Windows 4.3.20 specifically for errors due to security

Discussions related to using VirtualBox on Windows hosts.
Fr1z2r
Posts: 2
Joined: 26. Nov 2014, 17:51

Re: Windows 4.3.20 specifically for errors due to security

Post by Fr1z2r »

Host: win8.1 64 bit
VBoxStartup.log: 8kb file of zero bytes
Without antivirus and firewalls.

After updating to 4.3.20 (from 4.3.12), I have a bsod on launching any VM.
RelakS
Posts: 15
Joined: 15. Sep 2014, 09:53

Re: Windows 4.3.20 specifically for errors due to security

Post by RelakS »

Fr1z2r wrote: After updating to 4.3.20 (from 4.3.12), I have a bsod on launching any VM.
Host or Guest BSoD?

Send the Minidump file from the [yourdrive]:\Windows\Minidump folder.

I have this problem also, so I would like to see a solution to it. The more lof files to the developers the better :)
Fr1z2r
Posts: 2
Joined: 26. Nov 2014, 17:51

Re: Windows 4.3.20 specifically for errors due to security

Post by Fr1z2r »

RelakS wrote:
Fr1z2r wrote: After updating to 4.3.20 (from 4.3.12), I have a bsod on launching any VM.
Host or Guest BSoD?

Send the Minidump file from the [yourdrive]:\Windows\Minidump folder.

I have this problem also, so I would like to see a solution to it. The more lof files to the developers the better :)
Host bsod.
Minidump in attachement.
Attachments
112314-28906-01.dmp.zip
(24.22 KiB) Downloaded 44 times
Duanehebert
Posts: 33
Joined: 27. Oct 2014, 18:28

Re: Windows 4.3.20 specifically for errors due to security

Post by Duanehebert »

Host machine windows 7 Ultimate. 32 bit Service pack 1. Virus scanner ESET but disabled during install.

Ran the installer as administrator. Installation went ok. When I try to load any guest I get error popup
saying Failed to create the Virtual Com Object. The application will terminate. The details say:

Callee RC: E_INVALIDARG (0x80070057)

I've attached the startup log but had to zip it as it was too large.

Edit: Just to add that the errors in the log file refer to problems loading c:/windows/system32/wintab32.dll. This file does not exist on my system, nor can I find any reference to it in a registry search.
Attachments
VBoxStartup.zip
(28.29 KiB) Downloaded 43 times
Last edited by Duanehebert on 28. Nov 2014, 20:30, edited 1 time in total.
MikeDiack
Posts: 75
Joined: 20. Mar 2009, 15:57
Primary OS: MS Windows 8.1
VBox Version: PUEL
Guest OSses: Win 10, Win 7, XP, Linux, Win 8.1, Win 2000, Win NT 4
Location: UK

Re: Windows 4.3.20 specifically for errors due to security

Post by MikeDiack »

Host machine is (very high spec, 16 CPU, 16GB) Windows 7 SP1 x64 fully patched up to date.
Symantec Endpoint Protection: Version 12.1.5 (12.1 RU5) build 5337 (12.1.5337.5000) (Note: This is a recent version of SEE, released mid Sept 2014)
Virtual Box 4.3.20.96996

1) Select a virtual machine e.g. XP SP3 VM.
2) Start it.
3) The Starting VM "Creating process for virtual machine ..... (GUI/Qt)" message appears.
4) This message stays up, but stuck with progress bar at 0%, which doesn't progress, until after about 1 minute..
5) Then eventually a message is seen: "VirtualBox - Error in supR3HardNtChildWaitFor".
Timed out after 60001 ms waiting for child request #1 (CloseEvents). (rc=258).
with an Abort button.
6) On clicking Abort, a Virtual Box error is shown:

Note: The problem does NOT occur with the test build Virtual Box 4.3.17.96342, but has been seen in all builds after that, so this appears to be some regression since that version.

Failed to open a session for the virtual machine IRM_XP.

The virtual machine 'IRM_XP' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'C:\Users\MDiack\VirtualBox VMs\IRM_XP\Logs\VBoxStartup.log'.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}
Attachments
VBoxStartup.log
Virtual box log file when failing to start an XP VM with Vbox 4.3.20.96996 and Symantec Endpoint Protection
(16.68 KiB) Downloaded 50 times
nickb834
Posts: 1
Joined: 27. Nov 2014, 13:47

Re: Windows 4.3.20 specifically for errors due to security

Post by nickb834 »

Host: Windows 7 Enterprise 6.1.7601 SP1 Build 7601 / HP DC5850 PC (AMD Athlon Dual Core 5000B)
Log: VBoxSVC.log (as I can't even launch the GUI, much less a VM) attached
Security: Microsoft System Center Endpoint Protection (preventing service from starting makes no difference)

Have added screenshot showing error at startup.
Have tried multiple versions of VB, last working version I have is 4.1.34-95024.
Have tried running in safe mode - get exact same error as in screenshot.
Have updated drivers and BIOS to those latest available for this machine.
Have uninstalled all unecessary software from this machine and disabled all unecessary services (FWIW - obviously too many to list)
AMD-VT is enabled.

