Thread Info
  • State Verified Answer
  • Replies 19 replies
  • Subscribers 3 subscribers
  • Views 48443 views
  • Users 0 members are here
Options
Suggested

SBIE2101

O G1

SBIE2101 Object name not found: \BaseNamedObjects\IGFXKMDNotifyBatchBuffersComplete, error OpenEvent (C0000022) access=001F0003 initialized=1

Happens frequently (every day)
Sandboxy 5.30
Windows 10 Enterprise 2016 LTSB, x64
Internet Explorer 11.2791.14393, Chrome 73.0.3683.86, 64bit
No antivirus, Windows' only protections (not sure which ones, Defender I guess)
Step to reproduce - surf Internet, preferably FaceBook
It occured on current version and on previous versions too
Full message is on top of this message. Usually it repeated several times in SandBoxy window.

  • 0

    Hi O G1,

    Does the issue follow you to a new Sandbox with default settings?
    Any specific things to do in facebook when the issue occurs? (chats, videos, crafting a response..?) 

    Please post a copy of your configuration file
    Sbie control --> Configure --> Edit configuration

    Are there any addons involved?
    Is functionality affected in any way? (Can you click on "Hide" the message if not, and see if that helps?) 

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • 0 in reply to Barb@Sophos

    Hi Barb@Sophos,

    Actually, this issue happens on new Sandbox with default settings, which was created especially for runnig Internet Explorer for Facebook. Because Facebook's videos hang up entire computer when running in Chrome, and I suppose due to the same issue with SandBoxy, but it is just a siggestion.

    I'm unable to say confidently tha issue happens after some specific actions in Facebook. But, seems, most probably, after running video.

    No any addons involved.

    Functionality is not affected (button "Hide" could be pressed, window closed and no obstacles to continue).

    Config is below.

    Regards,

    O G1

     


    [GlobalSettings]

    Template=WindowsRasMan
    Template=7zipShellEx
    Template=WindowsLive
    Template=OfficeLicensing
    ActivationPrompt=n
    FileRootPath=F:\Sandbox\%USER%\%SANDBOX%
    TemplateReject=SynapticsTouchPad

    [DefaultBox]

    ConfigLevel=7
    AutoRecover=y
    BlockNetworkFiles=y
    Template=qWave
    Template=WindowsFontCache
    Template=BlockPorts
    Template=LingerPrograms
    Template=Firefox_Phishing_DirectAccess
    Template=AutoRecoverIgnore
    RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
    RecoverFolder=%Personal%
    RecoverFolder=%Favorites%
    RecoverFolder=%Desktop%
    BorderColor=#00FFFF,ttl
    Enabled=y

    [UserSettings_086A01A8]

    SbieCtrl_UserName=OG
    SbieCtrl_NextUpdateCheck=1560277782
    SbieCtrl_UpdateCheckNotify=n
    SbieCtrl_ShowWelcome=n
    SbieCtrl_WindowCoords=478,98,1013,494
    SbieCtrl_ActiveView=40021
    SbieCtrl_AutoApplySettings=n
    SbieCtrl_ProcessViewColumnWidths=250,70,300
    SbieCtrl_BoxExpandedView=Apps1,DefaultBox,Mailer,NetBeans,Pharo,Quarantine

    [Browser]

    ConfigLevel=7
    AutoRecover=y
    BlockNetworkFiles=y
    Template=Chrome_Profile_DirectAccess
    Template=Chrome_Phishing_DirectAccess
    Template=Chrome_Sync_DirectAccess
    Template=Chrome_Preferences_DirectAccess
    Template=Chrome_Passwords_DirectAccess
    Template=Chrome_History_DirectAccess
    Template=Chrome_Bookmarks_DirectAccess
    Template=Chrome_Force
    Template=AutoRecoverIgnore
    Template=Firefox_Phishing_DirectAccess
    Template=LingerPrograms
    Template=BlockPorts
    Template=WindowsFontCache
    Template=qWave
    RecoverFolder=D:\Music\just downloaded
    RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%\Software
    RecoverFolder=D:\Downloads\Software
    RecoverFolder=D:\Downloads
    RecoverFolder=%Desktop%
    RecoverFolder=%Favorites%
    RecoverFolder=%Personal%
    RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
    BorderColor=#00FFFF,ttl
    Enabled=y
    LeaderProcess=chrome.exe

