virtualbox.org

Continuation of viewtopic.php?f=6&t=66071 for VirtualBox version 4.3.24.

This topic is specifically for Windows users that may still have issues seen in version 4.3.24 caused by security being strengthened.

If you want to be taken seriously you need to post a few items as attachments (compressed is preferred)

• 1) Host OS and version
  2) VBoxStartup.log (zipped)
  3) Mention any host anti-virus, firewalls, protection software, and debugging programs etc which might be relevant.

As in the previous (4.3.14 through 4.3.22) discussions, the purpose of this topic is to gather diagnostic data needed to solve the hardening issues, and nothing else. Wibble posts, opinion posts, and posts that don't include necessary diagnostics will most likely be deleted. If a test build is created then you'll be expected to have tried it before you post.

Please be explicit about errors. Don't say "same as xxxxx". See list above for what's required.

Test builds (when available) can be found here: https://www.virtualbox.org/wiki/Testbuilds


--------- Original post by MikeDiack.
I've just set this up seeing as Virtual Box 4.3.24 r98716 has just been released. Hopefully mpack and co. can put in the relevant bits here.

I've just tried the new VBox 4.3.24 r98716 build on 2 host systems:

a) Windows 8.1 x64 Host (fully patched) running Comodo Internet Security Premium 8.1.0.4426
b) Windows 7 SP1 x64 Host (fully patched) running Symantec Endpoint Protection Version 12.1.5 (12.1 RU5) build 5337 (12.1.5337.5000)

I'm delighted to say that both host systems are successfully running Windows XP 32 bit and Linux 32 bit guest OSes.

Just as for 4.3.22, it looks like Virtual Box 4.3.24 is compatible with the latest Symantec Endpoint Protection (12.1.5)

Mike

Hello,
No go with the latest build.

OS - Win7 Professional 64bit - SP1
Trendmicro Office Scan - 11.0.1454
Virtualbox - 4.3.24

Screen shot and startup log attached.

I am happy to assist with debugging. Are there any switches or process that would provide additional diagnostic information?

Thanks,
Richard

a870.99d4: supR3HardNtViCallWinVerifyTrust: WinVerifyTrust failed with 0x800b010a (CERT_E_CHAINING) on '\Device\HarddiskVolume1\Program Files\NVIDIA Corporation\coprocmanager\nvdxgiwrapx.dll'
a870.99d4: supR3HardNtViCallWinVerifyTrust: WinVerifyTrust failed with 0x800b010a (CERT_E_CHAINING) on '\Device\HarddiskVolume1\Program Files\NVIDIA Corporation\coprocmanager\Nvd3d9wrapx.dll'
a870.99d4: supR3HardNtViCallWinVerifyTrust: WinVerifyTrust failed with 0x800b010a (CERT_E_CHAINING) on '\Device\HarddiskVolume1\Windows\System32\nvinitx.dll'

Has this been made usable with Symantec Endpoint Protection v12.1.4013 yet? I cannot test it on my machine because it is pretty near impossible to remove VBox once it's installed on my work machine, and "reinstalling" the OS would involve getting a whole replacement laptop mailed to me (I work remote). So I have to stick with v4.3.12 until this gets resolved. The corporate updater utility does not have an update of SEP to a newer build, so I will be stuck on 4013 for the foreseeable future.

Wouldn't it just be simpler to add a configuration switch to **disable** the security check that is giving everybody such trouble? It obviously is failing in a large number of configurations, so I presume it's bot really ready for widescale usage.

Having read some posts on the subject of disabling the security checking, I believe the dev's would rather get it fixed than add in a no-security switch, with all the testing and unexpected results that might also cause.

The real question is, do you have to update? "If it aint broke don't fix it" is a pretty good motto. I doubt guest OS's have changed much since the first security-hardening issues came out, and we know Windows 10 TP runs with the 8.1 template (10 doesn't technically exist yet anyway). I seem to recall that maybe the newest Linux might have a need for newer versions? But newer anything wouldn't get used in production. Could you dual-boot your laptop and run Virtualbox without the SEP on a different partition? Or use a different PC?

