbiesvc.exe usese about 20M memory. and it's speed is very slow
After opened 7 tabs, the memory usage reaches about 130M and console.exe report
SBIE2203 failed to communicate with Sandboxie service: null reply

then I reboot the machine the driver can't init and the service can't startup, some infomation in the system envent log below:
SBIE9156 Driver initialization not completed
SBIE1122 Error: [C0000058]
SBIE1121 Hook failed for service NtUserMessageCall
SBIE1153 Sandboxie initialization failed. Close all programs and then re-install Sandboxie OR restart your computer.

reinstall can correct the error.

[tzuk]

After opened 7 tabs, the memory usage reaches about 130M and console.exe report
SBIE2203 failed to communicate with Sandboxie service: null reply

That's the bug I've been looking for, but I have no idea how to reproduce it myself.

then I reboot the machine the driver can't init and the service can't startup
reinstall can correct the error.

OK, I will make Sandboxie wait longer during initialization.

[Unknown_User_866]

That's the bug I've been looking for, but I have no idea how to reproduce it myself.

Hi

I think I may found the reason of too much memory used.

I fond the sbisvc.exe try to create below directoryes again and agin.
Local Settings\Temporary Internet Files
Local Settings\Temporary Internet Files\Content.IE5
Local Settings\History
Local Settings\History\History.IE5

So I add below config into sandboxie
OpenFilePath=iexplore.exe,%Cache%
OpenFilePath=iexplore.exe,%Cache%\Content.IE5
OpenFilePath=iexplore.exe,%Cookies%
OpenFilePath=iexplore.exe,%History%
OpenFilePath=iexplore.exe,%History%\History.IE5
OpenFilePath=iexplore.exe,%Local Settings%
OpenFilePath=iexplore.exe,%Local Settings%\Temp

After added the settings, sbisvc.exe doesn't use so much memory when IE7 start
But the IE7 still slower than out of sandboxie.

[tzuk]

I fond the sbisvc.exe try to create below directoryes again and agin.

How did you find that out it was creating stuff? I'm asking because that's obviously a bug that I want to fix properly rather than with OpenFilePath settings.

SbieSvc is supposed to do some operations on existing directories on behalf of sandboxed programs, but not to create them. Can you give some more details?

[Unknown_User_866]

How did you find that out it was creating stuff? I'm asking because that's obviously a bug that I want to fix properly rather than with OpenFilePath settings.

SbieSvc is supposed to do some operations on existing directories on behalf of sandboxed programs, but not to create them. Can you give some more details?

I use Process Monitor record the operation of sbiesvc
http://www.microsoft.com/technet/sysint ... nitor.mspx
Log shows sbiesvc try to create these directorys in boxrootfolder but always can't fully success.

below is apart of the log
CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temporary Internet Files SUCCESS
SetBasicInformationFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temporary Internet Files SUCCESS
CloseFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temporary Internet Files SUCCESS
CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5 NAME NOT FOUND
CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\History NAME NOT FOUND
CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\History\History.IE5 PATH NOT FOUND
CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5 NAME NOT FOUND
CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temp\Temporary Internet Files\Content.IE5 PATH NOT FOUND

This process continue again and again.

[Mwewe]

I ran across those folders and files in my system too. It's just the IE7 cache, which consists of a huge number of files, depending on what you're viewing or downloading in IE7. It stores cookies, images, etc. in this space so it can re-load quickly.

The way I discovered them was trying to securely delete the default sandbox with Axcrypt. It left a couple of directories. So I opened up a DOS window and executed the command "dir /a /s". I was surprised when hundreds of files appeared. Apparently they all have the System and Hidden attributes set. So for drill, I executed the attrib command recursively and removed the S and H attributes. Then it was easy to secure delete the files.

I think it's normal for IE7 to create this huge cache of files, and it's clear Sandboxie should create this cache rather than add or use the one that un-sandboxed IE7 pages use.

I wonder if it would be a useful feature for Sanboxie to have an option to delete the default sandbox securely, i.e., by overwriting it with zeros. Somehow I find it reassuring to know your sandboxed session is securely deleted. I'd be curious if anyone else likes this idea.

On the other hand, it's quite easy to use a command like sdelete.exe (www.sysinternals.com) in a batch file to quickly accomplish the same thing manually.

Mwewe

[wraithdu]

Check the FAQ for info on how to use youre favorite secure delete program with Sandboxie's auto-delete option.

[Unknown_User_866]

But the IE7 still slower than out of sandboxie.

I found IE7 try to access some registry keys contain {871C5380-42A0-1069-A2EA-08002B30309D} non-stop
such as
HKCU\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

I think this may cause the IE High CPU Usage in sandboxie.