Thread Info
  • State Verified Answer
  • +4 person also asked this people also asked this
  • Replies 33 replies
  • Answers 1 answer
  • Subscribers 11 subscribers
  • Views 42966 views
  • Users 0 members are here
Options
Suggested

Sandboxie fails to purge Sandbox - ACCESS DENIED error on delete invocation

Carbonyl Stretch

 Hi. I've encountered a troubling error with Sandboxie this morning after having no issues for quite some time.

I'm running on the latest version of Windows 10, with ESET as my antivirus solution. The Sandbox in question contains only Chrome, version 75.0.3770.100.

I first experienced this issue on Sandboxie version 5.31.1

I have since upgraded and seen the issue on Sandboxie 5.31.2

 ---------

 The Issue:

I have a sandbox configured to contain Chrome, which on termination of Chrome processes, auto-deletes the contents of the sandbox. Last night (and for years prior) this was not an issue.

This morning I started up my machine, did some light browsing, and then closed Chrome to go to work. Sandboxie initiated the self-purge of the sandbox, and then gave this error:

The error reads "Delete Sandbox DefaultBox: Could not move the sandbox folder out of the way. The object (file or folder) may be in use by another program. Close any application or windows that may prevent access. System Error Code: Access is denied. (5)"

I attempted to update Sandboxie from 5.31.1 to 5.31.2, but the error persisted.

By rebooting my computer and then invoking a delete sandbox command from Sandboxie, I was able to purge the sandbox - But only if it was the first thing I did. If I opened Chrome again, then the error would repeat. It is not possible to purge the sandbox unless the system is rebooted again.

All Chrome processes are terminated when this error is observed. The Sandbox lists no processes running within it, and Process Explorer doesn't show any Chrome processes running.

By manually going into the sandbox folder, I was able to find the file that is giving the problem:

RegHive seems to be the culprit, though I'm not sure how. Somehow this file is in use and/or access to it is denied to both me, and from Sandboxie.

 --------------

 Any help on this would be greatly appreciated. I'm not sure why everything would have been fine last night, and now suddenly this is happening - As I installed no new software, and not even any updates were applied. I fear something nefarious may be afoot, but an ESET scan is not revealing anything.

 If anyone could provide assistance, I am getting worried and would thank you profusely for helping to determine just what is going on here. Thanks.

 EDIT: After a deeper Google Search, it appears this issue has been discussed numerous times on the old forums. Is there any way to access that knowledge? Clicking each Google search result link just brings me right back here, and there's no cached versions to view.

Parents
  • 0

    Hi Carbonyl,

    This is a fairly common scenario, and it is usually triggered by AVs holding on to files. 

    A few suggestions:
    -Try a leader program setting for Chrome https://www.sandboxie.com/ProgramStopSettings#leader
    -Add Sandboxie to the AVs exclusions and see if that helps. 

    The last option is what you already figured out, a reboot takes care of whatever is holding on the files and allows Sandboxie to empty the contents. 

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • 0 in reply to Barb@Sophos

    Hi Barb,

    Thanks for the fast reply. I very much appreciate the information. Just to be clear, does the frequency of this issue indicate it's fairly benign? It's the first time I've seen it, and it has me quite worried.

    To respond to your suggestions:

    -At present the sandbox in question already has Chrome as a leader program. The sandbox was configured this way before the issue occurred, and the settings are still configured that way. From what I can tell, no processes are running in the sandbox at all when this error is encountered.

    -I believe I had already added Sandboxie to the exclusions list in ESET, but I will verify that once I get home from work to check on that today.

    As an additional question: Is there any way to determine what program is holding on to RegHive? It seems to be quite persistent, but I can't find out what program is doing it in this case.

    I'd prefer not to have to reboot my computer every time I want to purge the Sandbox!

     

    Thanks very much for your help on this matter. I will also update as I learn more.

  • 0 in reply to Carbonyl Stretch

    Hi Carbonyl,

    Each situation may be different, but as you saw in your searches, and as covered in my previous response this is a common situation that gets reported. 
    If you are worried about an infection, please do scan your computer with your AV , and if needed, get a second opinion, here's a suggestion:
    https://www.sophos.com/en-us/products/free-tools.aspx --> Scroll down to find the "Virus removal tool", which will work alongside your existing AV. 

    To see what programs are holding on to files, you may perform an online search for third party software, typically they go by "file unlocker". 

    I'd also recommend trying a new Sandbox with default settings (as installing a diff version of Sandboxie does not delete your existing sandboxes). 

    If all fails, you may also try manually deleting the Sandbox folder instead of restarting your machine (Navigate to C:\Sandbox\....  to find your Sandboxes and right-click delete the affected one) . 

    Let us know how things go. 

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • 0 in reply to Barb@Sophos

    Hi Barb,

    Thanks again for your help on this matter.

    Unfortunately, the suggested paths did not result in a solution.

    I've done a full malware scan, and the results came back negative - No malware detected.

    I've added the RegHive files to the exception list in ESET, and that hasn't remedied the issue, either.

    When I check what process has the RegHive files open and won't let go of them, the process is "PID 4 - System". Which is either extremely uninformative, or extremely disturbing.

    Even more disturbing - This morning when I started my computer from a COLD BOOT, the first thing I did was try to empty the sandbox. Access was denied!

  • 0 in reply to Carbonyl Stretch

    Further update:

    It appears that ESET is actually holding on to a specific registry key even after there are no processes running in the Sandbox, and Sandboxie is trying to close it out.

    Ekrn.exe persists in holding open the "HKU\Sandbox_(Username)_(Sandboxname)" key, even long after all processes in the sandbox have terminated.

  • 0 in reply to Carbonyl Stretch

    I am also getting this same error just over the last few days  I am running 2 x WIN7 PC's both with ESET and firefox and with Sandboxie 5.30  I can only delete the firefox contents after a clean reboot  Does this present a threat or can I live with it ubtil a solution is found

Reply Children
No Data
Unfiltered HTML