ID Event 12 for VBoxNetLwf

Discussions related to using VirtualBox on Windows hosts.
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: ID Event 12 for VBoxNetLwf

Post by socratis »

JrPickle wrote:This hasn't been solved? ! I have been having random computer freezes after putting my laptop into sleep over the past month.
(emphasis mine)

If the developers can't reproduce it in a reliable manner[1],
  • => they can't know what's going on,
    • => they can't begin troubleshooting whatever might cause it,
      • => they can't begin addressing it,
        • => no fix.
So, unless someone comes up with a reproducible set of settings and conditions that causes this, it won't get resolved.

How do you know for example that this is not an interaction with some other piece of software? And what software might that be? Have you had this appear on a freshly installed Win10 installation for example? And when I sat freshly installed, that includes the OEM drivers/software that comes with the bundles of each OEM. They have been causing problems for example, more problems than you can imagine...

[1]: Yesterday I was testing a newly released test build. It crashed VBoxSVC on exit. Reliably, reproducibly and consistently, under really specific conditions. I keep copies of the previous test builds and I narrowed down the crash between r127414 and r127496, 82 builds in between, which made it easy to narrow and hone in on the mistake. Within 1/2 hour the developers knew about it, reproduced it, and fixed the crash. Within 1 hour there was a new test build, with the error taken care of...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Jiger
Posts: 100
Joined: 11. Jan 2017, 17:33
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: MS Windows XP, Linux Mint
Location: Stockholm

Re: ID Event 12 for VBoxNetLwf

Post by Jiger »

I decided to uninstall VBox (for the time being and until there is a solution to this error problem) and did that thoroughly including registry cleaning afterwards. I then restarted the system and found that the problem is still there!! It is exactly the same log text as before and the timing of the log post is exactly at the same time as the restart, maybe one or two seconds apart.
What could this indicate?
VBoxNetLwf could not be easily eliminated, because it was engaged in another program, but which one? I could not find out. When that was done - no error 12 in the log.
There are alltogether 5 Vbox files in the windows/system32 drivers/ folder - why are they left behind after uninstall of the VirtualBox program?
Could they all be deleted without consequenses for the system as a whole?
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: ID Event 12 for VBoxNetLwf

Post by socratis »

Jiger wrote:because it was engaged in another program, but which one?
If you've installed other programs that install VirtualBox because they rely on it, then that could happen. Programs like that (that I know of) are: Docker, Vagrant, Kitchen, Andy, Ubiquitous Bash, Genymotion, potentially others...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Jiger
Posts: 100
Joined: 11. Jan 2017, 17:33
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: MS Windows XP, Linux Mint
Location: Stockholm

Re: ID Event 12 for VBoxNetLwf

Post by Jiger »

socratis wrote:Programs like that (that I know of) are: Docker, Vagrant, Kitchen, Andy, Ubiquitous Bash, Genymotion, potentially others...
I have never heard of any o these programs...

Anyway, I have deleted all the 5 Vbox files in the windows/system32 drivers folder, and if there were any other program that needed any of these driver files, I would have noticed that by now. But I haven´t.
Mr Wolf
Posts: 50
Joined: 23. Aug 2010, 15:48
Primary OS: MS Windows 7
VBox Version: OSE other
Guest OSses: Kali Linux, BackTrack, Windows XP

Re: ID Event 12 for VBoxNetLwf

Post by Mr Wolf »

I remember once I had to remove VirtualBox from an old notebook of mine, and I couldn't get rid of the VirtualBox Host-Only Network. :roll:
Or, if I well remember, trying to removing the VirtualBox Host-Only Network I deleted some registry keys and the wireless network adapted didn't work anymore. I had to recover a backup and leave the VirtualBox Host-Only Network there. :|
This to say that removing completely VirtualBox (and other programs, of course) is a pain in the a... - very difficult, if not impossible.
Angel524
Posts: 1
Joined: 2. Feb 2019, 16:04

Re: ID Event 12 for VBoxNetLwf

Post by Angel524 »

Hello everyone and sorry if I introduce myself in the discussion.
This problem (ID event 12 for VBoxNetLwf) I saw it born with the next version of the "VirtualBox-5.2.8-121009-Win.exe", in fact this version does not cause; "ID event 12" and it works well.
I hope so much if developers can use this to compare the code between the new VirtualBox versions and find a solution to the bug. :)
Jiger
Posts: 100
Joined: 11. Jan 2017, 17:33
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: MS Windows XP, Linux Mint
Location: Stockholm

