Sandboxie cannot open (a sandboxed) Firefox anymore

[Peter 123]

[...] if an AV program blocks essential processes of SBIE, SBIE can't fix anything! They can contact the producer of the AV program only - nothing more.

This would also be a good step! Program developers have better contacts to such companies than simple users and above all they have the technical knowledge to communicate with their colleagues in an efficient way!

[...] which now leaves us with appealing to Norton to undo or modify what they did last Monday night (19th October).

Does someone know if Norton has something like a changelog concerning its updates and if there is a possibility to go back to a former version of the product, at least for test purposes*?

*) O.k. here I found possibilities to download former versions:
http://www.filehorse.com/download-norto ... -versions/
[url]http://norton_antivirus.en.downloadastro.com/old_versions/[/url]

[APMichael]

This would also be a good step! Program developers have better contacts to such companies than simple users and first of all they have the technical knowledge to communicate with their colleagues in an efficient way!

Correct, but sadly that didn't help also: e.g. Kaspersky still didn't fix KIS2016.

[MDrew]

[...]

Does someone know if Norton has something like a changelog concerning its updates and if there is a possibility to go back to a former version of the product, at least for test purposes*?

Pretty sure that won't do any good - when I deleted Norton I had to restore to a version from 2013 - and it didn't work either (I had to also "restore" almost 400MB of virus signature updates) - the engine was years old but something in the signature updates is the culprit. So the Norton engine from 2013 no longer plays nice with SB & FF nor does the very latest engine either - pretty sure it something in the "virus" updates themselves.

[Peter 123]

Correct, but sadly that didn't help also: e.g. Kaspersky still didn't fix KIS2016.

Maybe Norton would.

In the meantime I downloaded an older version of Norton from filehorse.com (link above), namely 22.5.2.15. The installation (plus automatic replacement of the existing version) seems to work without any problems but a reboot of the computer would be necessary. I did not take this step so I cannot say if after installing this older version Firefox would open correctly again in SBIE.

What I saw:
As the existing version of Norton was already uninstalled I activated Microsoft Security Essentials (MSE) and with this AV program Firefox works fine again within Sandboxie: no delay in the opening of the browser, no delays in surfing.

From this point of view it seems to be like Craig had mentioned above:

However, as for A/V programs, we recommend MSE (Defender.) It's free, and it works well with SBIE.

But nevertheless I would prefer the more extended protection offered by Norton (apart from that Norton Internet Security is not only an AV!).

[Curt@invincea]

Norton seems to have a problem when running as a regular user. Try running Ffx+Sbie+Norton under an admin account and see if your troubles disappear.

[Peter 123]

Try running Ffx+Sbie+Norton under an admin account and see if your troubles disappear.

I think it was already running under admin account. But anyway I typed now the command "net user Administrator /active:yes" but no change: Firefox may open within Sandboxie in one of perhaps 5 or 6 attempts.

[safemist]

This is definitely a norton problem. I fired up my tablet today, with the new norton 360, after leaving it off for a week, and i went online with firefox no problem before it updated its stuff. I closed down the browser and tried to go back online after the norton update and I cant get on, except maybe once in a while by accident. My main pc is vista with the old version of 360 and it works fine with firefox.

I dont currently have access to the tablet, but have you tried turning off browser protection in Norton:

settings--firewall--intrusion and browser protection--browser protection off

[Peter 123]

I cant get on, except maybe once in a while by accident.

Yes, that's my situation too.

have you tried turning off browser protection in Norton:

settings--firewall--intrusion and browser protection--browser protection off

Thanks for the tip. I tried it now (as disabling various other features before). No effect.

[bo.elam]

Pete, why don't you try MSE? It works well with SBIE and its been at least 5 years since it had any kind of issue with SBIE. In fact, MSE conflicted with SBIE when it first came out but soon afterward, the problem was fixed and all has been well ever since. I know on paper, supposedly MSE is not the best but I tell you something, that's the antivirus I install in friends and family whom I installed SBIE for and they are not getting infected.

Most of this people are using Sandboxies free version and dont ever read anything about internet security. You have the paid version, you are an advanced user, you can force most of the programs you run every day and force your USB drives, etc. You are well covered by combining Sandboxie with MSE or Windows defender. If I was using an AV, I would be using MSE.

I have friends whom I installed SBIE for, who gotten free one year licenses for paid antiviruses with the purchase of a new computer, those licenses have not been used in their computers as instead, I installed MSE. I done that in at least 4 computers. I gave a couple of those ESET licenses to a good friend at Wilders whose a big fan of ESET and don't use SBIE. I do this because I am convinced that using MSE with SBIE is a good combo. And I never hear about Sandboxie issues. They don't happen for them.

