Windows 4.3.16 specifically for errors due to security

[bird]

Reposting test build #3 as the initial build (96096) was broken by some build server changes:

The previous build (#2) broke things for all avast users. Frightfully sorry about that. Here is a new build that fixes that blunder.

Test build #3: https://www.virtualbox.org/download/tes ... 01-Win.exe

@RobBrownNZ, @spider38: Please try the new build, it should fix the problem you were seeing with build #2.

@derscherjm, @Limeroli, @rnewman, @Gurvender.Bahia, @mattsnowboard: Would be great if you could take the new build for a spin.

Cheers,
bird

[RelakS]

same error as with build 2 (several post before)
If new logs are needed, I can post tomorrow.

[spider38]

Reposting test build #3 as the initial build (96096) was broken by some build server changes:

The previous build (#2) broke things for all avast users. Frightfully sorry about that. Here is a new build that fixes that blunder.

Test build #3: VirtualBox-4.3.17-96101-Win.exe

@RobBrownNZ, @spider38: Please try the new build, it should fix the problem you were seeing with build #2.

@derscherjm, @Limeroli, @rnewman, @Gurvender.Bahia, @mattsnowboard: Would be great if you could take the new build for a spin.

Cheers,
bird

The revised test build #3 (96101) has fixed the installer error but introduced a different error when trying to start a VM:

VBox 4.3.17-96101 error when attempting to start VM.png (25.38 KiB) Viewed 8808 times

VBox 4.3.17-96101 error when attempting to start VM second dialogue box.png (37.81 KiB) Viewed 8808 times

VBoxStartup (2).zip

(14.17 KiB) Downloaded 68 times

To save hunting through previous posts, OS is Windows 7 Professional 64-bit with Avast.

I uninstalled VirtualBox, rebooted and re-installed but with the same error occurring.

[rexcat]

VirtualBox-4.3.17-96087,virtualbox.exe is still cannot run.

Code: Select all   Expand viewCollapse view

Faulting application name: VirtualBox.exe, version: 0.0.0.0, time stamp: 0x5415fe08
Faulting module name: VirtualBox.exe, version: 0.0.0.0, time stamp: 0x5415fe08
Exception code: 0xc0000005
Fault offset: 0x0000000000018158
Faulting process id: 0x1640
Faulting application start time: 0x01cfd0dbc3ccefa2
Faulting application path: C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
Faulting module path: C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
Report Id: 019724ba-3ccf-11e4-9913-902b343974b0

The disassembly at 0x18158 in VirtualBox.exe unfortunately makes no sense to me, I mean, we should not be executing anything at that address. So, the question is what caused us to get there.

I need at least the VBoxStartup.log for the crashing process in order to be able to help you (ideally I'd like a minidump of the crashing process of course).

Cheers,
bird.

Sorry，this system dmp file

[drescherjm]

Same error as previous with

1. Windows 8.1 Enterprise
3. Symantec Endpoint Protection 12.1.4100.4126

[JonathanThorpe]

Just tried 4.3.17 build, without success.

Running on Windows 7 Ultimate (x64), Microsoft Security Essentials (x64).

Rebooted for good measure after initial install. Didn't work.

Ran "sc.exe query vboxdrv" as suggested in the error message, was informed that no such service exists. Checked Windows Services and sure enough, VirtualBox isn't listed anywhere.

Log file attached.

[Limeroli]

@bird thanks for your efforts. I just wanted to inform you that my error suddenly disappeared (still with the 4.3.16 version). I didn't changed anyting (not that I am aware of). Maybe this was just some weird windows problem.

If my error will occur again, I will test your new build.

[udhos]

I'm hitting exact same error reported by spider38:

virtualbox-error.png (8.54 KiB) Viewed 8765 times

Test build: VirtualBox-4.3.17-96101-Win.exe
Host: Window 8.1 Enterprise on 64 bit
Antivirus software: Symantec Endpoint Protection 12.1.3001.165

VBoxStartup.zip attached.

[shewfig]

Windows 7 64-bit
VBox 4.3.17 r96101
Sophos Endpoint Security 10.3

Symptom: VM guest (Ubuntu 12_04) with eth0 as NAT. Can ping out, but cannot create outbound TCP socket - immediately returns ICMP error "Net unreachable", which is clearly not true, since the ping worked.