As I have read, the way to continue using 4.3.12 safely is to keep malware off your host.

scottgus1 wrote:Could you dual-boot your laptop and run Virtualbox without the SEP on a different partition? Or use a different PC?

Hah, if I could dual-boot, I'd probably already have more control over my work laptop. No DVD drive, and the HDD is already encrypted with bitlocker. About all I can do is add apps in elevated mode (and removing them often wants full administrative mode, which means I have to ping someone in the group with that access to AD). I would prefer running VBox on this machine since I'd want to work with files/systems within the corp. network. Also, the laptop has 8G of memory, my home system only has 4. Besides, my home systems are all Linux, and I don't have the same issues there. This is probably the first work computer in 20 years I haven't had some level of administrative control over, and I would have been able to reinstall those if my system went wonky.

Still having issues here with 4.3.24

Host: Win7 Ultimate 64-bit
AV: Norton Internet Security
VB: 4.3.24-98716

Can someone here at least confirm that the issue is, in fact, this new "security" thing? And not some other mystery issue?

The virtual machine 'CHS_XP' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'T:\VM\CHS_XP\Logs\VBoxStartup.log'.


OS - Win7 Professional 64bit
quanjia scan - 10.6.15950.224
Virtualbox - 4.3.24r98716

VirtualBox: v4.3.24 r98716
Host: Windows 7 Ultimate OEM with latest updates/patches (with SEP 12.1.5 (12.1 RU5))
Guests: Linux / Win XP x64 / Win 7 x64 (with SEP 12.1.5 (12.1 RU5))
A/V: Symantec Endpoint Protection 12.1.5337.5000 (including many other apps such as virtual drives)

I have not come across any error. VirtualBox 4.3.22 - 4.3.24 has no problem what so ever with SEP. Everything install smoothly and runs smoothly.

Windows 7 Home Premium (x64) SP1
Virtualbox 4.3.24 r98716
ZoneAlarm Extreme Security version: 13.3.052.000

Virtualbox seems to be tripping on shell32.dll, which I do have modded for a theme.
Startup Log is from Windows 10 Guest OS

Windows 8.1 Pro with Media Center
Kaspersky Internet Security 2015
Virtualbox 4.3.24

Failed to open a session for the virtual machine Tails.

The virtual machine 'Tails' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'J:\VirtualBox VMs\Tails\Logs\VBoxStartup.log'.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

Hello,

OS: Win7 Enterprise -32bit SP1
Virtualbox - 4.3.24-98716
Trendmicro OfficeScan Client for Windows 10.6.2192 SP1

It's a pity that v4.3.24 still doesn't fix it. Hope to get some good news on this problem soon

Failed to open a session for the virtual machine WinXP.

The virtual machine 'WinXP' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'C:\Users\vorou\VirtualBox VMs\WinXP\Logs\VBoxStartup.log'.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

Host: Windows 8.1 Enterprise, x64. No antivirus, except for default MS System Center Endpoint Protection (real-time protection disabled).

Host OS and version: Win 7 64 bit
A/V: McAfee VirusScan Enterprise/Agent/DLP Endpoint/Policy Agent/HIP

Installed clean today. Created a VM (Linux 32bit guest), loaded an ISO but got a "Failed to load session error...exit code -1073741819" when I tried to start up.

scottgus1 wrote:Having read some posts on the subject of disabling the security checking, I believe the dev's would rather get it fixed than add in a no-security switch, with all the testing and unexpected results that might also cause.

Yes, I don't understand why the hardened security isn't optional. A lot of casual Linux-on-Win users don't really need it. Though, if they make it easy to disable, I guess it is easy for malware to disable. But I am not sure if the security is about malware escaping the container (then such a switch makes sense), or keeping host malware out of the container (that seems like a lost cause if the host is already compromised -- I guess the container fails to start, as seen in this thread.)