Windows 4.3.16 specifically for errors due to security

[Limeroli]

I have a similar problem with my vm. I get the following error:

vbox_error.jpg (86.52 KiB) Viewed 9518 times

The error occurs since today, I think the windows-updates are the reason, maybe the update to Microsoft Security Essentials - 4.6.305.0 (KB2965031).

VirtualBoxVersion: 4.3.16.r95972
Windows 7 x64
Onlye Windows Firewall & Security Essentials are installed

On a other machine with Windows 8.1 x64 where I did not install todays updates my vm (same vbox version) starts successfully.

I hope these information will help you to solve the problem. If you need more info, feel free to ask.

EDIT:
As requested I attached my VBoxStartup.log

[mpack]

You are missing the VBoxStartup.log file requested in the first post. Ideally zip it before posting.

[quiettime]

Tried both MBAM 1.75 and 2.0.2 and I'm unable to reproduce the issue with either version here. So, I need some more information from you in order to figure this one out. But first, let me start by explaining what exactly goes wrong here. The driver (vboxdrv) gets an error when trying to reference the "ApiPort" object for the current session. If you use WinObj (from sysinternals) you'll find the "ApiPort" as \Windows\ApiPort for session 0 and \Sessions\*\Windows\ApiPort for the others, or at least that is how we understand it to be. On possible cause here is that we've got this wrong.

Thanks for testing and explaining. I failed to reproduce in a VMWare Workstation 9 guest Win7 x64 with MBAM 1.75 Pro and VirtualBox 4.3.16. Maybe there is something else causing it, or some combination of things that is present on my host.

Here's what I need: When this error occurs, we print the exact path and error status. Since we're in kernel land, you need to use DebugView from SysInternals/Microsoft to catch it. Make sure to enable both "Capture Kernel" and "Enable Verbose Kernel Output". There will then be a message "vboxdrv: Error opening '\...\ApiPort': 0x????????" in the output.

Here's the output from dbgview at the time I tried to start a VM:

Code: Select all   Expand viewCollapse view

vboxdrv: Error opening '\Sessions\1\Windows\ApiPort': 0xc0000024
vboxdrv: Declined 0000000000001640 access to VBoxDrvStub: rc=-3739
[5696] Error -3739 in supR3HardenedWinReSpawn!
[5696] NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -3739 (0xfffff165) (rcNt=0xe986f165)

0xc0000024 == OBJECT_TYPE_MISMATCH, which seems like weird error. I tried several times and the messages above were consistent every time, although the "Declined <address>" address changed each time.

Also I saw this the first time, but only the first time:

Code: Select all   Expand viewCollapse view

[4848] VMListReg::Listener - Initial registry scan completed.
MBAMProtector!InstanceSetup:  RtlVolumeDeviceToDosName failed with status 0xc0000034

Would also be cool if you could peek around using WinObj for ApiPort objects, esp at the location given in the vboxdrv message.

I need more information about this, I'm not sure what you want.

Thanks

[revere521]

I'm unable to reproduce the issue here. Which avast! edition and version are you using?

The symptoms are similar to the issue we had with symantec endpoint protection (SEP) in test build 7. However I was under the impression that recent avast versions didn't invade processes in the synchronous manner that SEP does and thus should not be subject to the same issue. Beside, if they did I would've expected immediate hangs every time, unlike the 2nd log you pasted. In the first case, it's so early we haven't even started talking to our kernel components, it's pure user land. Which means that it's probably avast being responsible for the hang. Now, what's more annoying is that the code that is causing the hang was intended to make avast work better...

Thanks for the report,
bird.

No problem, Avast is reporting current version - 2014.9.0.2021.

That 2nd log was different from all the others i tested which were more like the 1st log from Mint - aberration maybe?

Disabling the avast shields, and adding all the file paths i can think of for VBox to the exclusion log didn't seem to help.

let me know if there is anything you want me to try

[garbage_collected]

I uninstalled a (working) 4.3.15 test build and installed the 4.3.16 release. Several problems:

1. The VirtualBox UI was not working right after install. There were no error dialogues; the process just went out to lunch and nothing happened. I then tried to reboot the computer, but...
2. ...I got stuck on the Windows "Shutdown" screen with the spinning widget for quite a long time, so I ended up hard power-cycling the PC.
3. On next startup I again tried to start the VBox UI and got the following error:



Afterwards I noticed that...

4 ...All other apps on my PC stopped working. I could not launch my browser. I could not kill the VirtualBox process in TaskManager. I could not shutdown or reboot the computer which became very unstable. Eventually I started getting error messages from Windows telling me to hard power-off the machine.
5. On next startup I tried to uninstall VirtualBox but the uninstaller is not available! There is no VirtualBox entry in "Programs and Features" in the Control Panel. There is also no uninstaller link in the VirtualBox menu:



At this point I am unable to uninstall the app which is causing major stability problems on my desktop and would appreciate your help/advice.