Re: ID Event 12 for VBoxNetLwf

Post by Jiger »

I have uninstalled VBox completely and found that the freezing problem ocurred anyway, but rather seldom, say once every 4-5 days. At that time I used MyPhoneExplorer (for Windows 10, 64 bit) as a start program in the host. THERE WAS NOTHING WHATSOEVER IN THE LOGBOOK CONCERNING THESE ERRORS! After having disabled this program as a start object, there hasn´t been any freezing problem for three weeks now.
I have decided not to install VBox again, as I find sufficient to have my VMs on the desktop, so I can´t say what would happen if it was installed, but maybe this could be a trace to investigate for the Event 12 error.
ACWETL
Posts: 1
Joined: 16. Feb 2015, 14:02

Re: ID Event 12 for VBoxNetLwf

Post by ACWETL »

I have been experiencing similar issues to others in this thread. As this is a random occurrence I can fully understand the difficulties in tracking it down. So, I hope the information I provide here is helpful in locating the issue.

I am currently using VirtualBox 5.2.28 on a Windows 10 1809 laptop.
I have been plagued with random BSOD events since October 2018 which all seem to relate to a device driver issue.
All the drivers and OS are up to date with the latest versions.

What is noticeable in the event log is a long list of Errors relating to VBoxNetLwf which stretch back to 3rd October 2018
Sample list of entries
Sample list of entries
Event Log Entries.png (65.27 KiB) Viewed 9119 times
Not all of these entries result in a BSOD
Here is the detail for the latest entry
General information from error
General information from error
Entry General Info.png (27.21 KiB) Viewed 9119 times
Details information from error
Details information from error
Entry Details.png (52.62 KiB) Viewed 9119 times
If I can collect any further logs or information from my system that will be helpful, please let me know.
Andrew
Tey'
Posts: 1
Joined: 18. May 2019, 23:48

Re: ID Event 12 for VBoxNetLwf

Post by Tey' »

Same error shows up on my system. After digging into the source code, I can confirm this is more a warning than an error. It is triggered by this code in VBoxNetLwf-win.cpp:

Code: Select all

    pModuleCtx->cbOffloadConfig = sizeof(NDIS_OFFLOAD) * 2; /* Best guess to accomodate future expansion. */
    /* Get the exact size, if possible. */
    if (pParameters->DefaultOffloadConfiguration)
        pModuleCtx->cbOffloadConfig = pParameters->DefaultOffloadConfiguration->Header.Size;
    else
        vboxNetLwfLogErrorEvent(IO_ERR_INTERNAL_ERROR, STATUS_SUCCESS, 8);
What this means is that one of the network interface on your system does not support offloading, and VBoxNetLwf does not expect that. Most of the time, network interfaces that are software only does not support offloading. In my case, I guess this is my VPN network interface.

The error message is harmless and pretty useless actually, since DefaultOffloadConfiguration is checked again before filling the buffer of size cbOffloadConfig. It should probably be removed to prevent useless worries by users, or at least, be downgraded to a warning message.
I really doubt the BSOD some users experience are related to that message.

For the records, the event ID 12 is IO_ERR_INTERNAL_ERROR and you can find out the error ID is 8 by looking at the binary word at offset 0x0010:
vbox-error.png
vbox-error.png (32.85 KiB) Viewed 9063 times
Koperlite
Posts: 1
Joined: 19. May 2019, 19:49

Re: ID Event 12 for VBoxNetLwf

Post by Koperlite »

Hello,

I just reinstalled Windows 10. Clear and new.
Installed the last 6.0.8 release and got errors on VboxNetLwf and got bad restart after *every* sleep modes (cover or time). After restart : "Windows didn't stop correctly"... "get back Chrome tabs" (sorry, I translate from french) "Office has some files to recover... do you want to save them"

Uninstalled 6.0.8 and installed 5.2.8. No more event errors and sleep mode wakes up ok.

I have an Intel AC-7260 wireless card on a laptop.

Regards
MrBud
Posts: 1
Joined: 20. Jul 2019, 12:43

Re: ID Event 12 for VBoxNetLwf

Post by MrBud »

I know this is an older topic, however, I figured some "fresh" input may help. If I'm wrong, please feel free to delete and let me know.