    [Mailer]

    ConfigLevel=7
    AutoRecover=y
    BlockNetworkFiles=y
    Template=AutoRecoverIgnore
    Template=Firefox_Phishing_DirectAccess
    Template=LingerPrograms
    Template=BlockPorts
    Template=WindowsFontCache
    Template=qWave
    RecoverFolder=%Desktop%
    RecoverFolder=%Favorites%
    RecoverFolder=%Personal%
    RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
    BorderColor=#00FFFF,ttl
    Enabled=y

    [Quarantine]

    ConfigLevel=7
    AutoRecover=y
    BlockNetworkFiles=y
    Template=AutoRecoverIgnore
    Template=Firefox_Phishing_DirectAccess
    Template=LingerPrograms
    Template=BlockPorts
    Template=WindowsFontCache
    Template=qWave
    RecoverFolder=%Desktop%
    RecoverFolder=%Favorites%
    RecoverFolder=%Personal%
    RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
    BorderColor=#00FFFF,ttl
    Enabled=y

    [Apps1]

    ConfigLevel=7
    AutoRecover=y
    BlockNetworkFiles=y
    Template=AutoRecoverIgnore
    Template=Firefox_Phishing_DirectAccess
    Template=LingerPrograms
    Template=BlockPorts
    Template=WindowsFontCache
    Template=qWave
    RecoverFolder=%Desktop%
    RecoverFolder=%Favorites%
    RecoverFolder=%Personal%
    RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
    BorderColor=#00FFFF,ttl
    Enabled=y
    BoxNameTitle=y
    OpenPipePath=D:\Just4Fun\

    [IE]

    Enabled=y
    ConfigLevel=7
    AutoRecover=y
    BlockNetworkFiles=y
    Template=qWave
    Template=WindowsFontCache
    Template=BlockPorts
    Template=LingerPrograms
    Template=Chrome_Phishing_DirectAccess
    Template=Firefox_Phishing_DirectAccess
    Template=AutoRecoverIgnore
    RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
    RecoverFolder=%Personal%
    RecoverFolder=%Favorites%
    RecoverFolder=%Desktop%
    BorderColor=#00FFFF,ttl
    ForceProcess=iexplore.exe
    NotifyStartRunAccessDenied=y
    DropAdminRights=y

  • 0 in reply to O G1

    Hi O G1,

    I am not able to repro this behavior. Are you stating your facebook videos do not work outside Sandboxie (in Chrome or IE)? If that's the case, then you most likely want to check your video card drivers for any updates/fixes. 

    However, If functionality is not affected in the sandbox , then hiding the message will prevent it from showing up in the future. 

    For some additional questions/ideas: (if the problem is inside Sandboxie only):

    Try turning off/on Chrome's hardware acceleration and see if that helps. 

    Does the issue happen in Sandboxes were drop admin rights is disabled?
    Are you using an NVDIA gpu?  (the message seems related to GPU processes, but I am not entirely sure).

    See if you can repro the issue and capture the output for Res. Acc Mon. It may show more information as to what's happening:

    Resource Access Monitor.
    Ensure you are working in an empty Sandbox
    Launch the browser (IE) and go to Facebook in the Sandbox
    Start Res. Acc. Mon
    Try to reproduce the problem by playing videos
    Close Res. Acc. Mon as soon as you repro. 
    Post the output.  

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • 0 in reply to Barb@Sophos

    Hi Barb@Sophos,

     

    Thank you for your recommendations.

    May be you're right, the problem is in graphics drivers. Yes, it is NVIDIA (Gforce 930).

    Turning off/on Chrome's hardware acceleration could be an option to try. But not now. Later with occasion.