I can launch the GUI if I launch with compatibility set for any OS other than Win 7. If I launch this way, and create a brand new VM with default options for Windows XP 32 Bit - I get a slightly different error
Attachments
Screenshot_WINVISTA_COMPATABILITY_LAUNCH
Screenshot_WINVISTA_COMPATABILITY_LAUNCH
VB1.png (28.36 KiB) Viewed 11754 times
Screenshot_NO_COMPATABILITY_LAUNCH
Screenshot_NO_COMPATABILITY_LAUNCH
VB.png (20.42 KiB) Viewed 11754 times
VBoxSVC.zip
VBoxSVC.log
(762 Bytes) Downloaded 23 times
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Windows 4.3.20 specifically for errors due to security

Post by mpack »

@nickb834 and others :-

This is not the 4.3.20 support thread. Please only post in this thread if you have reason to believe that your problems are caused by the security (a.k.a. "hardening") features added in VirtualBox 4.3.14 and later. Those features attempt to prevent third party code from running inside a VM host process. If you are not even getting as far as launching a VM then by definition you are not suffering from a hardening/security related issue. Please see the Discuss the 4.3.20 Release topic for general discussion about 4.3.20. And in fact, please use search to find issues related to your specific error message (the cause of which, I suspect, is not VBox version related at all).
andreya108
Posts: 2
Joined: 28. Nov 2014, 08:48

Re: Windows 4.3.20 specifically for errors due to security

Post by andreya108 »

Windows 8.1 x64 latest updates.

VBox 4.3.20r96997

Does not start any VMs!

The same issue as ProTofik has: kernel32.dll lacks WinVerifyTrust.

No 3rd party AV software installed (just have removed).

Rolled back to 4.3.10

Code: Select all

1438.1470: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume6\Windows\System32\kernel32.dll)
1438.1470: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume6\Windows\System32\kernel32.dll
1438.1470: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000801:<flags> [calling]
1438.1470: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume6\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
1438.1470: supR3HardenedDllNotificationCallback: load   00007ff911190000 LB 0x0010f000 C:\WINDOWS\system32\KERNELBASE.dll [fFlags=0x0]
1438.1470: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume6\Windows\System32\KernelBase.dll)
1438.1470: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume6\Windows\System32\KernelBase.dll
1438.1470: supR3HardenedDllNotificationCallback: load   00007ff913920000 LB 0x0013a000 C:\WINDOWS\system32\KERNEL32.DLL [fFlags=0x0]
1438.1470: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume6\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
1438.1470: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff913920000 'C:\WINDOWS\system32\KERNEL32.DLL'
1438.1470: supR3HardenedDllNotificationCallback: load   00007ff7332a0000 LB 0x00106000 C:\Program Files\Oracle\VirtualBox\VirtualBox.exe [fFlags=0x0]
1438.1470: '\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
1438.1470: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe)
1438.1470: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume6\Program Files\Oracle\VirtualBox\VirtualBox.exe
f50.fb8: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0xc0000005 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 86 ms, CloseEvents);

Code: Select all

C:\WINDOWS\system32>sigcheck -e C:\WINDOWS\system32\KERNEL32.DLL

Sigcheck v2.1 - File version and signature viewer
Copyright (C) 2004-2014 Mark Russinovich
Sysinternals - www_sysinternals_com

c:\windows\system32\kernel32.dll:
        Verified:       Signed
        Signing date:   6:02 08.11.2014
        Publisher:      Microsoft Windows
        Description:    ?????????? ??????? Windows NT BASE API
        Product:        ???????????? ??????? Microsoftо Windowsо
        Prod version:   6.3.9600.17031
        File version:   6.3.9600.17031 (winblue_gdr.140221-1952)
        MachineType:    64-bit
Attachments
VBoxStartup(4.3.20r96997).zip
(3.66 KiB) Downloaded 25 times
Anunes
Posts: 71
Joined: 17. Jul 2014, 18:49

Re: Windows 4.3.20 specifically for errors due to security

Post by Anunes »

Hi,
@andreya108 - I have same OS as you , Win 8.1 x64 no AV installed and 4.3.20 is working perfectly.
My KERNELL32.DLL version is 6.3.9600.17056 so neuer than yours.
I have all updates installed including the optional ones, but I removed KB 3000850 and Kb 3014442 as I had the feeling they were causing problems in other app's
MuldeR
Posts: 27
Joined: 25. Aug 2014, 20:45

Re: Windows 4.3.20 specifically for errors due to security

Post by MuldeR »

Frank Mehnert wrote:
MuldeR wrote:VirtualBox 4.3.20, Release-Build 96996

Starting with VirtualBox v4.3.18, including all the VirtualBox v4.3.19 Test-Builds and the VirtualBox v4.3.20 Release-Build, the following error occurs with all VM's (32-Bit and 64-Bit) that I try to launch under Windows 7 (x64)...
I'm not 100% sure but I think your problem is fixed in the updated 4.3.20 Windows build (rev 96997, old rev was 96996). Please could you check?
Nope. I just tried with VirtualBox v4.3.21 r97032, but it still refuses to launch any VM on Windows 7 (x64) when custom Windows themes are in place.
Attachments
Logs.zip
(29.33 KiB) Downloaded 29 times
andreya108
Posts: 2
Joined: 28. Nov 2014, 08:48

