Windows 4.3.20 specifically for errors due to security

[Jacky]

Thanks for reporting, OK I can revert for beeing able to get my machines running...

Will there be soon an update which fixes it?

Looking forward hearing from you

[mpack]

I'm afraid only the devs know their future plans to release any fixes.

[rbal]

Virtual Machine is stuck at - Creating process for virtual machine..........
0%

VBox version: 4.3.20
Host OS: Windows 7 Enterprise Service Pack 1
AV: Symantec Endpoint Protection
Latest Windows Security Update: KB3011780(12/5/2014)

I installed VBox last week and everything worked great until I restarted my machine yesterday. I noticed after the restart few windows security updates were done, and reading the thread seems it some the windows security updates have issues. I uninstalled the windows security updates from 12/17/2014, and uninstalled and re-installed VirtualBox but the issue is not resolved. I have also tried to install the VBox version 4.3.18 but I still run into same issues.

Only errors/information I can see in the start-Up log is :-

1e0c.1e10: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\apphelp.dll
1e0c.1e10: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling]
1e0c.1e10: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
1e0c.1e10: supR3HardenedDllNotificationCallback: load 000007fefd1d0000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0]
1e0c.1e10: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\apphelp.dll [lacks WinVerifyTrust]
1e0c.1e10: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd1d0000 'C:\Windows\system32\apphelp.dll'

I'm not even sure now if this issue is due to security or something else.

Anybody familiar with similar issues ?

[mongorian]

Host: Windows 7 Professional x64 running Symantec Endpoint Protection (enterprise system, centrally managed) on Lenovo W520

Fyi... This system did encounter the 4.3.14 issues, but these were all resolved with the 4.3.16 release.

My system does NOT have either of the suspect Microsoft patches installed (neither the original nor the rollup that was mentioned earlier) and yet has an issue starting any VMs on 4.3.20. I get the same message as 'rbal' and 'Jacky' - I am stuck at "Creating process for virtual machine... (0%)". Also, after trying to launch any VMs with 4.3.20 my Windows host will refuse to shutdown cleanly, requiring a hard poweroff to finally come down.

It was absolutely not a Windows update that broke my system. VirtualBox 4.3.16 was working perfectly fine following my latest round of Windows patches and a reboot (on 12/15). No additional OS Windows patches have been installed since these. I did not have any problems until I upgraded VirtualBox to 4.3.20 yesterday (12/17), and my problem is resolved by going back to 4.3.16.

I did not have these same issues on my home PC, where I also have Win7 Pro but on very different hardware. The system with the problem is my work computer, on which I rely on VirtualBox daily to get my job done. For this reason I cannot leave a broken version installed for any appreciable length of time to troubleshoot.


EDIT: I just checked the startup log for my latest successful startup on 4.3.16 and it still has several messages in there saying "lacks WinVerifyTrust" for a slew of different dll files, but the guest still starts without any problems. I have attached this log for review of a working 4.3.16 startup.

EDIT 2: I have attached a screenshot of the message I'm seeing (and even this takes excessively long to come up) as well as a copy of my startup log from a "failed" (more like "hung") start on 4.3.20. The log was done writing at least a minute or two before this message window finally popped up. Also worth noting, I think, is that I never actually see a "failure" message - I eventually have to close this 0% progress message window, then Virtual Box, and then force Windows to shut down by eventually doing a hard reset on the host.


Thanks,
-Jeremy

[mongorian]

I have a small update on my testing efforts...

I just found that VirtualBox 4.3.18 has the exact same issues for me as 4.3.20 does. I also tried manually disabling Symantec Endpoint Protection temporarily and launching a guest and had the same results.

At this point, this definitely seems to be related to some change made in VirtualBox between 4.3.16 (working version) and 4.3.18 / 4.3.20 (both broken in the same way).

EDIT: The latest test build (4.3.21 build 97294) has the same issues.

I have rolled back to 4.3.16 (yet again) and will be staying there until these issues get resolved.

[jonathandart]

Hi Guys,

I'm getting the error:

Code: Select all   Expand viewCollapse view

Failed to open a session for the virtual machine FishWpg_default_1418749363800_64528.

The virtual machine 'FishWpg_default_1418749363800_64528' has terminated unexpectedly during startup with exit code 1 (0x1).  More details may be available in '...'.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

1) Host OS and version
Windows 7 Enterprise, 64-bit

2) VBoxStartup.log (zipped)
Can't attach files until tomorrow (forum rule)

3) Mention any host anti-virus, firewalls, protection software, and debugging programs etc which might be relevant.
McAfee VirusScan Enterprise + AntiSpyware Enterprise 8.8.0
HTTP Proxy
Using vagrant 1.6.5 to manage vbox

Neither KB3004394 or KB3024777 are installed.

