sbiesvc.exe use more than 100M memory

[Mwewe]

Wraithdu, thanks for pointing out that Sandboxie can be customized to handle secure deletes. I found it in the FAQ and have implemented it here. It's deleting everything and it does it so quickly I can't see any difference from the default rmdir method. So I ran a few tests.

First, it does indeed securely delete the objects. I tried it with 1200 files and then used a file recovery program to see if I could detect them. I couldn't, they were completely gone.

Still puzzled by the rapidity that I regained control after commanding a secure delete of 1200 files, I brought up Task Manager. There was sdelete.exe in its own process listing, using about 30% of the CPU. It was working in a background process and was not causing interference with the keyboard, mouse, or display. When if finished about 10-20 seconds later, all the files were gone.

Tzuk has implemented this beautifully. Changing to sdelete.exe mades little difference to the user except that the sandbox is securely deleted.

This answers my original question, is anyone else interested in it -- I know that at least Tzuk was! It also answers the question I would have asked next, how do I implement it.

Thanks again,
Mwewe

[tzuk]

CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temporary Internet Files SUCCESS
SetBasicInformationFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temporary Internet Files SUCCESS
CloseFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temporary Internet Files SUCCESS

Oh, I see, well I recognize this sequence. The operation is called CreateFile but in this case it doesn't actually create the file. I'm sure if you can get Process Monitor to tell you the disposition of the operation, you would see something to the effect of 'opened existing file' rather than 'created new file'.

Still interesting though, why so many operations, and why this should cause excessive memory usage. I will have to look into it in depth and let you know what I learn.

[tzuk]

CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\Temporary Internet Files\Content.IE5 NAME NOT FOUND
CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\History NAME NOT FOUND
CreateFile C:\Documents and Settings\Administrator\Application Data\Sandbox\DefaultBox\user\current\Local Settings\History\History.IE5 PATH NOT FOUND

This process continue again and again.

By the time a request to do something ends up in SbieSvc, the sandboxed copy of the folder should already exist. There was a bug in copying folders into the sandbox. Please try a revised version:

http://www.sandboxie.com/SandboxieInstall04x.exe

I can't say if this will resolve the memory problems, but the "NAME NOT FOUND" errors should be resolved.

[Unknown_User_866]

By the time a request to do something ends up in SbieSvc, the sandboxed copy of the folder should already exist. There was a bug in copying folders into the sandbox. Please try a revised version:

http://www.sandboxie.com/SandboxieInstall04x.exe

I can't say if this will resolve the memory problems, but the "NAME NOT FOUND" errors should be resolved.

Hi Tzuk

Thank you very much for so quickly and kindly solve the problem.
After I get rid of the OpenfilePath config for IE cache direcotory and update.
The new version won't generate the "NAME NOT FOUND" in procmon.
The memory usage problem should have been fixed in the revised version, the sbisvc.exe only increase about 100KB memory usage when open one new tab in IE7.
IE7's performance have significantely improved.
I can now run almost all my programs need access network with sandboxie protecting.

By the way
After The sandboxie update to 3.00.04, I found some minor problem but not related to this topic.
Because I'm a newcomer to this forums and I see there is a "Resolved Problems", so I think you use this form as a bug tracker.
Should I post new problemes with new topics?

[SnDPhoenix]

Should I post new problemes with new topics?

Yes, thats how it is supposed to be done.

[tzuk]

Thanks soul916, I couldn't have done it so quickly without your hints.