Bo

[Curt@invincea]

Try running Ffx+Sbie+Norton under an admin account and see if your troubles disappear.

I think it was already running under admin account. But anyway I typed now the command "net user Administrator /active:yes" but no change: Firefox may open within Sandboxie in one of perhaps 5 or 6 attempts.

net user does not login to anything. Try logging in under and admin account. Reboot windows, login under admin, disable Norton firewall.

[MDrew]

Norton seems to have a problem when running as a regular user. Try running Ffx+Sbie+Norton under an admin account and see if your troubles disappear.

I am running XP with one user (me) who is the administrator and FF+SB won't work here.
I am still of the opinion that the issue is in the virus signature updates and not the Norton engine itself so reverting to an"older" version of Norton is futile, the next sig update will kill SB & FF.

[Peter 123]

net user does not login to anything. Try logging in under and admin account. Reboot windows, login under admin, disable Norton firewall.

O.k. I got it now. The net user command was not wrong but afterwards I have to continue with the log in process. (For those [like me] who need a descriptive explanation what to do under Windows 7 in order to get the admin account and to log in there, here is a good video: https://www.youtube.com/watch?v=loU9qJd28hM)

The result (after disabling the Norton firewall):
The first approximately fife times in series it worked indeed: Firefox opened in Sandboxie. But afterwards the situation became the same as when working with the normal user account: sometimes it worked but in most of the attempts it failed.

Pete, why don't you try MSE? [...]
You are well covered by combining Sandboxie with MSE or Windows defender. If I was using an AV, I would be using MSE.

Bo, thanks a lot for your encouraging comment. It's good to hear - especially from you - that MSE would be a sufficient solution. I would prefer it for several reasons to other AV programs like Avast or AVG (no delay in my short tests, no new software necessary ...). At the moment I still hope for some positive solution with Norton but your recommendation shows me that the next step will probably be a change to MSE.

Norton seems to have a problem when running as a regular user. Try running Ffx+Sbie+Norton under an admin account and see if your troubles disappear.

I am running XP with one user (me) who is the administrator and FF+SB won't work here.

I think that in XP too (like in Windows 7) this is not the same as logging in under an admin account as meant by Curt.

See for example here:

There are times when you need to install a particular software or hardware driver or you just wanted to edit your setting and windows requires you to be logged in as administrator but even your current login account with administrator privilege doesn't work out, or maybe you just want the administrator account shows up when windows welcome screen appears

(source: https://www.youtube.com/watch?v=Myd9N2apHjA)

[MDrew]

n

I am running XP with one user (me) who is the administrator and FF+SB won't work here.

I think that in XP too (like in Windows 7) this is not the same as logging in under an admin account as meant by Curt.

Nope, my single log-in IS the administrator - none of the silly grief introduced in Vista - but that is all academic as your experiment proved. I too hope this issue can be resolved because I actually like Norton and have used SB, FF and Norton for years and would hate to be forced to use a program I consider inferior just to "make it work at all"

[rpljhun]

Is anyone of you could post here your access logs? Just follow procedure below.

1. Create New Sandbox. Copy Settings is None. (Sandbox Menu -> Create New Sandbox)
2. Terminate all programs in the sandbox. (File Menu -> Terminate All Programs)
3. Make sure no program is running in the sandbox(There should be no list of processes in Sandboxie Control Window)
4. Open Resource Access Monitor. (File Menu -> Resource Access Monitor)
5. Run Firefox as sandboxed in the newly created sandbox.(Right-click Firefox Shortcut -> Run Sandboxed)
6. Click Copy Contents… from Resource Access Monitor window
7. Post here the logs in code tags

[Peter 123]

Is anyone of you could post here your access logs?

Here are mines.

I was lucky and during the first attempt the opening of Firefox in the newly created Sandbox succeeded (the following times it failed). So you can see two logs for comparing.

I saw that one of the differences is that the ctfmon.exe has not loaded as FF opened and has loaded as FF failed to open. If this could be of any importance please take also a look at this thread: http://forums.sandboxie.com/phpBB3/view ... 11&t=21966 (The messages of SBIE reported there did not appear again since this time [4 days ago].)

