Windows 4.3.18 specifically for errors due to security

[MisterTea]

Situation:
I upgraded to 4.3.18 a few days back and everything worked fine. I was able to start all of my VM's without issue. However, Last night my PC installed updates and rebooted on its own. Today I tried starting my Linux VM and to my extreme frustration, VB cant start any of the virtual machines. Nothing starts and all fail with the same errors.

What I tried to do:
Disabling antivirus does nothing.
I also tried to uninstall 4.3.18 and roll back to 4.3.16. No dice, still the same failure message.
I then rolled back to 4.3.10 and the VM's start and boot albeit after disabling the USB controller.
Updated to 4.3.12 - again, still works.
Updated to 4.3.14 - VB wont even start the UI and throws numerous errors about dll's, see screenshot entitled 4.3.14-failure.png
Tried installing 4.3.17 testbuild and got the same errors as 4.3.16 and 4.3.18 (figured as much but wanted to cover all the bases.)
Tried uninstalling windows security updates - did nothing BUT I have yet to uninstall all listed updates.

Host system:
Windows 7 Ultimate SP1 64-bit
AMD A8-3850, 16 GB RAM
AVG Free version 2014.0.4765

[pfeerick]

Have had issues with all release versions of VirtualBox post 4.3.12, and have also tried almost all test versions with no luck.

With release version of 4.3.18, previously working VMs (Win7, Win10 & Deb Linux) not launching with following two error dialogs:

First error message

error 1.PNG (9.88 KiB) Viewed 8032 times

Second error message

error2.PNG (34.4 KiB) Viewed 8032 times

Host system: Windows 7 SP1 32bit, 4GB RAM, Intel i5.
AV: Bitdefender Free 1.0.21.1099

Anything you can glean from this info would be appreciated, and I'm willing to run more tests if needed. But for now I'm rolling back to 4.3.12.

Peter

[Buehlerra]

I have the following problem with Version 4.3.18.:
Up to know, I have used Version 4.3.10 and Internet Access worked fine. I am using Windows 7 64Bit as Host and Linux (Debian and Ubuntu) as Guest Operating Systems.
After I updated to Version 4.3.18 the Internet Access (NAT) is not working anymore. Still I am able to Ping the physical router, which means the network itself is OK. Only if I use bridged mode, the Internet works fine.
By downgrading to Version 4.3.10, Internet is back working again.
Thanks for any help to solve the problem, Buehlerra

[revoman]

I recently upgraded virtualbox to 4.3.18 and started receiving exit code -1073741816. I'm attaching the logs and a screenshot.

This is a company PC so I do not have all the details, but here is what I know.
AMD A10-5800B
8GB Ram
Windows 7 Enterprise 64-bit
SkyRecon StormShield
Microsoft Endpoint Protection

Hope that's enough.

VirtualBox-4_3_18.png (32.04 KiB) Viewed 7978 times

Last part of the logs

Code: Select all   Expand viewCollapse view

1e94.1c2c: apisetschema.dll: timestamp 0x5348a50b (rc=VINF_SUCCESS)
1e94.1c2c: VirtualBox.exe: timestamp 0x5439147c (rc=VINF_SUCCESS)
1e94.1c2c: '\Device\HarddiskVolume1\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
1e94.1c2c: '\Device\HarddiskVolume1\Windows\System32\apisetschema.dll' has no imports
1e94.1c2c: '\Device\HarddiskVolume1\Windows\System32\ntdll.dll' has no imports
1e94.1c2c: supR3HardNtChildPurify: Done after 545 ms and 0 fixes (loop #0).
1e94.1c2c: supR3HardNtEnableThreadCreation:
814.21d4: Log file opened: 4.3.18r96516 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db110
814.21d4: supR3HardenedVmProcessInit: uNtDllAddr=0000000077b10000
814.21d4: ntdll.dll: timestamp 0x521eb03f (rc=VINF_SUCCESS)
814.21d4: New simple heap: #1 00000000002d0000 LB 0x400000 (for 1744896 allocation)
814.21d4: System32:  \Device\HarddiskVolume1\Windows\System32
814.21d4: WinSxS:    \Device\HarddiskVolume1\Windows\winsxs
814.21d4: KnownDllPath: C:\Windows\system32
814.21d4: supR3HardenedVmProcessInit: Opening vboxdrv stub...
814.21d4: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
814.21d4: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
814.21d4: Registered Dll notification callback with NTDLL.
814.21d4: supR3HardenedMonitor_LdrLoadDll: 'kernel32.dll' -> 'C:\Windows\system32\kernel32.dll' [rcNt=0xc0150008]
814.21d4: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume1\Windows\System32\kernel32.dll)
814.21d4: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\kernel32.dll
814.21d4: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
814.21d4: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000008 'C:\Windows\system32\kernel32.dll'
1e94.1c2c: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0xc0000008 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 42 ms, CloseEvents);



VBoxStartup.zip

(2.57 KiB) Downloaded 36 times

[TripleRipple]

As requested I am including the following

1) Host and version
Windows 8 Version 6.3 (Build 9600)

2) VBoxStartup.log
Attached

3) Host anti-virus, firewalls, protection software, and debugging programs.
None, Built in Windows Defender

The following is the error I am receiving with VirtualBox version 4.3.18 r96516

NtCreateFile(\Device\VBoxDrvStub) failed: 0xc0000034 STATUS_OBJECT_NAME_NOT_FOUND (0 retires)

Driver is probably stuck stopping/starting. Try 'sc.exe query vboxdrv' to get more information about its state. Rebooting may actually help. (rc=-101)

Make sure the kernel module has been loaded successfully/

[Petr Vones]

Rebooting may actually help. (rc=-101)

Have you tried that ?