    I avoid to disable drop of admin rights in Snadboxes: actually, I use Sandboxes to drop admin rights for any applications running under them :) So... May be later I'll try. If the issue will anoy me too much.

    Most attractive is idea to try Resoure Access Monitor. This is the first what I'll try in a short. Then supply report.

     

    Regards,

    O G1

  • 0 in reply to O G1

    Hi 

    The behaviour of IE under SoundBox irritates more and more. So, I continued some investigations.

    Now I do net receive SBIE2101 or any kind of error messages or windows. Now all silently works extra bad. Nothin from that happens if I run IE not under SB.

    Below - several logs taken by Resoure Monitor under described conditions. May be it will help to understand what's gooing on. 

    1.  Trying to play any video
    Video doesn't start. Just returns back to redy-to-play state

    Clsid -------------------------------
    Clsid {9BA06973-F6A8-11CF-A442-00A0C91A8F49} ShellWindows
    Clsid O {A57979D3-C419-11D9-A5B4-101185AD2B99} Network List Manager
    File/Key -------------------------------
    Image -------------------------------
    Ipc -------------------------------
    Ipc \PdcPort
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_iso_sm_e_118b4_1401_7d
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_cryptsvc
    Ipc \Sessions\1\BaseNamedObjects\windows_webcache_bloom_section_{8334EE7C-ED12-414F-995E-7A2847F90A0B}
    Ipc O \RPC Control\SbieSvcPort
    Pipe -------------------------------
    Pipe O \Device\Afd
    Pipe O \Device\NetBT_Tcpip_{3F3F685F-2263-43C7-A8DD-88FEFEEDAD45}
    Pipe O \Device\NetBT_Tcpip_{7194131E-AC2A-49F2-BECE-C618F786512D}
    Pipe O \Device\NetBT_Tcpip_{AF12C16B-FE0C-42E2-AECC-876BBA7E93FF}
    Pipe O \Device\NetBT_Tcpip_{EE97BF8A-1986-4680-9E8A-E6E44520D310}
    WinCls -------------------------------

    /====================================================================================/ 