So here is:

A) Access log when the opening of Firefox succeeded:

Code: Select all

(Drive)     \Device\CdRom0
(Drive)     \Device\CdRom1
(Drive)     \Device\HarddiskVolume2
(Drive)     \Device\HarddiskVolume3
Clsid       -------------------------------
Clsid       {BCDE0395-E52F-467C-8E3D-C4579291692E} MMDeviceEnumerator class
Clsid    O  {8BC3F05E-D86B-11D0-A075-00C04FB68820} Windows Management and Instrumentation
File/Key    -------------------------------
Image       -------------------------------
Image       *:\program files\mozilla firefox\firefox.exe
Image       *:\program files\sandboxie\sandboxiedcomlaunch.exe
Image       *:\program files\sandboxie\sandboxierpcss.exe
Image       *:\program files\sandboxie\start.exe
Image       c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
Image       c:\program files\mozilla firefox\browser\components\browsercomps.dll
Image       c:\program files\mozilla firefox\freebl3.dll
Image       c:\program files\mozilla firefox\icudt52.dll
Image       c:\program files\mozilla firefox\icuin52.dll
Image       c:\program files\mozilla firefox\icuuc52.dll
Image       c:\program files\mozilla firefox\mozglue.dll
Image       c:\program files\mozilla firefox\msvcp120.dll
Image       c:\program files\mozilla firefox\msvcr120.dll
Image       c:\program files\mozilla firefox\nss3.dll
Image       c:\program files\mozilla firefox\nssckbi.dll
Image       c:\program files\mozilla firefox\nssdbm3.dll
Image       c:\program files\mozilla firefox\sandboxbroker.dll
Image       c:\program files\mozilla firefox\softokn3.dll
Image       c:\program files\mozilla firefox\xul.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\ccipc.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\cclib.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\ccvrtrst.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\efacli.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\msvcp110.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\msvcr110.dll
Image       c:\program files\norton internet security\nortondata\22.5.0.124\definitions\ipsdefs\20151023.001\ipseng32.dll
Image       c:\program files\sandboxie\sbiedll.dll
Image       c:\windows\system32\advapi32.dll
Image       c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Image       c:\windows\system32\audioses.dll
Image       c:\windows\system32\bcrypt.dll
Image       c:\windows\system32\cfgmgr32.dll
Image       c:\windows\system32\clbcatq.dll
Image       c:\windows\system32\comdlg32.dll
Image       c:\windows\system32\credssp.dll
Image       c:\windows\system32\crypt32.dll
Image       c:\windows\system32\cryptbase.dll
Image       c:\windows\system32\cryptsp.dll
Image       c:\windows\system32\d2d1.dll
Image       c:\windows\system32\d3d11.dll
Image       c:\windows\system32\dbghelp.dll
Image       c:\windows\system32\devobj.dll
Image       c:\windows\system32\dnsapi.dll
Image       c:\windows\system32\dui70.dll
Image       c:\windows\system32\duser.dll
Image       c:\windows\system32\dwmapi.dll
Image       c:\windows\system32\dwrite.dll
Image       c:\windows\system32\dxgi.dll
Image       c:\windows\system32\explorerframe.dll
Image       c:\windows\system32\fwpuclnt.dll
Image       c:\windows\system32\gdi32.dll
Image       c:\windows\system32\iertutil.dll
Image       c:\windows\system32\imm32.dll
Image       c:\windows\system32\iphlpapi.dll
Image       c:\windows\system32\kernel32.dll
Image       c:\windows\system32\kernelbase.dll
Image       c:\windows\system32\lpk.dll
Image       c:\windows\system32\mmdevapi.dll
Image       c:\windows\system32\msasn1.dll
Image       c:\windows\system32\mscms.dll
Image       c:\windows\system32\msctf.dll
Image       c:\windows\system32\msimg32.dll
Image       c:\windows\system32\msvcr100.dll
Image       c:\windows\system32\msvcrt.dll
Image       c:\windows\system32\mswsock.dll
Image       c:\windows\system32\msxml6.dll
Image       c:\windows\system32\napinsp.dll
Image       c:\windows\system32\netapi32.dll
Image       c:\windows\system32\netutils.dll
Image       c:\windows\system32\nlaapi.dll
Image       c:\windows\system32\normaliz.dll
Image       c:\windows\system32\nsi.dll
