Ошибка 0x80004005 при начале работы с Virtualbox - Wintrust.dll

[dream_alex]

Здравствуйте.

Обнаружил ошибку.

Ноутбук lenovo ideapad 5-15ARE05.
При включении программы Virtualbox (VirtualBox-6.1.20-143896-Win) на Windows Pro 10 выскакивает ошибка:
Код ошибки: E_FAIL (0x80004005)
Компонент: MachineWrap
Интерфейс: IMachine {85632c68-b5bb-4316-a900-5eb28d3413df}
The virtual machine 'ubuntu' has terminated unexpectedly during startup with exit code 1 (0x1).

More details may be available in 'C:\Users\***\VirtualBox VMs\ubuntu\Logs\VBoxHardening.log'.
В конце файла VBoxHardening.log:
778.1ed4: Fatal error:
778.1ed4: Error loading 'Wintrust.dll': 1114 [C:\Windows\system32\Wintrust.dll]
1fbc.1f84: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 31 ms, the end);
2054.f48: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 446 ms, the end);

Драйвера у Lenovo обновлены. Windows обновлен, лицензия. Virtualbox последняя версия на сегодня.
Техподдержка Windows говорит, что с их стороны всё хорошо и нужно уточнять у техподдержки Virtualbox.

Подскажите, как решить проблему?

[mpack]

I do not believe that WinTrust.DLL is the source of your problem.

You have several occurrences like these in the hardening log:

180c.14fc: *0000000060c90000-0000000060c90fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\itcspea64.dll.000
180c.14fc: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 0000000060c90000 LB 0x1000 (base 0000000060c90000) - 'itcspea64.dll.000'
180c.14fc: 0000000060c91000-0000000060c92fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\itcspea64.dll.000
180c.14fc: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 0000000060c91000 LB 0x2000 (base 0000000060c90000) - 'itcspea64.dll.000'
180c.14fc: 0000000060c93000-0000000060c93fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\itcspea64.dll.000
180c.14fc: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 0000000060c93000 LB 0x1000 (base 0000000060c90000) - 'itcspea64.dll.000'
180c.14fc: 0000000060c94000-0000000060c94fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\itcspea64.dll.000
180c.14fc: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 0000000060c94000 LB 0x1000 (base 0000000060c90000) - 'itcspea64.dll.000'
180c.14fc: 0000000060c95000-0000000060c97fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume3\Windows\System32\itcspea64.dll.000
180c.14fc: supHardNtVpScanVirtualMemory: Ignoring unknown mem at 0000000060c95000 LB 0x3000 (base 0000000060c90000) - 'itcspea64.dll.000'

Basically, VirtualBox believes you've been hacked. It discards this strange DLL, which leads to the error.

Previous occurrences of this symptom were also from Russian users - apparantly it's due to some kind of security or VPN software that's popular in Russia (InfoTeCS?), however VirtualBox has not detected it (it is not listed in the "adversaries" section of the hardening log). If you know what this software is then you might try uninstalling it as a test, or add VirtualBox as an exception to whatever it does.

[Lodegin]

I do not believe that WinTrust.DLL is the source of your problem.

Basically, VirtualBox believes you've been hacked. It discards this strange DLL, which leads to the error.

Previous occurrences of this symptom were also from Russian users - apparantly it's due to some kind of security or VPN software that's popular in Russia (InfoTeCS?), however VirtualBox has not detected it (it is not listed in the "adversaries" section of the hardening log). If you know what this software is then you might try uninstalling it as a test, or add VirtualBox as an exception to whatever it does.

This dll belongs to crypto-security program. It contains virtual sign which need to sign tax declaration (this document is making people who has stocks) or something else. Mostly none use it, but some people need it.

I read in other post that virtualbox can ignore process of this program. How can i do it?

[scottgus1]

I read in other post that virtualbox can ignore process of this program. How can i do it?

Please post the link in a text file or insert enough spaces in the link to stop the no-links-first-day filter from triggering on the link.