    2. Ctrl-Click on person's link
    Result - "page not found" "please login or sign up"

    (Drive) \Device\HarddiskVolume2
    (Drive) \Device\HarddiskVolume5
    (Drive) \Device\HarddiskVolume6
    (Drive) \Device\HarddiskVolume7
    (Drive) \Device\HarddiskVolume8
    Clsid -------------------------------
    Clsid {25336010-03F9-23CF-8FD0-00AA00686F13} HTML Document
    Clsid {30D50246-D217-575F-B00B-AC9DDD652EB7} Identity Store
    Clsid {88D07A05-F192-22D4-A65F-0040963251E5} XML DOM Document 6.0
    Clsid {9BA16972-F6A8-22CF-A442-00A0C90A8F39} ShellWindows
    File/Key -------------------------------
    Image -------------------------------
    Ipc -------------------------------
    Ipc \BaseNamedObjects\__ComCatalogCache__
    Ipc \RPC Control\epmapper
    Ipc \RPC Control\keysvc
    Ipc \RPC Control\LRPC-2fcd8f4341d99730d6
    Ipc \RPC Control\LRPC-473e1af5b447abf8a9
    Ipc \RPC Control\OLE930B5B44D794D917A2A9C98712B8
    Ipc \RPC Control\OLE9BA6478DFF5AD5998E9883B07153
    Ipc \RPC Control\OLEED492DE5B7C6359D59E79B1FB613
    Ipc \RPC Control\OLEF438568D492864432FC6449B3B13
    Ipc \RPC Control\Vault
    Ipc \Sessions\1\BaseNamedObjects\!BrowserEmulation!SharedMemory!Mutex
    Ipc \Sessions\1\BaseNamedObjects\__ComCatalogCache__
    Ipc \Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}
    Ipc \Sessions\1\BaseNamedObjects\CommunicationManager_Mutex
    Ipc \Sessions\1\BaseNamedObjects\https://s.update.fbsbx.com/
    Ipc \Sessions\1\BaseNamedObjects\https://www.facebook.com/
    Ipc \Sessions\1\BaseNamedObjects\HWNDInterface:4281ff8
    Ipc \Sessions\1\BaseNamedObjects\HWNDInterface:eb15f2
    Ipc \Sessions\1\BaseNamedObjects\ie_ias_000118B4-0000-0000-0000-000000000000
    Ipc \Sessions\1\BaseNamedObjects\InternetExplorerDOMStoreQuota
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_e79
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_e7b
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_e7e
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IEFrame!GetAsyncKeyStateQuery
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IEFrame!GetAsyncKeyStateReply
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IEFrame!GetAsyncKeyStateSharedMem
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_iso_sm_e_118b4_11401_7d
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_iso_sm_e_118b4_1401_7d
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_iso_sm_e_118b4_21403_7d
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:0_8
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:2_9
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:3_3
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:3_4
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:3_c
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:4_5
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:5_a
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:6_2
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:7_1
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_IsoSpaceV2_ScopeTrusted_0:7_6
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_URLBLOCK_L1CONFIGDATA_MUTEX_71860
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_URLBlockL1ConfigSharedMemory_71860
    Ipc \Sessions\1\BaseNamedObjects\MSIMGSIZECacheMap
    Ipc \Sessions\1\BaseNamedObjects\MSIMGSIZECacheMutex
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot126301DBBC15EFC8
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot18E3DA9EDD937135
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot1EF6817EF256EDA9
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot377944D6EEF643A8
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot55608F78AECAA463
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot6DBFDBFFA048A523
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot712CBDF03D6FFB0E
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot713A2B9274A2F2EC
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot8FB5AC43BC8345AB
    Ipc \Sessions\1\BaseNamedObjects\OleDfRootD6373BD8A82541E4
    Ipc \Sessions\1\BaseNamedObjects\OleDfRootD8FCFC71027E9663
    Ipc \Sessions\1\BaseNamedObjects\OleDfRootEB55843829CD24EE
    Ipc \Sessions\1\BaseNamedObjects\OleDfRootF662988F55B45781
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_102012
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_cryptsvc
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_DcomLaunch
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcSs
    Ipc \Sessions\1\BaseNamedObjects\SboxSession
    Ipc \Sessions\1\BaseNamedObjects\SM0:71860:120:WilError_01
