Windows explorer closes automatic

[Faustenhammer]

When I want to copy a file and open windows explorerer in the sandbox, explorer is automatically closed when I select any folder. Im am using sandboxie since 1,5 years. At the beginning it was no problem. Maybe this is since the last update.

Sandboxie version 5.10 (licensed version)
OS Windows 7 64 bit

[Craig@Invincea]

Delete the contents of your sandbox.

Any new / installed Antivirus / Anti-malware?

[Faustenhammer]

Today I created a new sandbox but it is the same problem. We are using McAfee, but its not new installed. Even when I deactivate McAfee its the same.

[bo.elam]

Faustenhammer, even though the new sandbox did not work, remove it and try creating another one. And leave default settings in place, in other words, allow all programs to run and connect and dont tick Drop rights. Dont copy settings from any existing sandbox. McAfee SiteAdvisor conflicts with SBIE, remove it if you are using it or if its installed in the computer. Test and see what happens.

Bo

[Faustenhammer]

I removed sandbox and created a new one with default settings (same as yesterday), still the same problem. We are using MvAfee VirusScan Enterprise + AntiSpyware Enterprise 8.8. As this is a company computer I am not allowed to remove McAfee. Any other possibility?

[Faustenhammer]

No more idea ?

[Craig@Invincea]

It appears that the McAfee product could be the cause, and thus that would have to be disabled (or removed) to rule that out. Usually, this is the #1 conflict..

[Faustenhammer]

Today I took an other PC in our company, uninstalled McAffe and disabled Firewall. Then I installed sandboxie 5.10. But there is the same problem, windows explorer closes automatic.

[Craig@Invincea]

Today I took an other PC in our company, uninstalled McAffe and disabled Firewall. Then I installed sandboxie 5.10. But there is the same problem, windows explorer closes automatic.

If it's a company machine, there are could be GPO's at play causing a conflict as well as other unknown security precautions that are causing this. I'd look there first and check with your IT and ask them about domain and GPO policies that may have been implemented.

Nothing in SBIE would cause that, and you're the only issue we've seen on it.

[Faustenhammer]

I contacted our IT and they checked log files on windows and mcaffe. There was no entry that something blocks Sandboxie. Then they moved my user to a group with no GPO´s (except password) and no security precautions. But still the same problem. Even when I start PC as local user it is not working. Is there any possibility to enable logfile on sandboxie to see what happens?
Additional I tried at home on my PC and sandboxie works. But I have Win7 home and in company we have Win7 pro.

[Craig@Invincea]

Procmon would be the next thing to try and log..

Get procmon here (free) https://technet.microsoft.com/en-us/sys ... 96645.aspx

Steps
Close any programs that are not needed.
Run Procom (not sandboxed)
and then try and open Windows Explorer (sandboxed of course).
Let the error happen/not load/etc
stop capturing events in Procmon (under file)
then Save the results (under file, make sure "save all events it ticked") and
save in PML format.
These files can be large, so post somewhere we can download and look (link)
OR (Please zip them!) and send to Support@sandboxie.com

[Faustenhammer]

OK, you can download logfile from our File Exchange Server

https://eurofex.horiba.com/fop/0THJmsn0/Logfile.zip

[Craig@Invincea]

Ok, a few things.

One, Audiodg.exe seems to be loading up much more than it should (and it really should not be) and it's known to cause an issue in Windows Vista-7. This is a MS hotfix to stop memory leaks bc of this, And it could cause issues with SBIE. Maybe your IT can look at MS KB https://support.microsoft.com/en-us/kb/981013 to confirm? [It's an old Hotfix, so I hope it is already present.]

Two: McAfee is still present on your system

mcafee.JPG (42.21 KiB) Viewed 1224 times

[Faustenhammer]

When I try the hotfix I get the error message: Update not working with your system. Even if the hotfix is for Win7 and we have Win7. I tried on two different PC but on both the same problem.

[Curt@invincea]

The sandboxed explorer.exe is crashing for some reason. It is then unable to run werfault.exe to report the crash.

Code: Select all

4:50:29.6795212 AM	svchost.exe	6940	756	6508	NT-AUTORITÄT\SYSTEM	CreateFile	C:\Windows\System32\WerFault.exe	ACCESS DENIED	Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\ANONYMOUS LOGON

I expect that it is either McAfee or DigitalPersona interfering. Try disabling/removing these.

ExplorerCrash.jpg (153.96 KiB) Viewed 1215 times