[MisterTea]

Rebooting may actually help. (rc=-101)

Have you tried that ?

I have the same problem in Windows 7 and it was caused after this weeks round of patches on "patch tuesday". Tuesday everything was working 100% with 4.3.18. Wednesday morning at 3AM my Win 7 PC auto installed updates and rebooted. Wednesday morning my 4.3.18 no longer worked and I received the same errors as the GP you were quoting. The only fix I have gotten to work is to roll back to 4.3.12. Not exactly a fix but a workaround. Every version afterward implements the VB security model and is failing to launch VM's. My other work system, a Macbook pro, runs 4.3.18 without issue.

Of course you can use system restore to roll back before the updates. Go to control panel, click windows updates and view the update history. Go to system restore and assuming you didn't disable it or have it crap out on you unknowingly (thanks windows !), restore before the updates and see VB works. My system restore somehow crapped out and was not writing restore point files. So I am stuck with running 4.3.12 until the VB teams works everything out. That or I painstakingly uninstall every update by hand and risk breaking Windows.

[Petr Vones]

I have the same problem in Windows 7 and it was caused after this weeks round of patches on "patch tuesday".

The only known issue with October updates is http://answers.microsoft.com/en-us/wind ... 01571ff2c1 Just reinstall the afftected KB2952664, if failed. I am not convinced that this is Microsoft issue at all. I have already posted my opinion that all these PE loading hacking attempts will result in substantial VirtualBox reliability issues but this is out of scope of this discussion.

Of course you can use system restore to roll back before the updates.

Do not do that.

[here647]

I have the same problem in Windows 7 and it was caused after this weeks round of patches on "patch tuesday".

The only known issue with October updates is http://answers.microsoft.com/en-us/wind ... 01571ff2c1 Just reinstall the afftected KB2952664, if failed. I am not convinced that this is Microsoft issue at all. I have already posted my opinion that all these PE loading hacking attempts will result in substantial VirtualBox reliability issues but this is out of scope of this discussion.

Of course you can use system restore to roll back before the updates.

Do not do that.

Petr, your response seems strange. The link you provided only has to do with if an MS patch doesn't install properly. If virt box is having problems after the patch release, more then likely it's an MS patch that did get installed that's conflicting with virt box.

[Petr Vones]

If virt box is having problems after the patch release, more then likely it's an MS patch that did get installed that's conflicting with virt box.

No, VirtualBox after 4.3.12 is performing operations/hacks that goes against and "out of" Windows operating system principles. So any regular update can make the VB fragile part to fail again, it is not Microsoft nor any other vendor (antivirus) fault. (moderators, feel free to delete my posts since there are off topic ... but correct)

[Perryg]

@petr Vones

I don't want to delete any post but all I have seen from you is conjectures and sometimes false truths. If you want to boost your position I would think supplying proof and even code improvements. It is after all open source. Other than that you are just another sour grapes, sky is falling individual that wants people to think he knows it all.

Hopefully this will fall on open ears so to say and if not I don't see any reason for you to continue to use a product that you hate this much. Use Linux as host or some other virtualizer.

[Petr Vones]

I don't want to delete any post but all I have seen from you is conjectures and sometimes false truths.

I am aware and fully agree with that. Unfortunately the policy of hiding the technical aspects of the vulnerability opens an imaginations. I have already browsed the source code but you can not expect to understand a reverse engineer the issue from it that soon.

Hopefully this will fall on open ears so to say and if not I don't see any reason for you to continue to use a product that you hate this much.

Sorry this is a big misunderstanding. I have tried all client virtualization technologies available on Windows platform (including commercial ones, I have no problem to buy them) but the VirtualBox is the best of them regarding features, performance and system requirments. I would like to continue to use it. That's why I am being sad that recent major versions are in such state of reduced reliability. And last comment, I can not agree it is Microsoft or any other's fault that was said in the forum recently. Always try to find your bugs first before you accuse someone else, that's my basic rule.

[Perryg]

the policy of hiding the technical aspects of the vulnerability

This is on purpose. If it were posted in public it would be much worse then it is at the present state. Its enough to know that the issue was serious enough for the complete DEV team to stop everything else and address the issue before it became a major cluster ( you know what ) to deal with. As for blame it is actually no ones and everyones. Code always has and always will have issues. Hopefully this ( as I see it only temporary ) pain will be addressed soon and not by white list as been previously speculated.

[socratis]

Just to add to what Perry said, imagine the two potential release notes:

1. Fixed a vulnerability where a guest could gain administrator access to the host (CVE ###).
2. Fixed a vulnerability where a guest accessing http://www.malware.com/VirtualBox4.3.12exploit.cgi causes a guest to gain administrator access to the host (CVE ###). The reason is that there is an unhandled exception in VBoxSvc.dll. Here is some sample code on how to achieve this.

[Petr Vones]

Just to add to what Perry said, imagine the two potential release notes:

Lets continue here https://forums.virtualbox.org/viewtopic.php?f=1&t=62897 Please move those offtopic posts there, if possible.