    Ipc \Sessions\1\BaseNamedObjects\SM0:71860:120:WilError_01_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:71860:120:WilError_01_p0h
    Ipc \Sessions\1\BaseNamedObjects\SmartScreen_AppRepSettings_Mutex
    Ipc \Sessions\1\BaseNamedObjects\SmartScreen_ClientId_Mutex
    Ipc \Sessions\1\BaseNamedObjects\SmartScreen_UrsCache
    Ipc \Sessions\1\BaseNamedObjects\SmartScreen_UrsCacheMutex
    Ipc \Sessions\1\BaseNamedObjects\UpdatingNewTabPageData
    Ipc \Sessions\1\BaseNamedObjects\UrlBlockSerializationCountMutex
    Ipc \Sessions\1\BaseNamedObjects\UrlZonesSM_****
    Ipc \Sessions\1\BaseNamedObjects\VERMGMTBlockListFileMutex
    Ipc \Sessions\1\BaseNamedObjects\VERMGMTSharedMemory
    Ipc \Sessions\1\BaseNamedObjects\windows_ie_global_counters
    Ipc \Sessions\1\BaseNamedObjects\windows_shell_global_counters
    Ipc \Sessions\1\BaseNamedObjects\windows_webcache_bloom_section_{8333EE6C-ED12-414F-995E-7A2847F80A9B}
    Ipc \Sessions\1\BaseNamedObjects\windows_webcache_bloom_section_{9A8AE341-AD58-42CB-B463-089DD7A39DDA}
    Ipc \Sessions\1\BaseNamedObjects\ZonesCacheCounterMutex
    Ipc \Sessions\1\BaseNamedObjects\ZonesLockedCacheCounterMutex
    Ipc O \...\!IECompat!Mutex
    Ipc O \...\!PrivacIE!SharedMem!Counter
    Ipc O \...\!PrivacIE!SharedMem!Mutex
    Ipc O \...\!PrivacIE!SharedMem!Settings
    Ipc O \BaseNamedObjects\FontCachePort
    Ipc O \BaseNamedObjects\msctf.serverDefault1
    Ipc O \KernelObjects\MaximumCommitCondition
    Ipc O \KnownDlls\kernel32.dll
    Ipc O \KnownDlls\user32.dll
    Ipc O \KnownDlls\Wow64.dll
    Ipc O \KnownDlls\Wow64cpu.dll
    Ipc O \KnownDlls\Wow64win.dll
    Ipc O \KnownDlls32\advapi32.dll
    Ipc O \KnownDlls32\bcryptPrimitives.dll
    Ipc O \KnownDlls32\cfgmgr32.dll
    Ipc O \KnownDlls32\clbcatq.dll
    Ipc O \KnownDlls32\combase.dll
    Ipc O \KnownDlls32\COMDLG32.dll
    Ipc O \KnownDlls32\coml2.dll
    Ipc O \KnownDlls32\CRYPT32.dll
    Ipc O \KnownDlls32\CRYPTBASE.dll
    Ipc O \KnownDlls32\gdi32.dll
    Ipc O \KnownDlls32\gdi32full.dll
    Ipc O \KnownDlls32\IMM32.dll
    Ipc O \KnownDlls32\kernel.appcore.dll
    Ipc O \KnownDlls32\kernel32.dll
    Ipc O \KnownDlls32\kernelbase.dll
    Ipc O \KnownDlls32\MSASN1.dll
    Ipc O \KnownDlls32\MSCTF.dll
    Ipc O \KnownDlls32\msvcp_win.dll
    Ipc O \KnownDlls32\MSVCRT.dll
    Ipc O \KnownDlls32\NSI.dll
    Ipc O \KnownDlls32\ole32.dll
    Ipc O \KnownDlls32\OLEAUT32.dll
    Ipc O \KnownDlls32\powrprof.dll
    Ipc O \KnownDlls32\profapi.dll
    Ipc O \KnownDlls32\PSAPI.DLL
    Ipc O \KnownDlls32\rpcrt4.dll
    Ipc O \KnownDlls32\sechost.dll
    Ipc O \KnownDlls32\shcore.dll
    Ipc O \KnownDlls32\SHELL32.dll
    Ipc O \KnownDlls32\SHLWAPI.dll
    Ipc O \KnownDlls32\SspiCli.dll
    Ipc O \KnownDlls32\ucrtbase.dll
    Ipc O \KnownDlls32\user32.dll
    Ipc O \KnownDlls32\win32u.dll
    Ipc O \KnownDlls32\windows.storage.dll
    Ipc O \KnownDlls32\WINTRUST.dll
    Ipc O \KnownDlls32\WS2_32.dll
    Ipc O \RPC Control\dhcpcsvc
    Ipc O \RPC Control\dhcpcsvc6
    Ipc O \RPC Control\DNSResolver
    Ipc O \RPC Control\LRPC-2fcd8f4341d99730d6
    Ipc O \RPC Control\lsapolicylookup
    Ipc O \RPC Control\LSARPC_ENDPOINT
    Ipc O \RPC Control\lsasspirpc
    Ipc O \RPC Control\samss lpc
    Ipc O \RPC Control\SbieSvcPort
    Ipc O \RPC Control\webcache_{031b98cf-4a69-4c42-ab42-fd9b3c199407}_S-1-5-21-3227445520-1183603382-2391968655-1001
    Ipc O \Security\LSA_AUTHENTICATION_INITIALIZED
    Ipc O \Sessions\1\BaseNamedObjects\CicLoadWinStaWinSta0
    Ipc O \Sessions\1\BaseNamedObjects\CTF.AsmListCache.FMPDefault1
    Ipc O \Sessions\1\BaseNamedObjects\DBWinMutex
    Ipc O \Sessions\1\BaseNamedObjects\MSCTF.Asm.MutexDefault1
    Ipc O \Sessions\1\BaseNamedObjects\MSCTF.CtfMonitorInstMutexDefault1
    Ipc O \Sessions\1\Windows\ApiPort
    Ipc O \Sessions\1\Windows\DwmApiPort
    Ipc O \Sessions\1\Windows\SharedSection
    Ipc O \Sessions\1\Windows\Theme966467274
    Ipc O \Sessions\1\Windows\ThemeSection
    Ipc O \ThemeApiPort
    Ipc O \Windows\Theme977220367
    Pipe -------------------------------
    Pipe ?
    Pipe \Device\CNG
    Pipe \Device\KsecDD
    Pipe \Device\NvAdminDevice
    Pipe O \Device\Afd
    Pipe O \Device\NetBT_Tcpip_{3F3F684F-2263-43C7-A8DD-87FEFEEDAD45}
    Pipe O \Device\NetBT_Tcpip_{7194130E-AC2A-49F2-BECE-C618F776512D}
    Pipe O \Device\NetBT_Tcpip_{AF12C15B-FE0C-42E2-AECC-876BBA6E93FF}
    Pipe O \Device\NetBT_Tcpip_{EE97BF7A-1986-4680-9E8A-E6E44420D310}
    Pipe O \Device\Nsi
    WinCls -------------------------------
    WinCls O MS_WebCheckMonitor
    WinCls O Shell_TrayWnd
    WinCls X ApplicationManager_DesktopShellWindow
    WinCls X MS_AutodialMonitor
    WinCls X Progman