Image       c:\windows\system32\ntdll.dll
Image       c:\windows\system32\ntdsapi.dll
Image       c:\windows\system32\ntmarta.dll
Image       c:\windows\system32\nvwgf2um.dll
Image       c:\windows\system32\ole32.dll
Image       c:\windows\system32\oleaut32.dll
Image       c:\windows\system32\pdh.dll
Image       c:\windows\system32\pnrpnsp.dll
Image       c:\windows\system32\profapi.dll
Image       c:\windows\system32\propsys.dll
Image       c:\windows\system32\psapi.dll
Image       c:\windows\system32\rasadhlp.dll
Image       c:\windows\system32\rpcepmap.dll
Image       c:\windows\system32\rpcrt4.dll
Image       c:\windows\system32\rpcrtremote.dll
Image       c:\windows\system32\rpcss.dll
Image       c:\windows\system32\rsaenh.dll
Image       c:\windows\system32\samcli.dll
Image       c:\windows\system32\samlib.dll
Image       c:\windows\system32\sechost.dll
Image       c:\windows\system32\secur32.dll
Image       c:\windows\system32\setupapi.dll
Image       c:\windows\system32\shell32.dll
Image       c:\windows\system32\shlwapi.dll
Image       c:\windows\system32\srvcli.dll
Image       c:\windows\system32\sspicli.dll
Image       c:\windows\system32\sxs.dll
Image       c:\windows\system32\user32.dll
Image       c:\windows\system32\userenv.dll
Image       c:\windows\system32\usp10.dll
Image       c:\windows\system32\uxtheme.dll
Image       c:\windows\system32\version.dll
Image       c:\windows\system32\wbem\fastprox.dll
Image       c:\windows\system32\wbem\wbemprox.dll
Image       c:\windows\system32\wbem\wbemsvc.dll
Image       c:\windows\system32\wbemcomn.dll
Image       c:\windows\system32\webio.dll
Image       c:\windows\system32\wevtapi.dll
Image       c:\windows\system32\winhttp.dll
Image       c:\windows\system32\wininet.dll
Image       c:\windows\system32\winmm.dll
Image       c:\windows\system32\winnsi.dll
Image       c:\windows\system32\winrnr.dll
Image       c:\windows\system32\wintrust.dll
Image       c:\windows\system32\wkscli.dll
Image       c:\windows\system32\wldap32.dll
Image       c:\windows\system32\wpc.dll
Image       c:\windows\system32\ws2_32.dll
Image       c:\windows\system32\wship6.dll
Image       c:\windows\system32\wshtcpip.dll
Image       c:\windows\system32\wsock32.dll
Image       c:\windows\system32\wtsapi32.dll
Image       c:\windows\system32\xmllite.dll
Image       c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
Image       c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
Ipc         -------------------------------
Ipc         \BaseNamedObjects\__ComCatalogCache__
Ipc         \BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
Ipc         \BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
Ipc         \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000002f.db
Ipc         \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db
Ipc         \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
Ipc         \BaseNamedObjects\C__Program Files_Norton Internet Security_NortonData_22.5.0.124_Definitions_IPSDefs_20151023.001
Ipc         \BaseNamedObjects\CINJR
Ipc         \BaseNamedObjects\RotHintTable
Ipc         \BaseNamedObjects\windows_shell_global_counters
Ipc         \RPC Control\actkernel
Ipc         \RPC Control\epmapper
Ipc         \RPC Control\OLE7EB03166E4DA46019A29461B7E76
Ipc         \RPC Control\plugplay
Ipc         \Sessions\1\BaseNamedObjects\__ComCatalogCache__
Ipc         \Sessions\1\BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
Ipc         \Sessions\1\BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
Ipc         \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000002f.db
Ipc         \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db
Ipc         \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
Ipc         \Sessions\1\BaseNamedObjects\C:*Users*****AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000ca0.db
Ipc         \Sessions\1\BaseNamedObjects\C:*Users*****AppData*Local*Microsoft*Windows*Caches*cversions.1.ro
Ipc         \Sessions\1\BaseNamedObjects\C__Program Files_Norton Internet Security_NortonData_22.5.0.124_Definitions_IPSDefs_20151023.001
