4.3.14 conflicts with anti-virus packages.

Discussions related to using VirtualBox on Windows hosts.

Re: 4.3.14 conflicts with anti-virus packages.

Postby pillainp » 24. Jul 2014, 16:56

mpack wrote:
pillainp.win81.vbox.log wrote:00:00:00.438661 CPUM: WARNING! Can't turn on NX/XD when the host doesn't support it!

This doesn't seem to have anything to do with the subject of this thread.

The Fedora log shows the same warning, but in that case I don't know if Fedora requires the NX feature.


I have no idea why this should happen. My physical host is fully capable of virtualization, and in fact, both Linux and Windows guests were running perfectly till this morning (a few hours ago).

The reason I am asking about VM storage location is two-fold:
a) I installed Comodo Free Firewall on the host yesterday evening. When I went to run the Windows VM this morning, I received a virtualization error message which I could not resolve except by deletingthe Windows VM. Linux was working fine at that point (Fedora, Ubuntu and Zorin VM's). Updating to 4.3.14 caused all VM's including Linux to stop and VBox errors to pop up similar to those posted above.

b) The only other thing I can think of that has changed on the host over the past two days was a Windows Defender update.

I am wondering if there has been a system level permissions issue or something similar.

But then again, I have my VMWare VM's (Windows 8.1 and Fedora 19) on a separate HDD and Window is having issues there too, while Fedora is not.
pillainp
 
Posts: 16
Joined: 24. Jul 2014, 07:45

Re: 4.3.14 conflicts with anti-virus packages.

Postby ThetaPhi » 24. Jul 2014, 17:05

Hi,
4.3.15 pre-release fixes the startup bug with NVIDIA Graphics Cards (detoured.dll). But now, virtual machines no longer start:

Für die virtuelle Maschine Ubuntu konnte keine neue Sitzung eröffnet werden.

The virtual machine 'Ubuntu' has terminated unexpectedly during startup with exit code 1.

Fehlercode:E_FAIL (0x80004005)
Komponente:Machine
Interface:IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}


This worked in 4.3.14.
Last edited by ThetaPhi on 24. Jul 2014, 17:30, edited 2 times in total.
ThetaPhi
 
Posts: 8
Joined: 18. Jul 2014, 14:08

Re: 4.3.14 conflicts with anti-virus packages.

Postby mpack » 24. Jul 2014, 17:09

@Pillainp: I see that your issue is in fact a cross post, and you already have a dedicated topic to discuss it. Please continue your comments there.
mpack
Site Moderator
 
Posts: 29306
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: 4.3.14 conflicts with anti-virus packages.

Postby boxifier » 24. Jul 2014, 19:14

This post is about both 4.3.14/4.3.15 versions.

At first I installed 4.3.14, had the following error (slightly different from the ones already posted):

VBox 4.3.14 launching error.png
VBox 4.3.14 launching error.png (27.78 KiB) Viewed 14752 times


Then I uninstalled both VBox 4.3.14 & antivirus software and installed 4.3.15 test build instead. After that, in effect, I can access VBox interface but still cannot launch VMs:

VBox 4.3.15 launching VMs error.png
VBox 4.3.15 launching VMs error.png (27.98 KiB) Viewed 14752 times


I kept Windows Defender deactivated, so my guess is these errors have nothing to do with antivirus-packages, but you guys tell me.

My specs:
Intel i7-2670QM
8 GB RAM
nVidia GeForce 520MX 1GB, 337.88 WHQL drivers
Windows 7 x64 Home Premium

Antivirus:
Kaspersky Internet Security 14

I hope this helps.
boxifier
 
Posts: 1
Joined: 24. Jul 2014, 17:57
Primary OS: MS Windows 7
VBox Version: PUEL
Guest OSses: XP & Linuxes (Debian, Ubuntu, ScientificLinux, etc)

Re: 4.3.14 conflicts with anti-virus packages.

Postby just_to_report_a_bug » 24. Jul 2014, 20:20

Same IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048} issue here. Host: Windows XP SP3. Guest: anything.
just_to_report_a_bug
 
Posts: 9
Joined: 23. Jul 2014, 18:24

Re: 4.3.14 conflicts with anti-virus packages.

