www.sandboxie.com :: View topic

Posted: Sun Jan 23, 2011 3:13 am

I have begun to see "unknown executable image" appear in the SBIE Settings/Restrictions/Internet Access and Start/Run Access dialogs under "Programs that were recently started" in my sandboxed browser.

Only Internet Access programs I have entered in that sandbox are:
iexplore.exe
rundll32.exe
msimn.exe

Only Start/Run Access programs I have entered there are:
iexplore.exe
rundll32.exe
msimn.exe
verclsid.exe
winword.exe

I haven't been able to find any helpful info on this "unknown executable image" entry.

Can someone tell me if this is common? What does it mean? Etc? Thanks!

Posted: Sun Jan 23, 2011 11:42 pm

Sandboxie calls all programs "unknown executable image" initially, and then a very short time later fills in the name. Perhaps in this case, a program started and ended too quickly. So my thoughts on this problem report is that all I should do is fix the dialogs to not display this particular entry as it is meaningless and confusing.

Posted: Mon Jan 24, 2011 4:54 am

Well, at the very least, I am observant. Smile

Thanks for the explanation.

Posted: Sat Jan 29, 2011 9:54 pm

tzuk wrote:

Sandboxie calls all programs "unknown executable image" initially, and then a very short time later fills in the name. Perhaps in this case, a program started and ended too quickly. So my thoughts on this problem report is that all I should do is fix the dialogs to not display this particular entry as it is meaningless and confusing.

I've started experiencing this as of the 3.52 Windows version of Sandboxie, and only in a sandbox running Firefox. Any clues as to what's going on?

Posted: Sat Jan 29, 2011 10:12 pm

Experiencing what, specifically?

Posted: Sun Jan 30, 2011 2:14 am

...experiencing having "unknown executable image" listed as a running process in the Sandboxie Control box, and continuing to run even after all other applications terminate.

Posted: Sun Jan 30, 2011 2:29 am

Example:

Program Name: unknown executable image
PID: 3212
Window Title: [blank]

PID 3212 (in this case) corresponds to SandboxieRpcSs.exe - a zombie process.

In other words, something's terminating prematurely or not cleaning up properly...

After killing process 3212, SandboxieRpcSs.exe (also PID 3212) comes to life, and is listed as kernel32.dll in the Sandboxie Control window, only now it cannot be killed/stopped...

Posted: Sun Jan 30, 2011 2:16 pm

Then it seems the problem is bigger than just seeing "unknown executable image".
The problem is why does SandboxieRpcSs turn into a zombie process.

I know that McAfee Viruscan Enterprise 8.7i is incompatible with Sandboxie to some extent and this conflict causes zombie processes:

http://www.sandboxie.com/index.php?KnownConflicts#mcafeevirusscan

Are you using this software?

Posted: Sun Jan 30, 2011 4:55 pm

No, tzuk, I'm on XP SP 3 with MS Security Essentials. I'd like to emphasize that this never happened on versions 3.50 or prior of Sandboxie, only started with the 3.52 update...

And, strangely, though I run different sandboxes, it only occurs in the one I have specifically for Firefox (and nothing else). I haven't updated Firefox since the Sandboxie update, and my Firefox (including all extensions) functions perfectly even after I terminate the "unknown executable image"...

Posted: Mon Jan 31, 2011 11:24 am

I'm not sure what to tell you. It's not clear to me how I would be able to reproduce your problem.
You might want to go back to version 3.50 for a bit, to make sure this problem really is caused as a result of upgrading to version 3.52.

Posted: Tue Feb 01, 2011 12:32 pm

Tzuk, I have done as you recommended: I went back to 3.50 and I can confirm that the issue does not arise; it is limited to 3.52.

Posted: Wed Feb 02, 2011 12:38 pm

OK. The problem here is that I don't know how to reproduce your problem. But I think this is a related problem:

http://www.sandboxie.com/phpbb/viewtopic.php?t=9765

Soon I will try to fix that problem and hopefully it will affect your problem as well.

Posted: Sun Feb 20, 2011 12:15 pm

In version 3.53.03:

The dialog box does not show "unknown executable image".

The dialog and also does not show programs from the Sandboxie installation directory.

As for sandboxed programs that become zombie programs:
I also was able to reproduce this behavior and fix it in version 3.53.03.

Posted: Wed Feb 23, 2011 11:50 am

Tzuk,

First of all, thank you for dedicating time to this issue.

Second, I'd like to mention that I've gone back to using 3.50 for a few weeks without issues.

I've installed 3.53.03, and the issue came back - same as in 3.52: SandboxieRpcSS.exe turns into a zombie and shows up as "unknown executable image", which prevents the sandbox from cleaning up properly after all other applications (Firefox in my case) have terminated.

Posted: Wed Feb 23, 2011 1:39 pm

I'm sorry to hear the problem is still there, unfortunately it is not clear to me what to do about it.

If you ever get an idea about what might be causing this, please let me know so I can try to reproduce the problem.