Ipc         \Sessions\1\BaseNamedObjects\CINJR
Ipc         \Sessions\1\BaseNamedObjects\ComPlusCOMRegTable
Ipc         \Sessions\1\BaseNamedObjects\FirefoxStartupMutex
Ipc         \Sessions\1\BaseNamedObjects\RotHintTable
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_1900
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_3364
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4308
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4368
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_RPCSS_SXS_READY
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_DcomLaunch
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_Mutex1
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcEptMapper
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcSs
Ipc         \Sessions\1\BaseNamedObjects\ScmCreatedEvent
Ipc         \Sessions\1\BaseNamedObjects\windows_shell_global_counters
Ipc      O  \BaseNamedObjects\CGSCE
Ipc      O  \BaseNamedObjects\CNDIE
Ipc      O  \BaseNamedObjects\CSECE
Ipc      O  \BaseNamedObjects\IDS_STORAGE_MUTEX
Ipc      O  \BaseNamedObjects\msctf.serverDefault1
Ipc      O  \KernelObjects\MaximumCommitCondition
Ipc      O  \KnownDlls\advapi32.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-advapi32-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-normaliz-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-ole32-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-user32-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-version-l1-1-0.dll
Ipc      O  \KnownDlls\CFGMGR32.dll
Ipc      O  \KnownDlls\clbcatq.dll
Ipc      O  \KnownDlls\COMDLG32.dll
Ipc      O  \KnownDlls\CRYPT32.dll
Ipc      O  \KnownDlls\DEVOBJ.dll
Ipc      O  \KnownDlls\gdi32.dll
Ipc      O  \KnownDlls\IERTUTIL.dll
Ipc      O  \KnownDlls\kernel32.dll
Ipc      O  \KnownDlls\kernelbase.dll
Ipc      O  \KnownDlls\LPK.dll
Ipc      O  \KnownDlls\MSASN1.dll
Ipc      O  \KnownDlls\MSCTF.dll
Ipc      O  \KnownDlls\MSVCRT.dll
Ipc      O  \KnownDlls\NORMALIZ.dll
Ipc      O  \KnownDlls\NSI.dll
Ipc      O  \KnownDlls\ole32.dll
Ipc      O  \KnownDlls\OLEAUT32.dll
Ipc      O  \KnownDlls\profapi.dll
Ipc      O  \KnownDlls\PSAPI.DLL
Ipc      O  \KnownDlls\rpcrt4.dll
Ipc      O  \KnownDlls\Setupapi.dll
Ipc      O  \KnownDlls\SHELL32.dll
Ipc      O  \KnownDlls\SHLWAPI.dll
Ipc      O  \KnownDlls\user32.dll
Ipc      O  \KnownDlls\USERENV.dll
Ipc      O  \KnownDlls\USP10.dll
Ipc      O  \KnownDlls\WININET.dll
Ipc      O  \KnownDlls\WINTRUST.dll
Ipc      O  \KnownDlls\WLDAP32.dll
Ipc      O  \KnownDlls\WS2_32.dll
Ipc      O  \RPC Control\{3403BA4D-EA56-4918-9AD2-E4BAEF269BAB}
Ipc      O  \RPC Control\{A67F6FBB-F3E6-4526-AA32-09C115C8487B}
Ipc      O  \RPC Control\AudioClientRpc
Ipc      O  \RPC Control\Audiosrv
Ipc      O  \RPC Control\DNSResolver
Ipc      O  \RPC Control\lsapolicylookup
Ipc      O  \RPC Control\LSARPC_ENDPOINT
Ipc      O  \RPC Control\lsasspirpc
Ipc      O  \RPC Control\SbieSvcPort
Ipc      O  \Security\LSA_AUTHENTICATION_INITIALIZED
Ipc      O  \Sessions\1\BaseNamedObjects\CTF.AsmListCache.FMPDefault1
Ipc      O  \Sessions\1\BaseNamedObjects\MSCTF.Asm.MutexDefault1
Ipc      O  \Sessions\1\BaseNamedObjects\MSCTF.AsmCacheReady.Default1
Ipc      O  \Sessions\1\BaseNamedObjects\MSCTF.CtfActivated.Default1
Ipc      O  \Sessions\1\Windows\SharedSection
Pipe        -------------------------------
Pipe        \Device\0000006b
Pipe        \Device\0000007c
Pipe        \Device\HarddiskVolume1
Pipe        \Device\HarddiskVolume2
Pipe        \Device\HarddiskVolume3
Pipe        \Device\KsecDD
Pipe        \Device\MountPointManager
Pipe        \device\namedpipe\samr
Pipe        \Device\Ndis
Pipe        \Device\NDMP10
Pipe        \Device\NDMP11
Pipe        \Device\NDMP12
Pipe        \Device\NDMP13
Pipe        \Device\NDMP14
Pipe        \Device\NDMP5
Pipe        \Device\NDMP6
Pipe        \Device\NDMP7
Pipe        \Device\NDMP9
Pipe        \Device\SYMEFASI
Pipe        \Device\SymIDSCoInj
Pipe     O  \Device\Afd
Pipe     O  \Device\Nsi
WinCls      -------------------------------
WinCls   O  OleMainThreadWndClass
WinCls   O  Shell_TrayWnd
WinCls   X  firefoxMessageWindow