Postby OmegaSyn » 24. Jul 2014, 20:58

Also experiencing this issue since upgrading, trying to get Server 2012 VM, Error screenshot and information below.

Failed to open a session for the virtual machine Server 2012.

The virtual machine 'Server 2012' has terminated unexpectedly during startup with exit code 1.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

System Specs
Windows 8.1
Intel Core i5 4570
16GB Corsair - PC3-10700
1TB HDD

AV: Avast! Internet Security version 2014.9.0.2021
Attachments
Error 1.png
Error 1.png (75.26 KiB) Viewed 14704 times
Last edited by OmegaSyn on 24. Jul 2014, 21:22, edited 1 time in total.
OmegaSyn
 
Posts: 1
Joined: 24. Jul 2014, 20:52

Re: 4.3.14 conflicts with anti-virus packages.

Postby RJC2 » 24. Jul 2014, 21:13

I am having this issue on two different systems both running Win7 but system 1 is using Symantec Endpoint Protection V12.1.3001.165 and the other is running AVG Internet Security 2014.0.4744.
No solution found...
RJC2
 
Posts: 1
Joined: 24. Jul 2014, 19:55

Re: 4.3.14 conflicts with anti-virus packages.

Postby Manveru » 24. Jul 2014, 23:19

I've had previous problem with 4.3.14 and I reinstalled 4.3.15. Now:

Failed to open a session for the virtual machine Ubuntu 14.04.

The virtual machine 'Ubuntu 14.04' has terminated unexpectedly during startup with exit code 1.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

The running antivirus is Kaspersky Internet Security 2014 (exact version now: 14.0.0.4651(g))

Anything else I can do?
Manveru
Manveru
 
Posts: 5
Joined: 5. Jul 2007, 10:00

Re: 4.3.14 conflicts with anti-virus packages.

Postby bird » 25. Jul 2014, 00:24

Hi!

Here's a new test build: https://www.virtualbox.org/download/tes ... 26-Win.exe

This build should fix a number of the "terminated unexpectedly during startup with exit code X" issue, though not all of them. (This was a regression in the previous test build that mostly happened on Windows 7. Unfortunately the build was only briefly screened on Windows 8.0 before it was uploaded, and that box didn't show the problem. Sorry about that.)

This build was tested on 64-bit windows 8.0 with symantec endpoint protection installed, as well as windows 7 with AVG internet security 2014.

Avast users (and probably others too) may see a message like "The virtual machine 'insert-vm-name' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in '...\VBoxStartup.log'." when starting a VM. This is being worked on and I hope there will be a new test build tomorrow that address this. (The problem is that avast is modifying ntdll in memory, from a kernel driver I believe, making a number of function jump to some new code segment they injected into the process. The above build removes the injected code segment but doesn't restore the ntdll to its original state, thus NtMapViewOfSection jumps into the void and crashes. Thus the STATUS_ACCESS_VIOLATION exit code value.)

Now, if you see a _different_ error and that nobody else has reported yet, it would be cool to get the VBoxStartup.log mentioned in the error message with the report as well as OS version + bit count and the list protective software installed.

Hope this new build brings more enjoyment that the last one,
bird
Knut St. Osmundsen
Oracle Corporation
bird
Oracle Corporation
 
Posts: 119
Joined: 10. May 2007, 10:27

Re: 4.3.14 conflicts with anti-virus packages.

