Virtual account

[tzuk]

I vaguely remember discussing this before, at least about the question of the tray icons. Anyway Sandboxie Control can't do very much when it's sandboxed, because it becomes an untrusted sandboxed process. The solution is ... (drum roll) ... don't run Sandboxie Control in your sandboxed desktop.

[street011]

okay, now... when i start the explorer (shell) sandboxed from the beginning, thus sandboxing all following child processes... how would i go and exclude SBControl from being sandboxed...
Now i don't need to have access to sbiecontrol, and it doesn't need to be visible or accessible in that specific profile.

[tzuk]

You can stop Sandboxie Control from auto-starting using the Configure -> Shell Integration window.

If you need more automation there, for instance if you have a script setting up your sandboxed desktop, then you can have that script manually remove the SandboxieControl value from the following registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

[street011]

well i disabled auto-start of sandboxiecontrol, but it still takes the same huge amount of time to load, also, i get not tray icons ofcourse, is there some way i can exclude sandboxie control from getting sandboxed? (im not aware of an exclude function)

[tzuk]

I don't understand, you're saying you stopped Sandboxie Control auto-start, and at the same time you repeat that you have trouble running Sandboxie Control sandboxed...? My advice is still the same: Just don't run Sandboxie Control sandboxed.

[street011]

well, as i understand, sandboxiecontrol is the component that loads tray icons...
as long as i can't start SBControl UNsandboxed someway (by excluding it someway in the config file), i can't see tray icons...

well tray icons are very usefull for accessing my programms :p so i kinda need sandboxie control to run, but UNsandboxed....

[tzuk]

well, as i understand, sandboxiecontrol is the component that loads tray icons...

I did not realize you were making this assumption. No, I'm afraid Sandboxie Control is only in charge of its own tray icon, that is, the Sandboxie tray icon. It has nothing at all to do with other tray icons.

It probably has to do with Sandboxie configuring Explorer to start in non-desktop mode. How about a taskbar, a desktop wallpaper? Do you get those?

[street011]

i get a desktop with icons and a startbar with time and quickstart, but no tray icons from ehh msn for example.
(i dont know about wallpaper havent set one yet, but its not realy important to me, i'll try wallpaper when i find a nice picture )

[edit]
found one with big round thingies, it works shows well on background
[/edit]

[tzuk]

Well, I guess desktop icons are as good an indication of a "full desktop Explorer" as a desktop wallpaper. Like I said, Sandboxie is configuring Explorer to start in non-desktop mode. Which means you had to do something to get Explorer to start in full desktop mode. I don't know what you did, but maybe that caused the tray icon problem.

[street011]

i didn't do anything special,
clean windows xp (sp2) installation, changed the registry: HKLM/Softwar/Microsoft/Windows NT/WinLogon/shell="c:\program files\sandboxie\start.exe" explorer.exe

rebooted and my explorer starts in shell mode, sandboxed

[tzuk]

Add an OpenKeyPath for that Winlogon\Shell key, delete the sandbox, and try a sandboxed session again. (ReadKeyPath may also be ok here, but try OpenKeyPath first.)

[street011]

how would adding that openkey make any difference regarding speed or tray icons, or allow sandboxiecontrol to be run unsandboxed?

[tzuk]

I think you should try it. It's only worth explaining if it makes any difference. Remember to delete your sandbox after adding the OpenKeyPath.

[street011]

i did as proposed, but it didn't do anything...
this is my config:

Code: Select all

[GlobalSettings]


[DefaultBox]

ConfigLevel=2
AutoRecover=y
AutoRecoverIgnore=.jc!
AutoRecoverIgnore=.part
RecoverFolder=%Personal%
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
LingerProcess=devldr32.exe
LingerProcess=syncor.exe
LingerProcess=jusched.exe
LingerProcess=acrord32.exe
Enabled=y
OpenKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft\Windows NT\CurrentVersion\Winlogon

[UserSettings_4BC00582]

SbieCtrl_UserName=administrator
SbieCtrl_ShowWelcome=N
SbieCtrl_NextUpdateCheck=1202422928
SbieCtrl_UpdateCheckNotify=Y
SbieCtrl_WindowLeft=133
SbieCtrl_WindowTop=112
SbieCtrl_WindowWidth=652
SbieCtrl_WindowHeight=450
SbieCtrl_Hidden=Y
SbieCtrl_ActiveView=40021
SbieCtrl_BoxExpandedView_DefaultBox=Y
SbieCtrl_AutoApplySettings=N
SbieCtrl_EnableLogonStart=N
SbieCtrl_EnableAutoStart=N
SbieCtrl_AddDesktopIcon=Y
SbieCtrl_AddQuickLaunchIcon=Y
SbieCtrl_AddContextMenu=Y
SbieCtrl_AddSendToMenu=Y
SbieCtrl_ColWidthProcName=250
SbieCtrl_ColWidthProcId=70
SbieCtrl_ColWidthProcTitle=310

[UserSettings_0C8E021F]

SbieCtrl_UserName=nicky
SbieCtrl_ShowWelcome=N
SbieCtrl_NextUpdateCheck=1201645242
SbieCtrl_UpdateCheckNotify=Y
SbieCtrl_EnableLogonStart=N
SbieCtrl_EnableAutoStart=N
SbieCtrl_AddDesktopIcon=Y
SbieCtrl_AddQuickLaunchIcon=Y
SbieCtrl_AddContextMenu=Y
SbieCtrl_AddSendToMenu=Y
SbieCtrl_WindowLeft=200
SbieCtrl_WindowTop=150
SbieCtrl_WindowWidth=660
SbieCtrl_WindowHeight=450
SbieCtrl_Hidden=N
SbieCtrl_ActiveView=40021
SbieCtrl_ColWidthProcName=250
SbieCtrl_ColWidthProcId=70
SbieCtrl_ColWidthProcTitle=310
SbieCtrl_BoxExpandedView_DefaultBox=Y

[tzuk]

You need to make the sandboxed Windows explorer see that the contents of the Winlogon\Shell value is "explorer.exe" (or maybe even C:\Widows\explorer.exe).

The idea with the OpenKeyPath was to stop Sandboxie from changing this value itself (because Sandboxie doesn't do that trick if the key is open), but ... on second thought ... it's meaningless because you already changed this value yourself to "Start.exe explorer.exe".

So, try using AutoExec settings to populate the sandboxed registry with the value "explorer.exe". Or set your shell to something that first fixes the registry to say "explorer.exe" there, then launches explorer.

The idea is that by the time sandboxed explorer starts, it should see just "explorer.exe" in that value.