Virtualbox does not have a 'whitelist' feature to ignore other programs which are injecting themselves into Virtualbox's space unnecessarily. Some of these other programs have exclusion features that can tell them to stay out of Virtualbox. Check if your crypto-security program has such an exclusion feature, and exclude all folders and files related to Virtualbox and your VMs.

To see if this program is causing the trouble:

try uninstalling it as a test, or add VirtualBox as an exception to whatever it does.

[Lodegin]

I read in other post that virtualbox can ignore process of this program. How can i do it?

Please post the link in a text file or insert enough spaces in the link to stop the no-links-first-day filter from triggering on the link.

Virtualbox does not have a 'whitelist' feature to ignore other programs which are injecting themselves into Virtualbox's space unnecessarily. Some of these other programs have exclusion features that can tell them to stay out of Virtualbox. Check if your crypto-security program has such an exclusion feature, and exclude all folders and files related to Virtualbox and your VMs.

To see if this program is causing the trouble:

try uninstalling it as a test, or add VirtualBox as an exception to whatever it does.

I mean this: viewtopic.php?f=6&t=100247

Nah, this program doesn't have any settings. Just some function like contain, remove and send virtual sign after check.
Maybe i can do it in regedit, but i didn't find any exclude options.
If i delete this program, it will be troublesome. I'll lose my virtual sign and i'll need restore it.

[scottgus1]

Thanks for the link. Unfortunately, while it appears o discuss the same program you are dealing with, the link does not show any way to allow Virtualbox to run while itcspea64.dll is invading Virtualbox. The recommended action was also to uninstall InfoTeCS.

Though InfoTeCS is a security program, its methods, like many other security and antivirus programs, act just like malware to work. Virtualbox cannot tell if InfoTeCS is malware or not.

You may be able to ask InfoTeCS support about this glitch, maybe they know a way to exclude Virtualbox. The Virtualbox developers have worked with 3rd-party software providers to achieve coexistence. Or if this is a work computer you can ask the boss about getting IT to exclude Virtualbox from InfoTeCS.

[Lodegin]

Thanks for the link. Unfortunately, while it appears o discuss the same program you are dealing with, the link does not show any way to allow Virtualbox to run while itcspea64.dll is invading Virtualbox. The recommended action was also to uninstall InfoTeCS.

Though InfoTeCS is a security program, its methods, like many other security and antivirus programs, act just like malware to work. Virtualbox cannot tell if InfoTeCS is malware or not.

You may be able to ask InfoTeCS support about this glitch, maybe they know a way to exclude Virtualbox. The Virtualbox developers have worked with 3rd-party software providers to achieve coexistence. Or if this is a work computer you can ask the boss about getting IT to exclude Virtualbox from InfoTeCS.

It's not usual security program like Avast or others. This program make cryptokey of sign which is equal manual sign.
I sended request in InfoTeCS, but i don't sure that they answer, cause it's russia (yes 'r', not 'R'). Here almost every company don't care about people.

[mpack]

cause it's russia (yes 'r', not 'R')

On the contrary. You are writing in English, a language which requires that proper nouns be capitalized on their first letter. Hence the correct form is "Russia" and not "russia".

Whatever the purpose of the software, it appears to be invasive like other security software (and malware), and it is presumably unsigned or it would be allowed. VirtualBox will block all unsigned invasive software. FAQ: Diagnosing VirtualBox Hardening Issues.

[Lodegin]

On the contrary. You are writing in English, a language which requires that proper nouns be capitalized on their first letter. Hence the correct form is "Russia" and not "russia".

Yeah, i know. That's why Germany, England, Norway e.t.c. But "russia" because almost 60% people who live here disrespect this country (especially government and man who call himself "president"). I'm one of them. (Little riot, if you wish).
But it's not about topic.

Whatever the purpose of the software, it appears to be invasive like other security software (and malware), and it is presumably unsigned or it would be allowed. VirtualBox will block all unsigned invasive software.

I checked your link. My (and not only my) case is:

(1) the DLL never had a valid certificate - e.g. malware, free software, or the vendor made a mistake

But it's definitely not mistake. Developer doesn't valid it, because this program can be used only if you russian citizen. And here words "license" and "validation" are unknown. Almost all DLL from here don't valid. As i wrote before: i sended request to InfoTeCs support, if they answer me, i duplicate they answer here. But i don't believe in normal answer.