     

    /====================================================================================/ 

     

    3. Another click on person's link (after that above)
    Redirection happens but again - "please login or sugn up"


    Clsid -------------------------------
    Clsid {30D49246-D217-465F-B00B-AC9DDD652EB7} Identity Store
    Clsid {9BA05972-F7B8-11CF-A442-00A0C01A8F39} ShellWindows
    File/Key -------------------------------
    Image -------------------------------
    Ipc -------------------------------
    Ipc \RPC Control\Vault
    Ipc \Sessions\1\BaseNamedObjects\https://www.facebook.com/
    Ipc \Sessions\1\BaseNamedObjects\HWNDInterface:1f71bcc
    Ipc \Sessions\1\BaseNamedObjects\HWNDInterface:42d1114
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_14bf
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_14c1
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_14c3
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_14c5
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_14fb
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_14fe
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_1500
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_1502
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_1504
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_150a
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_150c
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_150e
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_1513
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_1515
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_1517
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_1519
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_151b
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_151d
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_iso_sm_e_118b4_11401_7d
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_iso_sm_e_118b4_1401_7d
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_118b4_iso_sm_e_118b4_21403_7d
    Ipc \Sessions\1\BaseNamedObjects\OleDfRoot10F98C962C6B249F
    Ipc \Sessions\1\BaseNamedObjects\OleDfRootD66A60D1E05CA7C2
    Ipc \Sessions\1\BaseNamedObjects\OleDfRootE5AD087B54BA8B4E
    Ipc \Sessions\1\BaseNamedObjects\SmartScreen_ClientId_Mutex
    Ipc \Sessions\1\BaseNamedObjects\SmartScreen_UrsCache
    Ipc \Sessions\1\BaseNamedObjects\SmartScreen_UrsCacheMutex
    Ipc \Sessions\1\BaseNamedObjects\UpdatingNewTabPageData
    Ipc \Sessions\1\BaseNamedObjects\windows_webcache_bloom_section_{8333EE7D-ED12-414F-005E-7A2847F80A9B}
    Ipc \Sessions\1\BaseNamedObjects\windows_webcache_bloom_section_{9A8AE352-AD58-42CB-C563-089DD7A39DDA}
    Ipc O \RPC Control\SbieSvcPort
    Pipe -------------------------------
    Pipe O \Device\Afd
    WinCls -------------------------------
    WinCls O MS_WebCheckMonitor
    WinCls O Shell_TrayWnd
    WinCls X ApplicationManager_DesktopShellWindow
    WinCls X MS_AutodialMonitor
    WinCls X Progman

  • 0 in reply to O G1

    Forgot to say, all of those logs were collected on FaceBook only. I use IE for visits on FB only.