Best guess on the smoking gun in the log:

Code: Select all   Expand viewCollapse view

70a0.5078: \Device\HarddiskVolume2\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll: Owner is not trusted installer (01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00)
70a0.5078: supHardenedWinVerifyImageByHandle: -> -5667 (\Device\HarddiskVolume2\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll)
70a0.5078: Error (rc=0):
70a0.5078: supR3HardenedScreenImage/LdrLoadDll: rc=Unknown Status -5667 (0xffffe9dd) fImage=1 fProtect=0x0 fAccess=0x0 \Device\HarddiskVolume2\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll: supHardenedWinVerifyImageByHandle: TrustedInstaller is not the owner of '\Device\HarddiskVolume2\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll'.
70a0.5078: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll
70a0.5078: Error (rc=0):
70a0.5078: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll': rcNt=0xc0000190
70a0.5078: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll'
70a0.5078: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -5667 (0xffffe9dd)) on \Device\HarddiskVolume2\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [lacks WinVerifyTrust]
70a0.5078: Error (rc=0):
70a0.5078: supR3HardenedScreenImage/LdrLoadDll: cached rc=Unknown Status -5667 (0xffffe9dd) fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=1 \Device\HarddiskVolume2\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll
70a0.5078: Error (rc=0):
70a0.5078: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll': rcNt=0xc0000190
70a0.5078: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll'
70a0.5078: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -5667 (0xffffe9dd)) on \Device\HarddiskVolume2\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [lacks WinVerifyTrust]


[akujin]

This is happening to me with build 3.

I have Windows 7 Home Premium
I don't use antivirus software. Never even been installed on this machine (besides MalwareBytes for scanning - does not run at all times)

I can't post images, because this is my first post ever, so I'm attaching everything.

Error:
Failed to verify process integrity: (rc=-5640)
Please try reinstalling VirtualBox.

Then I get this:
Failed to open a session for the virtual machine Windows 8.1.
The virtual machine 'Windows 8.1' has terminated unexpectedly during startup with exit code 1 (0x1). More details maybe available in 'C:\Users\Administrator.Deadpool\VirtualBox VMs\Windows 8.1\Logs\VBoxStartup.log'.

Details:
ResultCode: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

As you can probably see, I installed this through my administrator account on my computer after a failed attempt on my regular user accounts. I had the same errors on those accounts as well.

[SteKs]

Just add me to this thread...

I installed .16 and the .vdi no longer loads (E_Fail sumthin') - I returned to .12 and all is well again!

attached the log!

[bird]

Sorry，this system dmp file

Excellent!! I can see pretty much exactly what's going wrong now, thanks!
You seems to have both Comodo Firewall and Symantec Endpoint Protection (SEP) (or some relatives of the two products) installed. I haven't seen SEP messing with the export table entries of ntdll.dll or kernel32.dll, so I assume it's Comodo's guard64.dll or some associated kernel component at work. Will try reproduce locally and/or fix.

Many thanks,
bird.

[Tyro]

It Works !

Windows Server 2008 R2
Anti-Virus : Trend Micro
VBox : 4.3.17 r96101

Thank you

[Robee]

Upgraded to 4.3.16 earlier this week, and whilst the first time I launched my VMs they worked fine, pretty soon they all started hanging on creating VM. I'm also an Avast! user.

The hung VirtualBox.exe's couldn't be terminated in any way, and prevented my machine from shutting down so I had to hard reset it each time. After about 4 or 5 reboots trying to solve the problem, found this thread!

Test Build #3 fixed it for me! Didn't need to reboot after installing it, VMs all now happily running as they did before.

Thanks!

[MikeDiack]

Pleased to report build 4.3.17 build 96101 installs and works well creating XP and Windows 7 guests on:

3 hosts:

1) Windows 7 x86 SP1 Ultimate with Avast 2014 (latest version: 2014.9.0.2021)
2) Windows 7 x64 SP1 Ultimate with Symantec Endpoint Protection (latest version: 12.1.4112.4156)
3) Windows 7 x86 SP1 Ultimate with Comodo Internet Security Premium (latest version: 7.0.317799.4142)