On Windows 8.1 I get the error E_FAIL (0x80004005)( screenshot in attach). In logs I have next:
Code: Select all
869c.8544: Log file opened: 4.3.20r96997 g_hStartupLog=0000000000000010 g_uNtVerCombined=0x63258000
869c.8544: \SystemRoot\System32\ntdll.dll:
869c.8544: CreationTime: 2015-01-13T07:30:50.514786100Z
869c.8544: LastWriteTime: 2015-01-13T07:30:50.618854500Z
869c.8544: ChangeTime: 2015-01-29T22:28:17.175498200Z
869c.8544: FileAttributes: 0x20
869c.8544: Size: 0x1a7540
869c.8544: NT Headers: 0xd8
869c.8544: Timestamp: 0x54516b13
869c.8544: Machine: 0x8664 - amd64
869c.8544: Timestamp: 0x54516b13
869c.8544: Image Version: 6.3
869c.8544: SizeOfImage: 0x1ac000 (1753088)
869c.8544: Resource Dir: 0x148000 LB 0x62450
869c.8544: ProductName: Microsoft® Windows® Operating System
869c.8544: ProductVersion: 6.3.9600.17476
869c.8544: FileVersion: 6.3.9600.17476 (winblue_r5.141029-1500)
869c.8544: FileDescription: NT Layer DLL
869c.8544: \SystemRoot\System32\kernel32.dll:
869c.8544: CreationTime: 2015-01-13T07:37:42.036665200Z
869c.8544: LastWriteTime: 2015-01-13T07:37:42.149745600Z
869c.8544: ChangeTime: 2015-01-29T22:28:15.097354500Z
869c.8544: FileAttributes: 0x20
869c.8544: Size: 0x13fc30
869c.8544: NT Headers: 0xf8
869c.8544: Timestamp: 0x545054ca
869c.8544: Machine: 0x8664 - amd64
869c.8544: Timestamp: 0x545054ca
869c.8544: Image Version: 6.3
869c.8544: SizeOfImage: 0x13e000 (1302528)
869c.8544: Resource Dir: 0x12e000 LB 0x518
869c.8544: ProductName: Microsoft® Windows® Operating System
869c.8544: ProductVersion: 6.3.9600.17415
869c.8544: FileVersion: 6.3.9600.17415 (winblue_r4.141028-1500)
869c.8544: FileDescription: Windows NT BASE API Client DLL
869c.8544: \SystemRoot\System32\KernelBase.dll:
869c.8544: CreationTime: 2015-01-13T07:36:21.681849500Z
869c.8544: LastWriteTime: 2015-01-13T07:36:21.682851400Z
869c.8544: ChangeTime: 2015-01-29T22:28:17.206762600Z
869c.8544: FileAttributes: 0x20
869c.8544: Size: 0x114a90
869c.8544: NT Headers: 0xf0
869c.8544: Timestamp: 0x54505737
869c.8544: Machine: 0x8664 - amd64
869c.8544: Timestamp: 0x54505737
869c.8544: Image Version: 6.3
869c.8544: SizeOfImage: 0x115000 (1134592)
869c.8544: Resource Dir: 0x110000 LB 0x3528
869c.8544: ProductName: Microsoft® Windows® Operating System
869c.8544: ProductVersion: 6.3.9600.17415
869c.8544: FileVersion: 6.3.9600.17415 (winblue_r4.141028-1500)
869c.8544: FileDescription: Windows NT BASE API Client DLL
869c.8544: \SystemRoot\System32\apisetschema.dll:
869c.8544: CreationTime: 2013-08-22T12:13:09.745625900Z
869c.8544: LastWriteTime: 2013-08-22T12:35:12.091034400Z
869c.8544: ChangeTime: 2014-07-15T04:03:23.987869200Z
869c.8544: FileAttributes: 0x20
869c.8544: Size: 0x11360
869c.8544: NT Headers: 0xd0
869c.8544: Timestamp: 0x52160049
869c.8544: Machine: 0x8664 - amd64
869c.8544: Timestamp: 0x52160049
869c.8544: Image Version: 6.3
869c.8544: SizeOfImage: 0x13000 (77824)
869c.8544: Resource Dir: 0x11000 LB 0x3f8
869c.8544: ProductName: Microsoft® Windows® Operating System
869c.8544: ProductVersion: 6.3.9600.16384
869c.8544: FileVersion: 6.3.9600.16384 (winblue_rtm.130821-1623)
869c.8544: FileDescription: ApiSet Schema DLL
869c.8544: NtOpenDirectoryObject failed on \Driver: 0xc0000022
869c.8544: supR3HardenedWinFindAdversaries: 0x40
869c.8544: \SystemRoot\System32\drivers\kl1.sys:
869c.8544: CreationTime: 2013-09-05T01:38:46.000000000Z
869c.8544: LastWriteTime: 2013-09-05T01:38:46.000000000Z
869c.8544: ChangeTime: 2014-07-15T00:45:39.166865800Z
869c.8544: FileAttributes: 0x20
869c.8544: Size: 0x75c460