I am not able to provide a useful log because the only ones available on my filesystem are older logs from previous installations (they predate the installation date of 4.3.16 which is 9/10/2014). It appears that a VBoxStartup log was not created since I installed 4.3.16:



My configuration is:
Windows 7 Pro SP1, 64-bit
Avast! Internet Security (subscription version, not free) program version 2014.9.0.2021

[mattsnowboard]

. Windows 8.1 64 bit

VirtualBox - Error in supR3HardenedWinReSpawn

NtCreateFile(\Device\VboxDrcStub) failed 0xc0000034
STATUS_OBJECT_NAME_NOT_FOUND (0 retries)
(rc=-101)

Same error

Windows 8.1 fully updated 64-bit
Just vanilla Windows Defender

VB 4.3.16

Log attached, downgrading until a fix is ready

[socratis]

@garbage_collected
This is not a 4.3.16 error due to security. You seem to have a tendency to hijack threads. Please start your own thread next time.

[danmac]

Windows 7 x64 host
Avast anti-virus 2014.9.0.2021

Exactly the same symptoms as revere521's post. (sits at creating process 1/2, GUI closes but leftover VirtualBox tasks won't end, forcing hard shutdown)

Continues to work fine with 4.3.15-95713

Good luck guys, hope this helps

[intrepid_ibex]

Have the same Problem like revere521 described above.
Haven't tested with VirtualBox-4.3.15-95713-Win.exe.
VirtualBox-4.3.12-93733-Win.exe ran without Erros, so I will downgrade again.

Host: Windows 7 64bit, Vers: 6.1, Build: 7601
Host Virus: Avast Free Antivirus, 2014.9.0.2021

VBoxStartup.log:

Code: Select all   Expand viewCollapse view

17f4.650: Log file opened: 4.3.16r95972 g_hStartupLog=0000000000000018 g_uNtVerCombined=0x611db110
17f4.650: Calling main()
17f4.650: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
17f4.650: SUPR3HardenedMain: Respawn #1
17f4.650: System32:  \Device\HarddiskVolume2\Windows\System32
17f4.650: WinSxS:    \Device\HarddiskVolume2\Windows\winsxs
17f4.650: ProgDir:   \Device\HarddiskVolume2\Program Files
17f4.650: ComDir:    \Device\HarddiskVolume2\Program Files\Common Files
17f4.650: ProgDir32: \Device\HarddiskVolume2\Program Files (x86)
17f4.650: ComDir32:  \Device\HarddiskVolume2\Program Files (x86)\Common Files
17f4.650: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
17f4.650: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VirtualBox.exe)
17f4.650: supR3HardNtEnableThreadCreation:
17f4.650: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007754c340 pvNtTerminateThread=00000000775717e0
17f4.650: supR3HardenedWinDoReSpawn(1): New child 458.648 [kernel32].
17f4.650: supR3HardenedWinPurifyChild: PebBaseAddress=000007fffffda000 cbPeb=0x380
17f4.650: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077520000 uNtDllChildAddr=0000000077520000
17f4.650: supR3HardNtPuChTriggerInitialImageEvents: uLdrInitThunk=000000007754c340 uNtTerminateThread=00000000775717e0
17f4.650: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007754c340 pvNtTerminateThread=00000000775717e0
17f4.650: supR3HardNtPuChTriggerInitialImageEvents: mapping view of ntdll.dll[2nd]

[aparra]

VirtualBox: 4.3.16 r95972
Equipment: HP EliteBook 840
OS: Windows 7 Enterprise SP1 64bits
AV: Trend Micro OfficeScan 10.6.5193

Error: The virtual machine "xxxx" has terminated unexpectedly during startup with exit code 1(0x1). More details in .....

The VBoxStartup.log is attached

Regards

Angel

[BrianG61UK]

I don't know if this is due to my security software or what but, as with the last 4.3.15 I tried, I find that with 4.3.16 my 32 bit Windows VMs (One Windows 7, One XP) (with 3D enabled) will not shut down.
I am running VirtualBox 4.3.16 on Windows 7 Ultimate 64-bit.

[mpack]

Hardening issues will generally make a VM fail to start up. I can't think of why it would stop one shutting down. If you don't believe the issue is relevant to this topic then please use the general "Discuss the 4.3.16 release" topic instead.

[garbage_collected]

@socratis, I'm sorry but my issue does seem related. I was receiving an error when trying to start VirtualBox similar to the others.
Did you remove my screenshots?

[IvanPetrov]

Windows 8.1 x86-64
Kaspersky Internet Security 2014
VirtualBox 4.3.16

Error: Status_Object_name_not_found


Thank you!

[rnewman]

Windows 7 Professional SP1 64bit
TrendMicro 11.0.1454
Virtualbox 4.3.16

No logs to attach as none were created.
GUI manager starts. However when an attempt to start a VM, the system hangs then reboots.

**Update: Yes, TrendMicro OfficeScan