[compbl]

Nope. I just tried with VirtualBox v4.3.21 r97032, but it still refuses to launch any VM on Windows 7 (x64) when custom Windows themes are in place.

Does this mean that Virutalbox is basically refusing to run if you have something like Rainmeter installed on the Host? Really?

[MuldeR]

Nope. I just tried with VirtualBox v4.3.21 r97032, but it still refuses to launch any VM on Windows 7 (x64) when custom Windows themes are in place.

Does this mean that Virutalbox is basically refusing to run if you have something like Rainmeter installed on the Host? Really?

Probably yes. VirtualBox will now check all System DLL's. And if one of those DLL's is not "original", VirtualBox will simply refuse to launch any VM. This even applies to some DLL's that are completely unrelated to VirtualBox' area of responsibility, such as the Windows theme support DLL (uxtheme.dll). That DLL must be edited to customize the look of Windows - which is 100% legitimate, of course. But VirtualBox doesn't "allow" this. As a bonus feature, you will get a super cryptic error message, which doesn't give the slightest hint on why VirtualBox doesn't work. Some user on this forum had to give me the explanation what was causing this! Since it makes zero sense to me that VirtualBox refuses to run when custom Windows themes are in place, I'm going to assume that this is an undesired "side effect" of the recent security "enhancements". Thus, until I see an official statement on the VirtualBox main web-site which says "VirtualBox no longer can work on Windows when custom Windows themes are in place, we know this and have no intentions to fix it", I feel obliged to report this severe bug for every build that they release - until it will finally be fixed.

[MuldeR]

VirtualBox 4.3.21, Release-Build 97294

Sorry, the same startup bug persists in build 97294. Log is attached, as always...

[AnrDaemon]

https://www.virtualbox.org/ticket/13187#comment:136

[bjfs]

Registered here just to take notice of the error which happens on every VirtualBox instance after 4.3.12.
Using usual Windows 7 x64 with Kaspersky Internet Antivirus. All is included in two logfiles.

- one for 4.3.20 release (r20)
- one for test build 97294 (r21)

Thruth be told, I'm getting tired of downgrading all the time on that box; Windows 8.1 host with the same third-party software runs fine, though.

[jelabarre59]

MS Windows 7 SP1 (64bit)
Virtualbox 4.3.20 r96997
Symantec Endpoint Protection 12.1.4013.4013
8G memory, Lenovo T440
================

Encountering the same problem here, have verified that KB3004394 has been removed, and the machine has been rebooted more than once since then (re-checked that it didn't re-appear in the system).

===================================================================
Failed to open a session for the virtual machine mint171.

The virtual machine 'mint171' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'C:\Users\m56685\VirtualBox VMs\mint171\Logs\VBoxStartup.log'.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}
===================================================================

I cannot disable SEP, and cannot remove VBox in order to try a reinstall (or revert back to a *working* version) because while I can install software by running the installer "elevated", uninstalling it requires full domain administration (this is the first time in 12 or more years I haven't had full admin rights on my workstation). This needs to be fixed in a new build of Virtualbox in order to fix it on this workstation.

[mpack]

@jelabarre: You are suffering from the KB3004394 problem. Read the bold black text in the first post of this topic.

[jelabarre59]

@jelabarre: You are suffering from the KB3004394 problem. Read the bold black text in the first post of this topic.

No I am ***NOT*** suffering from that problem, because KB3004394 has already been ****REMOVED**** from my system. If you had bothered reading MY message, I explicity stated such. I have checked MULTIPLE TIMES that the fixpack has been removed. Now, unless MS has decided to conceal/renumber that KB, and actually place it under another number, then it is NOT on my system.

I have even tried running Virtualbox in "elevated" mode, and have tried downloading and importing an OVF file (learn_puppet_centos-6.5), and it continues to fail with the same error. So it's not even a problem with how I configured my VMs, since that test shows it fails even with a pre-made VM.

[mpack]

Your startup log says otherwise. I suggest you take the matter up with Microsoft if you don't believe me.

I have no idea what you expect will change if you run in "elevated mode". A corrupted certificates database is not fixed by running as admin. Nor is the issue relevant to any particular VM - the problem is on the host, not a VM.