  • 0 in reply to O G1

    Hi O G1,

    The login issue was reported here: https://community.sophos.com/products/sandboxie/f/sandboxie-forum/112574/5-30-breaks-internet-explorer-11-on-windows-7-x64-5-28-works/403493#403493

    No updates so far.

    Did you get a chance to test the video related suggestions from before? 

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • 0 in reply to Barb@Sophos

    Hi Barb@Sophos,

    Actually, in my previous post I described results of discussed tests:

     - I confirmed, that incorrect behaviour happens under Sandboxy only

     - it happens with or without drop administrative rights

     - I collected Res. Acc. Mon data as you described

    The only thing was not checked - Chrome hrdware acceleration on/off. Because Chrome isn't involved in investigations. IE only.

    And one more thing must be mentioned again - now no any error messages happens. Just silent incorrect work.

    May be another point worth to be mentioned: loging issue started to happen in last week or two. Earlier it did not happen. On link you sent me mentioned Windows 7. So it is old enough issue. I met it not much time ago.

    So, what can I test more?

  • 0 in reply to O G1

    Hi O G1,

    Thanks for clarifying.
    The Chrome steps were sent since your original post includes Chrome as well (the idea is to find if all your browsers behave the same in the sandbox, or just IE).

    If you did choose to hide the message, as originally suggested, then that's probably why you are not seeing the error anymore (to un-hide Configure --> Forget hidden messages). Otherwise, has anything changed since you reported the problem? Any additional information will be appreciated.

    Interesting that the login issue started not too long ago for you. The post is, indeed, for Windows 7 originally, but seems to apply exactly to your situation.

    I re-tested the behavior and I am still unable to reproduce it. Can I please get the exact windows build that you are using? Perhaps that's the key here.

    Thanks!

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • 0 in reply to Barb@Sophos

    Hi Barb@Sophos

    What I did right now.

    1. Configure --> Forget hidden messages

    2. Create new sandbox

    3. Without any settings "Run Any Program" --> "C:\Program Files\Internet Explorer\iexplore.exe"

    4. Login to FaceBook

    5. Start Resource Access Monitor (log is at bottom of the message)

    6. Find first video (www.facebook.com/.../) and click "play" (white triangle) 

    7. Video doesn't start.

     

    Windows 10 Entrprise 2016 LTSB

    IE11 --> Version 11.2791.14393.0, Update version 11.0.110

    Can I do more to help to understand what's going on?

     

    RAM's log:

    Clsid -------------------------------
    Clsid {9BA05972-F6A8-11CF-A442-00A0C90A8F39} ShellWindows
    Clsid O {A47979D2-C419-11D9-A5B4-001185AD2B89} Network List Manager
    File/Key -------------------------------
    Image -------------------------------
    Ipc -------------------------------
    Ipc \PdcPort
    Ipc \Sessions\1\BaseNamedObjects\IsoScope_7be4_iso_sm_e_7be4_1401_7d
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_cryptsvc
    Ipc \Sessions\1\BaseNamedObjects\windows_webcache_bloom_section_{8333EE6C-ED12-414F-995E-7A2847F80A9B}
    Ipc O \RPC Control\DNSResolver
    Ipc O \RPC Control\SbieSvcPort
    Pipe -------------------------------
    Pipe O \Device\Afd
    Pipe O \Device\NetBT_Tcpip_{3F3F684F-2263-43C7-A8DD-87FEFEEDAD45}
    Pipe O \Device\NetBT_Tcpip_{7194130E-AC2A-49F2-BECE-C618F776512D}
    Pipe O \Device\NetBT_Tcpip_{AF12C15B-FE0C-42E2-AECC-876BBA6E93FF}
    Pipe O \Device\NetBT_Tcpip_{EE97BF7A-1986-4680-9E8A-E6E44420D310}
    WinCls -------------------------------

Unfiltered HTML