B) Access log when the opening of Firefox failed:

Code: Select all

(Drive)     \Device\CdRom0
(Drive)     \Device\CdRom1
(Drive)     \Device\HarddiskVolume2
(Drive)     \Device\HarddiskVolume3
Clsid       -------------------------------
Clsid       {BCDE0395-E52F-467C-8E3D-C4579291692E} MMDeviceEnumerator class
Clsid    O  {8BC3F05E-D86B-11D0-A075-00C04FB68820} Windows Management and Instrumentation
File/Key    -------------------------------
Image       -------------------------------
Image       *:\program files\mozilla firefox\firefox.exe
Image       *:\program files\sandboxie\sandboxiedcomlaunch.exe
Image       *:\program files\sandboxie\sandboxierpcss.exe
Image       *:\program files\sandboxie\start.exe
Image       *:\windows\system32\ctfmon.exe
Image       c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
Image       c:\program files\mozilla firefox\browser\components\browsercomps.dll
Image       c:\program files\mozilla firefox\freebl3.dll
Image       c:\program files\mozilla firefox\icudt52.dll
Image       c:\program files\mozilla firefox\icuin52.dll
Image       c:\program files\mozilla firefox\icuuc52.dll
Image       c:\program files\mozilla firefox\mozglue.dll
Image       c:\program files\mozilla firefox\msvcp120.dll
Image       c:\program files\mozilla firefox\msvcr120.dll
Image       c:\program files\mozilla firefox\nss3.dll
Image       c:\program files\mozilla firefox\nssckbi.dll
Image       c:\program files\mozilla firefox\nssdbm3.dll
Image       c:\program files\mozilla firefox\sandboxbroker.dll
Image       c:\program files\mozilla firefox\softokn3.dll
Image       c:\program files\mozilla firefox\xul.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\ccipc.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\cclib.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\ccvrtrst.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\efacli.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\msvcp110.dll
Image       c:\program files\norton internet security\engine\22.5.4.24\msvcr110.dll
Image       c:\program files\norton internet security\nortondata\22.5.0.124\definitions\ipsdefs\20151023.001\ipseng32.dll
Image       c:\program files\sandboxie\sbiedll.dll
Image       c:\windows\system32\advapi32.dll
Image       c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
Image       c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Image       c:\windows\system32\apphelp.dll
Image       c:\windows\system32\audioses.dll
Image       c:\windows\system32\bcrypt.dll
Image       c:\windows\system32\cfgmgr32.dll
Image       c:\windows\system32\clbcatq.dll
Image       c:\windows\system32\comdlg32.dll
Image       c:\windows\system32\credssp.dll
Image       c:\windows\system32\crypt32.dll
Image       c:\windows\system32\cryptbase.dll
Image       c:\windows\system32\cryptsp.dll
Image       c:\windows\system32\d2d1.dll
Image       c:\windows\system32\d3d11.dll
Image       c:\windows\system32\dbghelp.dll
Image       c:\windows\system32\devobj.dll
Image       c:\windows\system32\dnsapi.dll
Image       c:\windows\system32\dui70.dll
Image       c:\windows\system32\duser.dll
Image       c:\windows\system32\dwmapi.dll
Image       c:\windows\system32\dwrite.dll
Image       c:\windows\system32\dxgi.dll
Image       c:\windows\system32\explorerframe.dll
Image       c:\windows\system32\fwpuclnt.dll
Image       c:\windows\system32\gdi32.dll
Image       c:\windows\system32\iertutil.dll
Image       c:\windows\system32\imm32.dll
Image       c:\windows\system32\iphlpapi.dll
Image       c:\windows\system32\kernel32.dll
Image       c:\windows\system32\kernelbase.dll
Image       c:\windows\system32\lpk.dll
Image       c:\windows\system32\mmdevapi.dll
Image       c:\windows\system32\msasn1.dll
Image       c:\windows\system32\mscms.dll
Image       c:\windows\system32\msctf.dll
Image       c:\windows\system32\msctfmonitor.dll
Image       c:\windows\system32\msimg32.dll
Image       c:\windows\system32\msutb.dll
Image       c:\windows\system32\msvcr100.dll
Image       c:\windows\system32\msvcrt.dll
Image       c:\windows\system32\mswsock.dll
Image       c:\windows\system32\msxml6.dll
Image       c:\windows\system32\napinsp.dll
Image       c:\windows\system32\netapi32.dll
