[Resolved] Hardening errors suddenly appear when starting all VM's

Discussions related to using VirtualBox on Windows hosts.
Post Reply
rdread
Posts: 3
Joined: 21. Jun 2018, 19:00

[Resolved] Hardening errors suddenly appear when starting all VM's

Post by rdread »

I had not used VirtualBox in two or three months and recently tried opening my two virtual machines. They are both failing to open with the same hardening error. Everything was working OK previously.

I have a 64 bit Windows 8.1 host machine and the two virtual machines are running Windows 10 guests.

The error shown in the first pop-up dialog box that appears is: 5 VERR_INVALID_NAME (-104) – Invalid (malformed) file/path name.

Only a single error appears in the VBoxHardening log (attached):
2bd0.2a80: supR3HardenedMonitor_LdrLoadDll: error opening 'C:\WINDOWS\system32\wintab32.dll': 0 (NtPath=\??\C:\WINDOWS\system32\wintab32.dll; Input=C:\WINDOWS\system32\wintab32.dll; rcNtGetDll=0x0

2bd0.2a80: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000034 'C:\WINDOWS\system32\wintab32.dll'
Wintab32.dll does not exist in the C:\Windows\System32 directory (yes, hidden and system files are both displayed in my Windows explorer). In addition, I did a full registry search for "wintab" and "wintab32" and there were no hits. It appears the error is occurring because VirtualBox is trying to load wintab32.dll and the file does not exist.

I read the posting "Diagnosing VirtualBox Hardening Issues" and ran through the checks listed there, retesting VirtualBox after each:
  • Verified that the last line in the hardening log shows ExitCode = 0x1.

    Fully uninstalled and reinstalled latest version (5.2.12) of VBox using "Run as administrator" to run the installer.

    Made sure latest Windows updates are installed on my host.

    Ran "DISM.exe /Online /Cleanup-image /Restorehealth", followed by "sfc /scannow", which reported "Windows Resource Protection did not find any integrity violations."

    Disabled my antivirus software (ESET Smart Security) and tested.

    Fully uninstalled ESET and started Windows Firewall and Windows Defender in its place.

    Verified that Hyper-V is not enabled.

    "More than one thread in process" does not appear in the hardening log.

    Created a new empty virtual machine and started it – the same error occurred as it tried to load wintab32.dll. Thus it appears it has nothing to do with the contents of the virtual machine.
Why is VirtualBox demanding a driver for digitizing pen tablets (wintab32.dll) that is not distributed with VirtualBox nor distributed with the Windows 8.1 operating system? Why is VirtualBox demanding a driver for digitizing pen tablets at all? I have never owned such a device.

Just to see what would happen, I downloaded a digitizing pen tablet driver from a trusted vendor of such software (Wacom) and transferred the wintab32.dll to the Windows\System32 directory. This time the error did not occur on the attempt to open the file, but a different one occurred once it had it open:
  • "Image is for 'X86_32' and contains code (0x15a200), only accepting images for 'AMD64' with code."
It appears to be rejecting the DLL because it is 32 bit, and it is only accepting 64 bit (which is correct because I'm running VBox under 64 bit windows). However, I cannot understand why VBox is trying to load an arbitrary 32 bit DLL to begin with.

Would appreciate any advice.

Regards
Attachments
VBoxHardening.zip
(9.42 KiB) Downloaded 60 times
Last edited by socratis on 17. Oct 2018, 08:53, edited 2 times in total.
Reason: Marked as [Resolved].
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Hardening errors suddenly appear when starting all VM's

Post by socratis »

I couldn't see anything obvious from your log, and you seem to have done your homework before you were even asked to! Kudos! So, where does that leave you? Let's see...

See what you have installed on your host. Think of any programs that might be invasive. From filters, to antivirus, to ... anything. Lately for example we've had a barrage of reports about Trusteer Rapport, a web-banking security software. Never had the smallest issue before their 1/Jun/2018 update, when something broke in their signed programs. They're aware of it and try to fix it, it's relatively easy once you know that your software is problematic.

I personally had an issue about two days ago, when after my host froze hardening was refusing to start any VM. The fix? A simple 'chkdsk' and a reboot. Completely irrelevant, simply showing that something got confused in the Windows Certificate Database and all it needed was a jolt.

And try to see what got installed/updated lately from the Programs and Features, sort them by date.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Hardening errors suddenly appear when starting all VM's

Post by mpack »

rdread wrote: However, I cannot understand why VBox is trying to load an arbitrary 32 bit DLL to begin with.
Re this comment, are you assuming that your original "wintab32.dll" is 32bit because of the filename? If so that would be incorrect. If the host OS is 64bit then that DLL is 64bit, the name is just an accident of history. Likewise, the windows system directory is still called \Windows\System32 even on 64bit hosts. Old file and pathnames were retained in case the name change broke some non-Microsoft app.

You can tell that this is the case because you got a different error when you replaced that DLL with on from a 32bit host.

Frankly, I've seen this WinTab32.dll error lots of times. IMHO you can forget the idea that it's caused by a corrupted WinTab32.dll, but so far I have not pinned down what it does signify. Use of encryption? Disk compression? Non-MS audio drivers for some reason occurs to me too, since I see "midimap" being mention close to the failure (you might try disabling audio, 2D and 3D acceleration in a test VM).
rdread
Posts: 3
Joined: 21. Jun 2018, 19:00

Re: Hardening errors suddenly appear when starting all VM's

Post by rdread »

Socratis and mpack:

Thanks for your comments. I guess you are suggesting my "wintab32.dll" error is not informative of the real error that caused the failure. I'm not surprised, of course. As a developer I've often run into instances where the original error is not logged, but it triggers a cascade of errors, the last of which, when logged, bears no logical connection to the one that started the whole thing.

I guess all that's left is to start guessing at solutions, changing things, retesting, and hoping I will stumble into the cause eventually. I'll take a close look at some of the things you suggested. Sure wish the error logging could accurately identify the program that caused the problem.

Thank you for your assistance.
rdread
Posts: 3
Joined: 21. Jun 2018, 19:00

Re: Hardening errors suddenly appear when starting all VM's

Post by rdread »

Wow, that was quick!

I finally got around to looking for Trusteer. Did not realize i still had that on my system. I uninstalled it and that fixed the problem.

Thanks for your help.
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Hardening errors suddenly appear when starting all VM's

Post by socratis »

Great, thanks for the feedback. Marking as [Resolved].
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Splatz
Posts: 1
Joined: 5. Oct 2018, 13:21

Re: [Resolved] Hardening errors suddenly appear when starting all VM's

Post by Splatz »

I just want to add that I had exactly the same problem with the Trusteer Rapport software. The error went away when I uninstalled it.
biggerdime
Posts: 1
Joined: 17. Oct 2018, 08:18

Re: [Resolved] Hardening errors suddenly appear when starting all VM's

Post by biggerdime »

Same for me, removing Trusteer Rapport fixed my VBOX startup errors as well. Thanks for a decent post to start with.
Post Reply