I'm investigating errors in my Event Viewer that are causing a system freeze. Some of the issues that may be driving this, specifically with regards to a VM or the entire system freezing up, may be related to other underlying Windows issues. This may include a display driver issue, a network issue, or a power management issue.

[*]For the power management issue simply try the following: In the Power Options, Edit the current plan, and change the advanced power settings function, change the "Turn off hard disk after" settings to Never.

Those that are still experiencing this issue, (specifically with a BSOD or screen lockup) prior to the Event ID 12 with Source VBoxNetLwf, are you experiencing any of the following events prior to the Error:
[*]Warning: Event ID 1; Source rt640x64
[*]Warning: Event ID 17; Source i8042prt
[*]Warning: Event ID 4101; Source Display

If so, these may also need to be investigated on an individual basis. Those symptoms could be impacting the drivers, causing the issue. At least that's just a thought.
BirtualVox
Posts: 1
Joined: 8. Aug 2019, 22:15

Re: ID Event 12 for VBoxNetLwf

Post by BirtualVox »

I've been seeing this error in the event viewer at home and at work for a long time, but never experienced any actual problems.

On closer inspection, on my home machine, I've noticed that it always happens in close conjunction with a network link disconnection warning event (event id 27 from e1iexpress for my Intel I211 NIC). It appears that the network link disconnection event always comes first, and the VBoxNetLwf event quickly afterwards.

Hence, perhaps the VBoxNetLwf error is only an indirect symptom of the real problem, which would be network disconnection?
DunX
Posts: 1
Joined: 21. Aug 2019, 05:09

Re: ID Event 12 for VBoxNetLwf

Post by DunX »

This has occured with me as well with Virutal Box installed on my Win10 PC.
I received two errors.
Event 12, VboxNetLwf

The driver detected an internal driver error on \Device\VBoxNetLwf.
Then Followed by
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscDataProtection
and APPID
Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Which then crashed my system.
Last edited by socratis on 21. Aug 2019, 09:34, edited 1 time in total.
Reason: Enclosed the information in [quote] tag for better readability
Al.S
Posts: 1
Joined: 9. Sep 2019, 15:57

Re: ID Event 12 for VBoxNetLwf

Post by Al.S »

I just installed the last version and got the same error. OS - WIN 7.64.
Don't know what to do with it.

Code: Select all

+ System 
  - Provider 
   [ Name]  VBoxNetLwf 

  - EventID 12 
   [ Qualifiers]  49156  
   Level 2 
    Task 0 
    Keywords 0x80000000000000 
   - TimeCreated 
   [ SystemTime]  2019-09-09T13:20:53.346333300Z 
    EventRecordID 31522 
    Channel System 
    Computer Home_net-PC 
   Security 
- EventData 
   \Device\VBoxNetLwf 
   0000080001000000000000000C0004C0080000000000000000000000000000000000000000000000002618EEB7E80000 
--------------------------------------------------------------------------------
Binary Data:
In Words
0000: 00080000 00000001 00000000 C004000C 
0008: 00000008 00000000 00000000 00000000 
0010: 00000000 00000000 EE182600 0000E8B7 

In Bytes
0000: 00 00 08 00 01 00 00 00   ........
0008: 00 00 00 00 0C 00 04 C0   .......À
0010: 08 00 00 00 00 00 00 00   ........
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........
0028: 00 26 18 EE B7 E8 00 00   .&.î·è..
Last edited by socratis on 9. Sep 2019, 17:38, edited 1 time in total.
Reason: Enclosed the information in [code] tag for better readability
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: ID Event 12 for VBoxNetLwf

Post by socratis »

Al.S wrote:Don't know what to do with it.
Nothing, absolutely nothing. As I've been saying all along, this is not a real problem, this is a red herring. Sure, the developers might have to adjust the driver to make it power-savings-aware, so that it won't be raising the alarm, but this is not what's causing the BSODs.

And since I "owe" this thread an example (to put my money where my mouth is), here's my Event Viewer log. I get several of these errors per day, as you can see I have 60 of them (since I installed Win10-64 on 2019-06-28) and another 55 when booting in Win7-64, and another 38 when booting in Win7-32.
  • VBoxNetLwf Event ID 12.png
    VBoxNetLwf Event ID 12.png (52.49 KiB) Viewed 8372 times
Total? 153 of these messages in a little bit over two months. Guess how many BSODs I've had? None. Zero. Zilch. Not a single one...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Locked