Image       c:\windows\system32\netutils.dll
Image       c:\windows\system32\nlaapi.dll
Image       c:\windows\system32\normaliz.dll
Image       c:\windows\system32\nsi.dll
Image       c:\windows\system32\ntdll.dll
Image       c:\windows\system32\ntdsapi.dll
Image       c:\windows\system32\ntmarta.dll
Image       c:\windows\system32\nvwgf2um.dll
Image       c:\windows\system32\ole32.dll
Image       c:\windows\system32\oleaut32.dll
Image       c:\windows\system32\pdh.dll
Image       c:\windows\system32\pnrpnsp.dll
Image       c:\windows\system32\profapi.dll
Image       c:\windows\system32\propsys.dll
Image       c:\windows\system32\psapi.dll
Image       c:\windows\system32\rasadhlp.dll
Image       c:\windows\system32\rpcepmap.dll
Image       c:\windows\system32\rpcrt4.dll
Image       c:\windows\system32\rpcrtremote.dll
Image       c:\windows\system32\rpcss.dll
Image       c:\windows\system32\rsaenh.dll
Image       c:\windows\system32\samcli.dll
Image       c:\windows\system32\samlib.dll
Image       c:\windows\system32\sechost.dll
Image       c:\windows\system32\secur32.dll
Image       c:\windows\system32\setupapi.dll
Image       c:\windows\system32\shell32.dll
Image       c:\windows\system32\shlwapi.dll
Image       c:\windows\system32\srvcli.dll
Image       c:\windows\system32\sspicli.dll
Image       c:\windows\system32\sxs.dll
Image       c:\windows\system32\user32.dll
Image       c:\windows\system32\userenv.dll
Image       c:\windows\system32\usp10.dll
Image       c:\windows\system32\uxtheme.dll
Image       c:\windows\system32\version.dll
Image       c:\windows\system32\wbem\fastprox.dll
Image       c:\windows\system32\wbem\wbemprox.dll
Image       c:\windows\system32\wbem\wbemsvc.dll
Image       c:\windows\system32\wbemcomn.dll
Image       c:\windows\system32\webio.dll
Image       c:\windows\system32\wevtapi.dll
Image       c:\windows\system32\winhttp.dll
Image       c:\windows\system32\wininet.dll
Image       c:\windows\system32\winmm.dll
Image       c:\windows\system32\winnsi.dll
Image       c:\windows\system32\winrnr.dll
Image       c:\windows\system32\winsta.dll
Image       c:\windows\system32\wintrust.dll
Image       c:\windows\system32\wkscli.dll
Image       c:\windows\system32\wldap32.dll
Image       c:\windows\system32\wpc.dll
Image       c:\windows\system32\ws2_32.dll
Image       c:\windows\system32\wship6.dll
Image       c:\windows\system32\wshtcpip.dll
Image       c:\windows\system32\wsock32.dll
Image       c:\windows\system32\wtsapi32.dll
Image       c:\windows\system32\xmllite.dll
Image       c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
Image       c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
Ipc         -------------------------------
Ipc         \BaseNamedObjects\__ComCatalogCache__
Ipc         \BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
Ipc         \BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
Ipc         \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000002f.db
Ipc         \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db
Ipc         \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
Ipc         \BaseNamedObjects\C__Program Files_Norton Internet Security_NortonData_22.5.0.124_Definitions_IPSDefs_20151023.001
Ipc         \BaseNamedObjects\CINJR
Ipc         \BaseNamedObjects\RotHintTable
Ipc         \BaseNamedObjects\windows_shell_global_counters
Ipc         \RPC Control\actkernel
Ipc         \RPC Control\epmapper
Ipc         \RPC Control\OLE5362914313764CCD9DEB8D49D90F
Ipc         \RPC Control\plugplay
Ipc         \Sessions\1\BaseNamedObjects\__ComCatalogCache__
Ipc         \Sessions\1\BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
Ipc         \Sessions\1\BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
Ipc         \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000002f.db
Ipc         \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db
Ipc         \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
Ipc         \Sessions\1\BaseNamedObjects\C:*Users*****AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000ca0.db
Ipc         \Sessions\1\BaseNamedObjects\C:*Users*****AppData*Local*Microsoft*Windows*Caches*cversions.1.ro
Ipc         \Sessions\1\BaseNamedObjects\C__Program Files_Norton Internet Security_NortonData_22.5.0.124_Definitions_IPSDefs_20151023.001
