An interesting file in my Sandboxie sandbox

Discussion in 'sandboxing & virtualization' started by Keyboard_Commando, Oct 26, 2011.

Thread Status:
Not open for further replies.
  1. Keyboard_Commando

    Keyboard_Commando Registered Member

    Joined:
    Mar 6, 2009
    Posts:
    690
    So I decided to take a look in my Sandboxie sandbox location and see if everything is still good. Just checking to make sure everything has been deleted. I noticed there is a file I've never seen before. I can only imagine it's an audio alert when something in the sandbox contravenes a rule?

    Screenshot_2.png

    Anyone else seen this in their sandbox location?

    And yes, that is right ... the date says 1980, for those that missed it.

    Screenshot_3.png

    I don't know which to be weirded out most by. I have never seen another file appear in the sandbox ... or the fact I might have actually traveled back in time at some point.

    Anyway this file appears to be a legit Microsoft file and has a legit location on my computer (Win 7). A Microsoft Ringtone Editor, whatever that is.

    Screenshot_4.png

    Any ideas anyone?

    Have a traveled back in time? Does this file appear now as part of Sandboxie? Any ideas how it might have got here?

    *Twilight Zone theme*
     
  2. mick92z

    mick92z Registered Member

    Joined:
    Apr 27, 2007
    Posts:
    499
    Location:
    Nottingham
    I have the same file in the system 32 folder, not in sandboxie.
    The one in your SB is 0 kb. See if a reboot gets rid of it
     
  3. Keyboard_Commando

    Keyboard_Commando Registered Member

    Joined:
    Mar 6, 2009
    Posts:
    690
    I still have it there after reboot, and all the sandboxies are clean.

    I can't really think how it's there. A mystery.
     
  4. user0803y11

    user0803y11 Registered Member

    Joined:
    Aug 3, 2011
    Posts:
    5
    Hi, as I read from the Sandboxie forum, whenever a sandboxed program try to delete a file from the "real" system, the way Sandboxie deals with this is to create a zero-length file in the sandbox with the same name and an "illegal" creation time. This is supposed to mark the file as "deleted" to the sandboxed program.

    You can experiment with a sandboxed windows explorer, for example. From there, delete some test files from your real system and observe what happens in the sandbox.

    I don't know why the file shown in your screenshot appears to be outside the sandbox folder, though. Maybe you set some sandbox's "FileRootPath" to point to that directory?
     
  5. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    3,770
    Location:
    Nicaragua
    The only thing that I can think of is that maybe you moved the file inadvertently
    by dragging it and dropping the file in the SBIE folder. I done that before.
    On my XP, that file don't show up anywhere. I don't think it has anything to do with SBIE.

    Bo
     
  6. cgeek

    cgeek Registered Member

    Joined:
    Mar 31, 2010
    Posts:
    328
    Keyboard_Commando,
    By chance are you using Eraser to delete your sandboxes?
     
  7. Keyboard_Commando

    Keyboard_Commando Registered Member

    Joined:
    Mar 6, 2009
    Posts:
    690
    Hi, this sounds the most plausible reason. And no, nothing is set to that file location.

    Yes I am using Eraser. This is why I check the sandboxes every now and then to make sure everything is being deleted. I have had problems in the past with both Eraser and RMDIR not working 100%.

    Thanks for the replies.
     
  8. cgeek

    cgeek Registered Member

    Joined:
    Mar 31, 2010
    Posts:
    328
    I ask because I've been having issues with Eraser leaving strange files behind after deletion. Just yesterday I deleted a pdf file and it left wermgr.exe in my documents folder where the pdf once was. So, I took a peek into the system 32 folder and it was there as well. Further investigation lead to that it was the exact same file. This same scenario has happened before in the past and has left bios1.rom in place of my deleted sandboxie folder. I have no idea how to reproduce the issue but again has been happening every so often. :doubt:
     
    Last edited: Oct 27, 2011
Loading...
Thread Status:
Not open for further replies.