Sandboxie and AppGuard Help

[AaLF]

post deleted. Wasn't a SB/AG clash.

[AaLF]

SandboxiE Vs. AppGuard

When I try & launch SB FF browser I get a banner saying "FF is already running- not responding." And the SB browser doesn't launch.

APPGUARD EVENT LOG

10/19/12 22:54:49 Prevented process <Firefox> from writing to <c:\sandbox\aalf\defaultbox\user\current\appdata\roaming\mozilla\firefox\profiles\c8sb854r.default>.

To fix the problem I try & clear the sandbox:
APPGUARD EVENT LOG

10/19/12 22:55:58 Prevented process <Windows Command Processor> from writing to <c:\sandbox\aalf\__delete_defaultbox_01cdadf05bbc5eec>

.

[chris1341]

Been using SBIE and AppGuard on Win7 x 64 since it was made possible by power apps and never seen that.

It looks like the Sandbox container (C:Sandbox) has not been added to user space in AppGuard but from your other posts it looks like you've done that. If not you should, it is fundamental to how AppGuard works that it won't allow guarded apps to write to anything other than user space.

You could try moving the Sandboxie container to user space, somewhere in C:Users for example, or to another partition if you have one.

Can I also ask how you are invoking the Sandbox in the first place? Are the programmes forced or are using shortcuts/right click send to? Start.exe is used in the send to scenario and sandboxierpcss.exe when forced and it can make a difference for set up.

Thanks

[pegr]

Originally Posted by AaLF

SandboxiE Vs. AppGuard

When I try & launch SB FF browser I get a banner saying "FF is already running- not responding." And the SB browser doesn't launch.

APPGUARD EVENT LOG


To fix the problem I try & clear the sandbox:
APPGUARD EVENT LOG
.

Both of these errors are occurring because the sandbox container folder hasn't been given write access for guarded applications in AppGuard. As I explained in post #50 - and chris1341 has reinforced - you must do this or Sandboxie won't work with AppGuard. You can either do this by making the Sandboxie container folder an exception folder within AppGuard, or you can relocate it to another partition or RAM disk if you have one.

Whether you need to do any more than this will depend on what blocked events relating to Sandboxie you are seeing. This partially depends on which OS version you are using, also on which Sandboxie features you use: e.g. forced programs, launching applications sandboxed via the start menu, etc. On 32-bit Windows XP, I didn't need to do anything else to use the full feature set of Sandboxie; on 64-bit Windows 7, you may need to add one or more Sandboxie executables as PowerApps or make MemoryGuard exceptions for them. The AppGuard alert panel will guide you as to what, if any, additional configuration is required.

[AaLF]

O.K. So as to learn, I've reinstalled SBxiE.

Added the 3 SbxiE EXEs' to Power Apps only.

Result:

On launching SB browser

SBIE1241 Cannot mount registry hive: [C0000034 / 22]

And corresponding log from AG:

10/20/12 08:39:44 Prevented process <Sandboxie Start> from writing to <c:\sandbox\aalf\defaultbox\reghive>.

I have another partition. How & what to do to relocate? What is next step?

[chris1341]

AaLF, I think you might still be missing the fundamental part that you need to add the Sandbox container to user space in AppGuard or physically move it there using Sandboxie settings. AppGuard by default knows C:\Sandbox is located in the root of your system partition so will never let guarded apps write to it unless you make one of the following changes I posted the SBIE forum way back in April:

;.....you can move the container to user space by opening Sandboxie Control, dropping down the Sandbox menu and selecting 'Set Sandbox Container' from the list and pick a location on another partition or in the User folder. Done. It will now work with AppGuard.

Or leave the Sandbox in the default location and open AppGuard GUI - go to Guarded Apps tab, press the Settings button, then add, navigate to C:\Sandbox and select. When added to the list click the 'deny access' next to it and a drop down will allow you to select read/write. Click Ok and OK and you're done. AppGuard will then allow apps to write to the container.'

You might need to add the following to Power Apps for it to work on x64 systems

sandboxierpcss.exe
sandboxiedcomlaunch.exe
sandboxiecrypto.exe

to cut down on AppGuard alerts also add SbieCtrl.exe to Power Apps.

This does work but you need to follow ALL the steps.

Cheers

[AaLF]

Yeee-haaa!!! SB is back. Way to Chris! Woooo.

[AaLF]

Originally Posted by chris1341

AaLF, I think you might still be missing the fundamental part that you need
;[i].....you can move the container to user space by opening Sandboxie Control, dropping down the Sandbox menu and selecting 'Set Sandbox Container' from the list and pick a location on another partition or in the User folder. Done. It will now work with AppGuard.


You might need to add the following to Power Apps for it to work on x64 systems

sandboxierpcss.exe
sandboxiedcomlaunch.exe
sandboxiecrypto.exe

to cut down on AppGuard alerts also add SbieCtrl.exe to Power Apps.

This does work but you need to follow ALL the steps.

Cheers

I did the above as followed 2 or 3 days back. But since then, thought I didn't pay attention at the time, my sandboxie browser icon died. Now just a naked button. today I opened the SB folder. They're all naked.

So what do you think?

[chris1341]

No idea why that would happen. What method did you use to resolve the issues - move the Sandbox to user space or add the default location to AppGuard exceptions?

Anyway neither should cause it or at least didn't for me. Re-installing Sandboxie might bring back the icons back.

Cheers

[kupo]

Originally Posted by AaLF

I did the above as followed 2 or 3 days back. But since then, thought I didn't pay attention at the time, my sandboxie browser icon died. Now just a naked button. today I opened the SB folder. They're all naked.

So what do you think?

I don't think that losing the icon is a big thing, as long as it's still working, sometimes that happnes to my HitmanPro icon and I just reinstalled an it came back.

[AaLF]

The problem was bigger than Appguard. There were a few spot rebellions happening. My first Win7x64 install was showing insurrection tendencies. The problem is now solved. Win7x64 v1.01 has been deleted & replaced. Thanks to Drive(by) Snapshot v1.40.