Ipc         \Sessions\1\BaseNamedObjects\CINJR
Ipc         \Sessions\1\BaseNamedObjects\ComPlusCOMRegTable
Ipc         \Sessions\1\BaseNamedObjects\FirefoxStartupMutex
Ipc         \Sessions\1\BaseNamedObjects\RotHintTable
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_1916
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4284
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4376
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4948
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_5312
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_652
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_RPCSS_SXS_READY
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_DcomLaunch
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_Mutex1
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcEptMapper
Ipc         \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcSs
Ipc         \Sessions\1\BaseNamedObjects\ScmCreatedEvent
Ipc         \Sessions\1\BaseNamedObjects\windows_shell_global_counters
Ipc      O  \BaseNamedObjects\CGSCE
Ipc      O  \BaseNamedObjects\CNDIE
Ipc      O  \BaseNamedObjects\CSECE
Ipc      O  \BaseNamedObjects\IDS_STORAGE_MUTEX
Ipc      O  \KernelObjects\MaximumCommitCondition
Ipc      O  \KnownDlls\advapi32.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-advapi32-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-normaliz-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-ole32-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-user32-l1-1-0.dll
Ipc      O  \KnownDlls\api-ms-win-downlevel-version-l1-1-0.dll
Ipc      O  \KnownDlls\CFGMGR32.dll
Ipc      O  \KnownDlls\clbcatq.dll
Ipc      O  \KnownDlls\COMDLG32.dll
Ipc      O  \KnownDlls\CRYPT32.dll
Ipc      O  \KnownDlls\DEVOBJ.dll
Ipc      O  \KnownDlls\gdi32.dll
Ipc      O  \KnownDlls\IERTUTIL.dll
Ipc      O  \KnownDlls\IMM32.dll
Ipc      O  \KnownDlls\kernel32.dll
Ipc      O  \KnownDlls\kernelbase.dll
Ipc      O  \KnownDlls\LPK.dll
Ipc      O  \KnownDlls\MSASN1.dll
Ipc      O  \KnownDlls\MSCTF.dll
Ipc      O  \KnownDlls\MSVCRT.dll
Ipc      O  \KnownDlls\NORMALIZ.dll
Ipc      O  \KnownDlls\NSI.dll
Ipc      O  \KnownDlls\ole32.dll
Ipc      O  \KnownDlls\OLEAUT32.dll
Ipc      O  \KnownDlls\profapi.dll
Ipc      O  \KnownDlls\PSAPI.DLL
Ipc      O  \KnownDlls\rpcrt4.dll
Ipc      O  \KnownDlls\Setupapi.dll
Ipc      O  \KnownDlls\SHELL32.dll
Ipc      O  \KnownDlls\SHLWAPI.dll
Ipc      O  \KnownDlls\user32.dll
Ipc      O  \KnownDlls\USERENV.dll
Ipc      O  \KnownDlls\USP10.dll
Ipc      O  \KnownDlls\WININET.dll
Ipc      O  \KnownDlls\WINTRUST.dll
Ipc      O  \KnownDlls\WLDAP32.dll
Ipc      O  \KnownDlls\WS2_32.dll
Ipc      O  \RPC Control\{3403BA4D-EA56-4918-9AD2-E4BAEF269BAB}
Ipc      O  \RPC Control\{CE3B7248-C151-4073-A76C-8CB802FDD36A}
Ipc      O  \RPC Control\AudioClientRpc
Ipc      O  \RPC Control\Audiosrv
Ipc      O  \RPC Control\DNSResolver
Ipc      O  \RPC Control\lsapolicylookup
Ipc      O  \RPC Control\LSARPC_ENDPOINT
Ipc      O  \RPC Control\lsasspirpc
Ipc      O  \RPC Control\SbieSvcPort
Ipc      O  \Security\LSA_AUTHENTICATION_INITIALIZED
Ipc      O  \Sessions\1\BaseNamedObjects\CicLoadWinStaWinSta0
Ipc      O  \Sessions\1\BaseNamedObjects\MSCTF.Asm.MutexSandboxie_Desktop_794351
Ipc      O  \Sessions\1\BaseNamedObjects\MSCTF.CtfMonitorInstMutexDefault1
Ipc      O  \Sessions\1\Windows\SharedSection
Pipe        -------------------------------
Pipe        \Device\0000006b
Pipe        \Device\0000007c
Pipe        \Device\HarddiskVolume1
Pipe        \Device\HarddiskVolume2
Pipe        \Device\HarddiskVolume3
Pipe        \Device\KsecDD
Pipe        \Device\MountPointManager
Pipe        \device\namedpipe\samr
Pipe        \Device\Ndis
Pipe        \Device\NDMP10
Pipe        \Device\NDMP11
Pipe        \Device\NDMP12
Pipe        \Device\NDMP13
Pipe        \Device\NDMP14
Pipe        \Device\NDMP5
Pipe        \Device\NDMP6
Pipe        \Device\NDMP7
Pipe        \Device\NDMP9
Pipe        \Device\SYMEFASI
Pipe        \Device\SymIDSCoInj
Pipe     O  \Device\Afd
Pipe     O  \Device\Nsi
WinCls      -------------------------------
WinCls   O  OleMainThreadWndClass
WinCls   O  Shell_TrayWnd
WinCls   X  firefoxMessageWindow