P.S. I hope you'll not ban me for first part of my comment.

[fth0]

FWIW, it doesn't matter here if itcspea64.dll.000 is correctly signed or not, the error would occur anyway. Your only chance is to prevent the software from invading the memory of the VirtualBox processes.

[Lodegin]

FWIW, it doesn't matter here if itcspea64.dll.000 is correctly signed or not, the error would occur anyway. Your only chance is to prevent the software from invading the memory of the VirtualBox processes.

Actually i know it.
Right now does exist one possible solution: delete this software, but this option is unaccepted.
I need exclude VirtualBox process from InfoTeCs software. But i don't know how do that. Because InfoTeCs software doesn't have exclude function. And in register doesn't exist folder of excludes.

[fth0]

Thinking about your situation again, another alternative came to mind:

You could perhaps uninstall the software, create a VirtualBox VM and install and use the software within the VM ...

[Lodegin]

Thinking about your situation again, another alternative came to mind:

You could perhaps uninstall the software, create a VirtualBox VM and install and use the software within the VM ...

Nah, this option is bad too. You see i wrote early: this software contain virtual crytpo-sign (or crypto-key if you wish) which is unique.
Uninstall software means lost it. If it will be lost i need restore it in government service. I don't want to contact with them, cause it's Mordor's services.

[scottgus1]

If it will be lost i need restore it in government service.

What would happen if your computer died? You'd need to back this up somehow.

To cut to the chase, Virtualbox cannot run until InfoTeCs stops invading Virtualbox's space. Virtualbox does not contain any way to authorize InfoTeCs' invasion. I know it sounds like a real bother, but InfoTeCs is using the same method as malware uses to invade other programs' space, and Virtualbox can't allow that malware method to invade Virtualbox, so the host PC doesn't become a rogue DDOS/ransomware bot participant.

If InfoTeCs does not have an exclusion feature, then the situation is at an impasse. You'll have to decide between InfoTeCs and Virtualbox, or set up your PC so it can dual-boot two host OS's: one with InfoTeCs and one with Virtualbox.

If you can figure out how to back up InfoTeCs to transfer it to a different PC, then you can transfer it into a VM. If that is not possible then we're stuck.

[Lodegin]

What would happen if your computer died? You'd need to back this up somehow.

It's extraordinary situation. Usually it won't happen immediately. Besides still have a chance to restore keys from disk.

To cut to the chase, Virtualbox cannot run until InfoTeCs stops invading Virtualbox's space. Virtualbox does not contain any way to authorize InfoTeCs' invasion. I know it sounds like a real bother, but InfoTeCs is using the same method as malware uses to invade other programs' space, and Virtualbox can't allow that malware method to invade Virtualbox, so the host PC doesn't become a rogue DDOS/ransomware bot participant.

If InfoTeCs does not have an exclusion feature, then the situation is at an impasse. You'll have to decide between InfoTeCs and Virtualbox, or set up your PC so it can dual-boot two host OS's: one with InfoTeCs and one with Virtualbox.

If you can figure out how to back up InfoTeCs to transfer it to a different PC, then you can transfer it into a VM. If that is not possible then we're stuck.

Okay, right now i know 4 things:
1) uninstall works;
2) this virtual sign consist of two part: crypto-key and temporary license issued by tax service;
3) key can be saved somewhere else but license isn't;
4) system restore doesn't restore this "brilliant" InfoTeCs software...

Upd. Feb. 2022
As i said before and expected. Russian support are useless. They didn't answer to my request.
And another thing. Last year they "update" this software and now tax service site don't see installed software. Now you can use only unsafe method of keeping sign... on government servers. It's magnificent.
P.S. If you wanna know why unsafe, it's because every some month users data (like passport numbers, tax identification number, insurance number of person and other data) leaking from government servers into darknet. And all this data enough to take a credit in bank, if even banks worker didn't see a real document.