4.3.14 conflicts with anti-virus packages.

[just_to_report_a_bug]

Currently the only solution is to re-install 4.12 You won't lose your settings.

[Reza Toronto]

Greetings:

I just wanted to reconfirm with readers and contributors that indeed the best course of action is to revert to 4.3.12. After spending about 10+ hrs trying to sort this out, the only logical course of action was to downgrade.

There appears to be a fundamental problem with 4.3.14 which Oracle will have to correct and rectify. Until such time, waste no time. Its like hitting your head on a brick wall.

Thanks and regards,
Reza - Toronto.

[poncho524]

I really don't want to add to the whining...

BUT

This is a pretty big, stinky "feature" that was added with no mention on the release notes. Why wasn't this mentioned on the release notes?

Why does Oracle/VB feel the need to be the kosher-process-enforcer for my OS?

Is DLL injection a potential serious problem? Sure. But that's why people choose to run AV and Firewalls. And it's also a risk people take when running an OS that allows for such things to happen.

It is not the responsibility of Mr. 3rd Party Application to be concerned about.

Can we get a good explanation from Oracle as to why these changes were pushed through??

Oracle's description of the "vulnerability" doesn't seem to justify the "fix".

from http://www.oracle.com/technetwork/topic ... 72958.html

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are VirtualBox prior to 3.2.24, 4.0.26, 4.1.34, 4.2.26 and 4.3.14. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution.

Note: Applies only when VirtualBox is running on a Windows host operating system.

I'm assuming this is the issue. "Difficult to exploit" and requires "logon to OS". Well if you logon to the OS, most bets are off; user could run anything.

Oracle even notes that this issue is NOT a risk for "Remote Exploit without Auth". (http://www.oracle.com/technetwork/topic ... 72956.html)

So who voted on/for this fix? And why?

[rbaraldi]

Hi
I got the same problem. I have 7 VM running before the update . After I got the same problem, i downgrade , delete all files and import again but still got the error.
My laptop is i7 Windows 8.1 SP2 with 8 Gb RAM
Oracle please hurry up !
Ricardo (Brazil)

[kfsone]

Windows 7 Pro, i7, ESET Smart Security 7.0.302.26

Haven't rebooted since upgrading from 4.2 yet.

Don't have the Layers registry key, running as Admin doesn't solve.

[Boxy]

we are working on fixing the problems on Windows

Can we collect some kind of information to assist you in fixing the problem despite our thousand nearly similar pop-ups ?

[Cahes]

Vboxers:

I'm using AVG on Win8.1 64bits, With the same issue: E_FAIL (0x80004005)
Decided to revert to 4.3.12 release...

Sad, but, true.

I hope the masters get'a'fix...

[J.L.]

Just installed VirtualBox-4.3.15-95171-Win.exe. While Oracle VM VirtualBox Manager opens fine now, any time I try to start a virtual machine, this error pops up:

Code: Select all   Expand viewCollapse view

Failed to open a session for the virtual machine Windows XP.

The virtual machine 'Windows XP' has terminated unexpectedly during startup with exit code 1.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

[michaln]

Why does Oracle/VB feel the need to be the kosher-process-enforcer for my OS?

When security vulnerabilities are reported, they must be fixed. Oracle does not choose what independent security researches look for and report and when.

It is unfortunate that Windows makes it so hard to lock things down. It's several orders of magnitude easier on Linux/Solaris/OS X.

Can we get a good explanation from Oracle as to why these changes were pushed through??

Yes, but as I already said, security issues can not and will not be discussed on this forum, so you're wasting your time here, sorry. The publicly available information is already publicly available. If you need to know more, you'll have to contact your Oracle support representative.

[Jacob Klein]

Here's a test build of 4.3 that include fixes that should address the following issues:
... Link: https://www.virtualbox.org/download/tes ... 71-Win.exe
Enjoy!
- bird

I tried the 4.3.15r95171 test build. BOINC could no longer detect that VirtualBox was installed, and VM tasks indicated "Detection of Hypervisor failed." The 4.3.14r95030 build did not have this problem. I have additionally contacted BOINC developers to investigate.

bird / frank:
I found out the problem where the test build conflicts with BOINC. The 4.3.15 test build does not properly populate the InstallDir registry key, for me, on Windows 8.1 Update 1 x64. It is set to an empty string. BOINC requires both InstallDir and VersionExt. Can you guys please look into it? Is it normal for test builds to have empty InstallDir? Details below.

Code: Select all   Expand viewCollapse view

=============================================
4.3.14: HKLM\SOFTWARE\Oracle\VirtualBox
=============================================
InstallDir
C:\Program Files\Oracle\VirtualBox\

Version
%VER%

VersionExt
4.3.14

=============================================
4.3.15r95171: HKLM\SOFTWARE\Oracle\VirtualBox
=============================================
InstallDir


Version
%VER%

VersionExt
4.3.15

[michaln]

A greater mystery than why users didn't notice the availability of a beta: how all the devs involved in creating this update somehow all weren't running AV or any of the several other common things mentioned that can cause this problem.

That says something about observer bias, doesn't it. Developer systems are generally relatively clean, containing little beyond Microsoft software. Test machines are even cleaner. And although it may be difficult to believe, Microsoft's antivirus does not do any of the lovely things that Symantec/Kaspersky/Comodo/whoever do -- no DLL injection, no patching system code in memory.

[mpack]

I made a point of stating in the first message that wibble posts would be deleted, and I just deleted a whole bunch of them. Not to put to fine a point on it, but this is not the place for philosophical musings. If your post doesn't contribute directly towards documenting the problem or solving it then please don't bother posting in this thread at all.

[JRD]

Similar issues here with Sophos Endpoint Security and Control, v10.3 on Windows 7 Enterprise.

[sunboy]

Hi

Thanks for making Virtual box.


I understand the developers who want as much feedback as possible to hesitate adding a warning.
Too it's clear that Oracle can't make a testbed for each and every system outside in the wild.
Clear too: Errors happens.

Anyway: I would find it fair and polite if a hint would added to 4.3.14, especially for first time users.

"4.3.14 may not run with software which hooks into the windows operation system ( virusscanner eg. ). We are working on that. Please help us by trying <link to testversion> and give feedback to <this thread> here."

[akupaku]

Getting the same error dialog as for example "cremor" above when starting VirtualBox. Host is Windows 7 x64 Professional, no virus protection other than Microsoft Security Essentials. All windows updates up-to-date. Uninstall/reinstall does not help. Previous versions of VirtualBox work.