Postby J.L. » 25. Jul 2014, 01:01

Unfortunately, I have the same error with Avast uninstalled. Uninstalling Zemana AntiLogger made no difference, identical log. Uninstalling HitmanPro.Alert finally allowed it to start a VM. Re-installing Zemana AntiLogger, we get a different error. Here are some logs and errors:
With Avast wrote:338c.3b10: Log file opened: 4.3.15r95226 g_hStartupLog=0000000000000024 g_uNtVerCombined=0x611db110
338c.3b10: Calling main()
338c.3b10: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x0
338c.3b10: SUPR3HardenedMain: Respawn #1
338c.3b10: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
338c.3b10: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll)
338c.3b10: supR3HardenedWinDoReSpawn(1): New child 1a2c.31d0 [kernel32].
338c.3b10: supR3HardenedWinPurifyChild: PebBaseAddress=000007fffffdc000 cbPeb=0x380
338c.3b10: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077b50000 uNtDllChildAddr=0000000077b50000
338c.3b10: supR3HardNtPuChTriggerInitialImageEvents: pvLdrInitThunk=0000000077b7c340 pvNtTerminateThread=0000000077ba17e0
338c.3b10: supR3HardNtPuChSanitizeMemory: Freeing exec mem at 0000000000050000 (0000000000050000 LB 0x1000)
338c.3b10: supR3HardNtPuChSanitizeMemory: Freeing exec mem at 00000000001e0000 (00000000001e0000 LB 0x2000)
338c.3b10: supR3HardNtPuChSanitizeImage: 0000000077b50000 '\Device\HarddiskVolume2\Windows\System32\ntdll.dll'
338c.3b10: supR3HardNtPuChSanitizeImage: 000000013ffd0000 '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe'
338c.3b10: supR3HardNtPuChSanitizeImage: 000007feffe70000 '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll'
338c.3b10: supR3HardenedWinDoReSpawn(1): Quitting: ExitCode=0xc0000005 rcNt=0x0

Without Avast wrote:1d6c.1d70: Log file opened: 4.3.15r95226 g_hStartupLog=0000000000000020 g_uNtVerCombined=0x611db110
1d6c.1d70: Calling main()
1d6c.1d70: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x0
1d6c.1d70: SUPR3HardenedMain: Respawn #1
1d6c.1d70: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
1d6c.1d70: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.dll)
1d6c.1d70: supR3HardenedWinDoReSpawn(1): New child 1d90.1d94 [kernel32].
1d6c.1d70: supR3HardenedWinPurifyChild: PebBaseAddress=000007fffffd4000 cbPeb=0x380
1d6c.1d70: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000076ff0000 uNtDllChildAddr=0000000076ff0000
1d6c.1d70: supR3HardNtPuChTriggerInitialImageEvents: pvLdrInitThunk=000000007701c340 pvNtTerminateThread=00000000770417e0
1d6c.1d70: supR3HardNtPuChSanitizeMemory: Freeing exec mem at 0000000000050000 (0000000000050000 LB 0x1000)
1d6c.1d70: supR3HardNtPuChSanitizeImage: 0000000076ff0000 '\Device\HarddiskVolume2\Windows\System32\ntdll.dll'
1d6c.1d70: supR3HardNtPuChSanitizeImage: 000000013f020000 '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe'
1d6c.1d70: supR3HardNtPuChSanitizeImage: 000007feff310000 '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll'
1d6c.1d70: supR3HardenedWinDoReSpawn(1): Quitting: ExitCode=0xc0000005 rcNt=0x0

With Zemana wrote:Failed to open a session for the virtual machine Ubuntu.

The virtual machine 'Ubuntu' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'D:\Documents\VirtualBox VMs\Ubuntu\Logs\VBoxStartup.log'.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}
Attachments
Zemana.jpg
Zemana.jpg (49.26 KiB) Viewed 14597 times
Zemana.zip
(3.54 KiB) Downloaded 61 times
VBoxStartup.zip
"Success"
(11.91 KiB) Downloaded 124 times
Windows 10 is the actual host, not 8 (no option).
J.L.
 
Posts: 78
Joined: 17. Jan 2013, 07:38
Primary OS: MS Windows 8
VBox Version: PUEL
Guest OSses: LMDE, Ubuntu, Windows XP, Windows 7

Re: 4.3.14 conflicts with anti-virus packages.