869c.8544: NT Headers: 0xe0
869c.8544: Timestamp: 0x522826d2
869c.8544: Machine: 0x8664 - amd64
869c.8544: Timestamp: 0x522826d2
869c.8544: Image Version: 0.0
869c.8544: SizeOfImage: 0x75e000 (7725056)
869c.8544: Resource Dir: 0x75c000 LB 0x448
869c.8544: ProductName: Kaspersky Anti-Virus
869c.8544: ProductVersion: 6.0.1.990
869c.8544: FileVersion: 6.8.0.27
869c.8544: FileDescription: Kaspersky Unified Driver
869c.8544: \SystemRoot\System32\drivers\klflt.sys:
869c.8544: CreationTime: 2014-07-15T00:45:18.994827300Z
869c.8544: LastWriteTime: 2014-07-15T00:45:18.994827300Z
869c.8544: ChangeTime: 2014-07-15T00:45:22.244853700Z
869c.8544: FileAttributes: 0x20
869c.8544: Size: 0x18060
869c.8544: NT Headers: 0xe8
869c.8544: Timestamp: 0x52399b87
869c.8544: Machine: 0x8664 - amd64
869c.8544: Timestamp: 0x52399b87
869c.8544: Image Version: 6.2
869c.8544: SizeOfImage: 0x24000 (147456)
869c.8544: Resource Dir: 0x22000 LB 0x378
869c.8544: ProductName: Kaspersky™ Anti-Virus ®
869c.8544: ProductVersion: 1.2.0.29
869c.8544: FileVersion: 1.2.0.29
869c.8544: FileDescription: Filter Core [fre_win8_x64]
869c.8544: \SystemRoot\System32\drivers\klif.sys:
869c.8544: CreationTime: 2014-07-15T00:45:18.994827300Z
869c.8544: LastWriteTime: 2014-07-15T00:45:19.010452400Z
869c.8544: ChangeTime: 2014-07-15T00:45:22.244853700Z
869c.8544: FileAttributes: 0x20
869c.8544: Size: 0xa2660
869c.8544: NT Headers: 0xf8
869c.8544: Timestamp: 0x527a56b4
869c.8544: Machine: 0x8664 - amd64
869c.8544: Timestamp: 0x527a56b4
869c.8544: Image Version: 6.2
869c.8544: SizeOfImage: 0xaf000 (716800)
869c.8544: Resource Dir: 0xad000 LB 0x388
869c.8544: ProductName: Kaspersky™ Anti-Virus ®
869c.8544: ProductVersion: 8.12.1.115
869c.8544: FileVersion: 8.12.1.115
869c.8544: FileDescription: Klif Mini-Filter [fre_win8_x64]
869c.8544: \SystemRoot\System32\drivers\klim6.sys:
869c.8544: CreationTime: 2013-07-11T02:54:12.000000000Z
869c.8544: LastWriteTime: 2013-07-11T02:54:12.000000000Z
869c.8544: ChangeTime: 2014-07-15T00:45:38.026232800Z
869c.8544: FileAttributes: 0x20
869c.8544: Size: 0x7660
869c.8544: NT Headers: 0xe0
869c.8544: Timestamp: 0x51de6494
869c.8544: Machine: 0x8664 - amd64
869c.8544: Timestamp: 0x51de6494
869c.8544: Image Version: 6.2
869c.8544: SizeOfImage: 0xa000 (40960)
869c.8544: Resource Dir: 0x8000 LB 0x470
869c.8544: ProductName: Kaspersky Anti-Virus
869c.8544: ProductVersion: 6.0.1.990
869c.8544: FileVersion: 8.0.0.71
869c.8544: FileDescription: Kaspersky Lab Intermediate Network Driver
869c.8544: \SystemRoot\System32\drivers\kneps.sys:
869c.8544: CreationTime: 2013-07-01T08:18:10.000000000Z
869c.8544: LastWriteTime: 2013-07-01T08:18:10.000000000Z
869c.8544: ChangeTime: 2014-07-15T00:45:40.213780500Z
869c.8544: FileAttributes: 0x20
869c.8544: Size: 0x2b660
869c.8544: NT Headers: 0x110
869c.8544: Timestamp: 0x51d1814d
869c.8544: Machine: 0x8664 - amd64
869c.8544: Timestamp: 0x51d1814d
869c.8544: Image Version: 6.1
869c.8544: SizeOfImage: 0x2d000 (184320)
869c.8544: Resource Dir: 0x2b000 LB 0x370
869c.8544: ProductName: Kaspersky™ Anti-Virus ®
869c.8544: ProductVersion: 5.2.1.1
869c.8544: FileVersion: 5.2.1.1 built by: WinDDK
869c.8544: FileDescription: KNEPS Power
869c.8544: Calling main()
869c.8544: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
869c.8544: SUPR3HardenedMain: Respawn #1
869c.8544: System32: \Device\HarddiskVolume4\Windows\System32
869c.8544: WinSxS: \Device\HarddiskVolume4\Windows\WinSxS
869c.8544: KnownDllPath: C:\WINDOWS\system32
869c.8544: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
