Discussion of Problems due to Hardened Security

[p060477]

if is correct to run it in prompt cmd dos,with the higher administrator's rights, i get this:

Microsoft Windows [Versione 6.3.9600]
(c) 2013 Microsoft Corporation. Tutti i diritti riservati.

C:\Windows\system32>sc.exe query vboxdrv

NOME_SERVIZIO: vboxdrv
TIPO : 1 KERNEL_DRIVER
STATO : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
CODICE_USCITA_WIN32 : 0 (0x0)
CODICE_USCITA_SERVIZIO : 0 (0x0)
PUNTO_CONTROLLO : 0x0
INDICAZIONE_ATTESA : 0x0

C:\Windows\system32>

hope it helps you to give an helpful hand to us..

thxs in adv

cheers!!

[mpack]

4 running instances? That's not right. Didn't you reboot your host as I asked earlier? There should have been zero instances once you did that.

[p060477]

4 running instances? That's not right. Didn't you reboot your host as I asked earlier? There should have been zero instances once you did that.

i've reboot as you ask..

pls could you give me the exact timing-procedure to follow..?..:

i've unistall
re install
reboot
cmd prompt : sc.exe query vboxdrv

if i did something incomplete or wrong could you pls give me the correct procedure to follow..?

thxs so much in adv

cheers!

[mpack]

Actually, it looks like I misunderstood what the output of "sc.exe query vboxdrv" was telling me, it seems that my translation from Italian was imperfect. It looks like it isn't "Status: 4 running", rather the correct translation is "State: 4 (running)".

So in fact that looks normal, my own PC gives the same output.

In that case I have no idea what your problem is. You'll have to wait until a dev takes an interest, or you could simply downgrade to VirtualBox 4.3.12.

[p060477]

hi
first so many thxs indeed

what about dev's thoughts on this matter?

i downgrade to 4.3.12 but for me the issue is the same

there is an incompatibility between vbox and at least win 8.1,
with my old xp works so fine,

i've opened a 3d on this on MS community forum but the admin says that,
and there is a logic in it,, i copy paste:

"it must be the dev of a sw to take effort to have it compatible with a S.O
cause the sw are millions and there is no way for a dev of a s.o to take care of all
the s.o are very less so it must be on sw's developers side to take care of them"

so pls say this to the vbox dev in order to have yr wonderful sw suitable to the last win 8.1 s.o

pls help all of us to use it!!

cheers!!

[forderud]

VirtualBox version: 4.3.29-100833 (latest test build).
Host OS: Windows 7 SP1 x64 (fully patched).

Anti-virus & firewall info:
McAfee Host Intrusion Prevention 8.0.0.2919
McAfee Agent 4.8.0.1500
McAfee GTI Proxy Agent 2.0.0.614
McAfee VirusScan Enterprise + AntiSpyware Enterprise 8.8.0.1247

Error message when attempting to start any VM:
VirtualBox - Error In supR3HardNtChildPurify
supHardenedWinVerifyProcess failed with VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED: (rc=-5673)
Full log attached.

Work-around:
Downgrading to <=4.3.16 fixes the issue for me.

[mpack]

i downgrade to 4.3.12 but for me the issue is the same

If you have the same problem with 4.3.12 then discussion of it doesn't belong in this topic, which is entirely for discussing issues raised by the hardening features introduced in 4.3.14. Besides, 4.3.12 doesn't even create a VBoxStartup.log file, so you certainly can't be seeing an unchanged behaviour.

[rnewman]

Hello,
No go with the latest build...

OS - Win7 Professional 64bit - SP1
Trendmicro Office Scan - 11.0.1454
Virtualbox - 4.3.29-101039

Screen shot and startup log attached.

I am happy to assist with debugging. Are there any switches or process that would provide additional diagnostic information?

Thanks,
Richard

[Ferri]

VBox : 4.3.28 rc 100309
OS : Win7 32 Bit
AV : Avira Free Edition

This my log with screenshot archived

VBoxStartup.rar

(69.5 KiB) Downloaded 34 times

And another console result

$ sc.exe query vboxdrv

SERVICE_NAME: vboxdrv
TYPE : 1 KERNEL_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

Thanks a lot

[xxnileshxx]

Failed to open a session for the virtual machine. The virtual machine has terminated unexpectedly during stattup error. I have windows 7 on the machine that has virtual box is installed I am trying to run an Andriod OS in the virutal box on 32 bit linux. I have McAfee anti virus on the machine. attached is the logfile. Please provide a solution.

[MikeSchwartz]

Xxnileshxx, it looks like you've got the same issue that I'm seeing: BeyondTrust. (I see privman64.dll in your log.)

[virtualmachinesnotworking]

Using VirtualBox 4.3.28-r100309 on Windows 7 Enterprise SP1. Everything was fine to begin with but then suddenly began receiving the following error when trying to start any of my virtual machines:

---------------------------
VirtualBox - Error In supR3HardenedWinReSpawn
---------------------------
Error relaunching VirtualBox VM process: 5
Command line: '60eaff78-4bdd-042d-2e72-669728efd737-suplib-3rdchild --comment "Windows 10" --startvm 8d834c9d-22eb-4d4a-be91-2932d22efff0 --no-startvm-errormsgbox "--sup-startup-log=C:\Users\User\VirtualBox VMs\Windows 10\Logs\VBoxStartup.log"' (rc=-104)
---------------------------

I had Symantec Endpoint Protection and Malwarebytes Anti-Malware installed, but removed them after this error started occurring. Also I used Sysinternals Autoruns tool to ensure that there were no remnants of the aforementioned security software. However, the error remained. The VBoxStartup.log now reports that supR3HardenedWinFindAdversaries returns 0x0.

The test build 4.3.29-r101248 elicited the same error.

Unfortunately the last version before hardening (4.3.12-r93733) is missing the Windows 10 guest type, so I can't use that as an alternative. Any suggestions to work around this error, or investigate it more deeply, would be most appreciated.

[rnewman]

Hi virtualmachinesnotworking,
You can run Windows 10 guests with 4.3.12.
You just use the Windows 8.1 settings.
I've been running two Win 10 VMs for several months now without issues.

-Richard

[rnewman]

Hello,
No go with the latest build...

OS - Win7 Professional 64bit - SP1
Trendmicro Office Scan - 11.0.1454
Virtualbox - 4.3.29-101248

Screen shot and startup log attached.

I am happy to assist with debugging. Are there any switches or process that would provide additional diagnostic information?

Thanks,
Richard

[MDCI]

VirtualBox 4.3.29-101248
After install, restoring VM:
BSOD
Error:
PAGE_FAULT_IN_NONPAGED_AREA
VBoxDrv.sys

After reboot:

Unable to load R3 module C:\Program Files\Oracle\VirtualBox\VBoxDD.dll (VBoxDD)
GetLastError=1790 (VERR_UNRESOLOVED_ERROR)
Details:
Error: EFAIL (0x80004005)
Component: Console
Interface: IConsole {8ab7c520-2442-4b66-8d74-4ff1e195d2b6}

Software:
Windows 7 SP1 x64
Kaspersky Internet Security

Version 4.3.12 works !
(the last version that worked fine)