Re: Windows 4.3.20 specifically for errors due to security

Post by andreya108 »

My KERNELL32.DLL version is 6.3.9600.17056 so neuer than yours.
Why this can happen when both our systems are up to date? Different regional update policy?
I have all updates installed including the optional ones, but I removed KB 3000850 and Kb 3014442 as I had the feeling they were causing problems in other app's
The same thing, all updates including optional. No updates were removed, since I do not feel any regression after KB3000850 and KB3014442. I still think something wrong with VB because of previous versions work flawlessly.

Is there any possibilities to disable new wave VB security?
Shumron
Posts: 5
Joined: 15. Nov 2014, 17:57

Re: Windows 4.3.20 specifically for errors due to security

Post by Shumron »

As I wrote in previous post in 4.3.18, the same thing with incorrect path to dll retreiving/parsing exists in 4.3.20/21 and not changed at all.
I had created ticket with detailed information and logs, please review it:
https://www.virtualbox.org/ticket/13659
Hardened protection can't get path to dll correctly, so can't verify signature and... rejecting this dll
GraphicJazz
Posts: 1
Joined: 1. Dec 2014, 08:17

Re: Windows 4.3.20 specifically for errors due to security

Post by GraphicJazz »

I just recently upgraded to VirtualBox 4.3.20 r96997 from a 4.2.x version. Now I am unable to run any of the virtual machines I had created or any new ones I create.

Every time I try to run a virtual machine it thinks for a few minutes then I get an error window titled "VirtualBox - Error In supR3HardNtChildWaitFor". In the window it has "Timed out after 60012 ms waiting for child request #1 (CloseEvents). (rc=258)" with an "Abort" button. After I click abort another error window appears titled "VirtualBox - Error" with the following text:

Failed to open a session for the virtual machine mint.
The virtual machine 'mint' has terminiated unexpectedly during startup
with exit code 1 (0x1). More details may be available in 'C:
\Users\****\VirtualBox VMs\mint\Logs\VBoxStartup.log'
.
Details
Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

This window has "OK" and "Copy" buttons

My host machine is Windows 7 Pro 6.1 Build 7601 SP1 64 bit
I am currently using Symantec Endpoint Protection 12.1.5 (12.1 RU5) build 5337 (12.1.5337.5000) for my firewall and anti-virus/malware protection.
I have attached the log file for this particular virtual machine.
Attachments
VBoxStartup.zip
(4.66 KiB) Downloaded 31 times
MikeDiack
Posts: 75
Joined: 20. Mar 2009, 15:57
Primary OS: MS Windows 8.1
VBox Version: PUEL
Guest OSses: Win 10, Win 7, XP, Linux, Win 8.1, Win 2000, Win NT 4
Location: UK

Re: Windows 4.3.20 specifically for errors due to security

Post by MikeDiack »

Trying the current latest test build (4.3.21 build 97058) with Symantec Endpoint Protection:

Host machine is Windows 7 SP1 x64 fully patched up to date.
Symantec Endpoint Protection: Version 12.1.5 (12.1 RU5) build 5337 (12.1.5337.5000)
Virtual Box 4.3.21.97058 test build

1) Select a virtual machine e.g. XP SP3 VM.
2) Start it.
3) There's a long pause (60 secs approx) before the Starting VM "Creating process for virtual machine ..... (GUI/Qt)" message appears.
4) This message stays up, but stuck with progress bar at 0%, which doesn't progress.
5) Then eventually a message is seen: "VirtualBox - Error in supR3HardNtChildWaitFor".
Timed out after 60007 ms waiting for child request #1 (CloseEvents). (rc=258).
with an Abort button.
6) On clicking Abort, a Virtual Box error is shown:
Failed to open a session for the virtual machine IRM_XP.

The virtual machine 'IRM_XP' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'C:\Users\MDiack\VirtualBox VMs\IRM_XP\Logs\VBoxStartup.log'.

Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

7) Vboxstartup.Log is attached.

Note: The last build that worked correctly on my configuration is VBox 4.3.17.96342.
Attachments
VBoxStartup.log
Failure to startup a VM with 4.3.21 test build on Win 7 x64 SP1 host with Symantec Endpoint Protection 12.1.5
(16.59 KiB) Downloaded 34 times
rnewman
Posts: 37
Joined: 11. Sep 2014, 19:58

Re: Windows 4.3.20 specifically for errors due to security

Post by rnewman »

Still no luck with 4.3.20

Windows 7 Professional SP1 64bit
TrendMicro OfficeScan 11.0.1454
Virtualbox 4.3.20 - r96997

Virtualbox startup log and screen shot of pop up error message attached.
Attachments
VirtualBox-4.3.20.zip
(202.18 KiB) Downloaded 50 times
Locked