869c.8544: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe)
869c.8544: supR3HardNtEnableThreadCreation:
869c.8544: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbca9ca650 pvNtTerminateThread=00007ffbcaa41170
869c.8544: supR3HardenedWinDoReSpawn(1): New child 8624.8454 [kernel32].
869c.8544: supR3HardNtChildGatherData: PebBaseAddress=00007ff61a17b000 cbPeb=0x388
869c.8544: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffbca9b0000 uNtDllChildAddr=00007ffbca9b0000
869c.8544: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffbca9ca650
869c.8544: supR3HardenedWinSetupChildInit: Start child.
869c.8544: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
869c.8544: supR3HardNtChildPurify: Startup delay kludge #1/0: 513 ms, 57 sleeps
869c.8544: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
869c.8544: *0000000000000000-ffffffffff45ffff 0x0001/0x0000 0x0000000
869c.8544: *0000000000ba0000-0000000000b7ffff 0x0004/0x0004 0x0020000
869c.8544: *0000000000bc0000-0000000000bb0fff 0x0002/0x0002 0x0040000
869c.8544: 0000000000bcf000-0000000000bcdfff 0x0001/0x0000 0x0000000
869c.8544: *0000000000bd0000-0000000000ad3fff 0x0000/0x0004 0x0020000
869c.8544: 0000000000ccc000-0000000000cc8fff 0x0104/0x0004 0x0020000
869c.8544: 0000000000ccf000-0000000000ccdfff 0x0004/0x0004 0x0020000
869c.8544: *0000000000cd0000-0000000000ccbfff 0x0002/0x0002 0x0040000
869c.8544: 0000000000cd4000-0000000000cc7fff 0x0001/0x0000 0x0000000
869c.8544: *0000000000ce0000-0000000000cddfff 0x0004/0x0004 0x0020000
869c.8544: 0000000000ce2000-ffffffff819e3fff 0x0001/0x0000 0x0000000
869c.8544: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
869c.8544: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
869c.8544: 000000007fff0000-ffff800ae5e8ffff 0x0001/0x0000 0x0000000
869c.8544: *00007ff61a150000-00007ff61a12cfff 0x0002/0x0002 0x0040000
869c.8544: 00007ff61a173000-00007ff61a16afff 0x0001/0x0000 0x0000000
869c.8544: *00007ff61a17b000-00007ff61a179fff 0x0004/0x0004 0x0020000
869c.8544: 00007ff61a17c000-00007ff61a179fff 0x0001/0x0000 0x0000000
869c.8544: *00007ff61a17e000-00007ff61a17bfff 0x0004/0x0004 0x0020000
869c.8544: 00007ff61a180000-00007ff619b1ffff 0x0001/0x0000 0x0000000
869c.8544: *00007ff61a7e0000-00007ff61a7defff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a7e1000-00007ff61a75cfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a865000-00007ff61a863fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a866000-00007ff61a828fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a8a3000-00007ff61a8a1fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a8a4000-00007ff61a8a2fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a8a5000-00007ff61a8a2fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a8a7000-00007ff61a8a5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a8a8000-00007ff61a8a6fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a8a9000-00007ff61a8a4fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a8ad000-00007ff61a873fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
869c.8544: 00007ff61a8e6000-00007ff06a81bfff 0x0001/0x0000 0x0000000
869c.8544: *00007ffbca9b0000-00007ffbca9aefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
869c.8544: 00007ffbca9b1000-00007ffbca884fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
869c.8544: 00007ffbcaadd000-00007ffbcaad6fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
869c.8544: 00007ffbcaae3000-00007ffbcaad5fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