Postby J.L. » 25. Jul 2014, 01:37

That is not all though. FileBox eXtender was blocked as shown in the logs. I can tolerate that, but my forced Nvidia GPU settings (High-performance NVIDIA processor selected in Control Panel) for VirtualBox are also blocked. That means VirtualBox is using my slow and buggy integrated Intel GPU. Looks like Oracle still wants to pursue this "hardened" mode, let's see for how long. Reverting back to my AX64 snapshot.
Windows 10 is the actual host, not 8 (no option).
J.L.
 
Posts: 78
Joined: 17. Jan 2013, 07:38
Primary OS: MS Windows 8
VBox Version: PUEL
Guest OSses: LMDE, Ubuntu, Windows XP, Windows 7

Re: 4.3.14 conflicts with anti-virus packages.

Postby cgill27 » 25. Jul 2014, 01:45

The latest test build works for me, no errors, woohoo!

VirtualBox-4.3.15-95226-Win.exe

host:
Windows 8.1 Pro 64bit no antivirus or security software installed

guest:
Xubuntu 12.0.4 64bit

I did have to upgrade the extension pack to 4.3.14 from 4.3.12 in order to boot the vm, got a weird message about usb not being supported.
cgill27
 
Posts: 2
Joined: 21. Jul 2014, 22:20

Re: 4.3.14 conflicts with anti-virus packages.

Postby birrellwalsh » 25. Jul 2014, 04:02

I believe 4.3.15 does NOT solve the problem. :?

I am going to follow our fellow member's excellent suggestion and return to 4.3.12
birrellwalsh
 
Posts: 8
Joined: 18. Jul 2014, 07:17

Re: 4.3.14 conflicts with anti-virus packages.

Postby jefke » 25. Jul 2014, 06:52

bird wrote:Hi!

Here's a new test build: https://www.virtualbox.org/download/tes ... 26-Win.exe

This build should fix a number of the "terminated unexpectedly during startup with exit code X" issue, though not all of them. (This was a regression in the previous test build that mostly happened on Windows 7. Unfortunately the build was only briefly screened on Windows 8.0 before it was uploaded, and that box didn't show the problem. Sorry about that.)

This build was tested on 64-bit windows 8.0 with symantec endpoint protection installed, as well as windows 7 with AVG internet security 2014.

Avast users (and probably others too) may see a message like "The virtual machine 'insert-vm-name' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in '...\VBoxStartup.log'." when starting a VM. This is being worked on and I hope there will be a new test build tomorrow that address this. (The problem is that avast is modifying ntdll in memory, from a kernel driver I believe, making a number of function jump to some new code segment they injected into the process. The above build removes the injected code segment but doesn't restore the ntdll to its original state, thus NtMapViewOfSection jumps into the void and crashes. Thus the STATUS_ACCESS_VIOLATION exit code value.)

Now, if you see a _different_ error and that nobody else has reported yet, it would be cool to get the VBoxStartup.log mentioned in the error message with the report as well as OS version + bit count and the list protective software installed.

Hope this new build brings more enjoyment that the last one,
bird

So if I am reading this right, the solution being worked on at the moment is not to whitelist some products or whatever, but to actually remove the code that security packages inject to do their work, basically blocking their security functionality for virtualbox and causing the AV packages not to be able to monitor the virtualbox processes anymore?
jefke
 
Posts: 21
Joined: 15. Aug 2012, 16:17

Re: 4.3.14 conflicts with anti-virus packages.

Postby Ady » 25. Jul 2014, 10:20

mpack wrote:
Fredrik wrote:I also tried older version VirtualBox-4.2.26-95022-Win and it gave me the same error.

If you have the same error with VBox 4.2.x then your problem is not relevant to this thread, which is about VBox 4.3.14 explicitly.

I'd like to remind you that all versions (updates) released together with 4.3.14 (such as 4.2.26) are also affected by this "supR3HardenedWinReSpawn" (et al) problem.

Hopefully new versions will be released for the prior branches too (and around the same time), not just for 4.3.x.
Ady
 
Posts: 29
Joined: 19. May 2011, 16:05
Primary OS: MS Windows Vista
VBox Version: OSE other
Guest OSses: several

PreviousNext

Return to VirtualBox on Windows Hosts

Who is online

Users browsing this forum: No registered users and 51 guests