869c.8544: 00007ffbcaaf0000-00007ffbcaaeefff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
869c.8544: 00007ffbcaaf1000-00007ffbcaaedfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
869c.8544: 00007ffbcaaf4000-00007ffbcaaf2fff 0x0010/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
869c.8544: 00007ffbcaaf5000-00007ffbcaa8dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
869c.8544: 00007ffbcab5c000-00007ff7956d7fff 0x0001/0x0000 0x0000000
869c.8544: *00007ffffffe0000-00007ffffffcffff 0x0001/0x0002 0x0020000
869c.8544: VirtualBox.exe: timestamp 0x54731167 (rc=VINF_SUCCESS)
869c.8544: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
869c.8544: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports
869c.8544: supR3HardNtChildPurify: Done after 543 ms and 0 fixes (loop #0).
8624.8454: Log file opened: 4.3.20r96997 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x63258000
8624.8454: supR3HardenedVmProcessInit: uNtDllAddr=00007ffbca9b0000
869c.8544: supR3HardNtEnableThreadCreation:
8624.8454: ntdll.dll: timestamp 0x54516b13 (rc=VINF_SUCCESS)
8624.8454: New simple heap: #1 0000000000df0000 LB 0x400000 (for 1753088 allocation)
8624.8454: System32: \Device\HarddiskVolume4\Windows\System32
8624.8454: WinSxS: \Device\HarddiskVolume4\Windows\WinSxS
8624.8454: KnownDllPath: C:\WINDOWS\system32
8624.8454: supR3HardenedVmProcessInit: Opening vboxdrv stub...
8624.8454: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
8624.8454: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
8624.8454: Registered Dll notification callback with NTDLL.
8624.8454: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\kernel32.dll)
8624.8454: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel32.dll
8624.8454: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000801:<flags> [calling]
8624.8454: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
8624.8454: supR3HardenedDllNotificationCallback: load 00007ffbc7a20000 LB 0x00115000 C:\WINDOWS\system32\KERNELBASE.dll [fFlags=0x0]
8624.8454: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\KernelBase.dll)
8624.8454: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
8624.8454: supR3HardenedDllNotificationCallback: load 00007ffbc8e50000 LB 0x0013e000 C:\WINDOWS\system32\KERNEL32.DLL [fFlags=0x0]
8624.8454: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
8624.8454: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbc8e50000 'C:\WINDOWS\system32\KERNEL32.DLL'
8624.8454: supR3HardenedDllNotificationCallback: load 00007ff61a7e0000 LB 0x00106000 C:\Program Files\Oracle\VirtualBox\VirtualBox.exe [fFlags=0x0]
8624.8454: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
8624.8454: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe)
8624.8454: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbca9ca650 pvNtTerminateThread=00007ffbcaa41170
869c.8544: supR3HardNtChildWaitFor: Found expected request 1 (CloseEvents) after 72 ms.
8624.8454: \SystemRoot\System32\ntdll.dll:
8624.8454: CreationTime: 2015-01-13T07:30:50.514786100Z
8624.8454: LastWriteTime: 2015-01-13T07:30:50.618854500Z
8624.8454: ChangeTime: 2015-01-29T22:28:17.175498200Z
8624.8454: FileAttributes: 0x20
8624.8454: Size: 0x1a7540
8624.8454: NT Headers: 0xd8
8624.8454: Timestamp: 0x54516b13
8624.8454: Machine: 0x8664 - amd64
8624.8454: Timestamp: 0x54516b13
8624.8454: Image Version: 6.3
8624.8454: SizeOfImage: 0x1ac000 (1753088)
8624.8454: Resource Dir: 0x148000 LB 0x62450
8624.8454: ProductName: Microsoft® Windows® Operating System
8624.8454: ProductVersion: 6.3.9600.17476
8624.8454: FileVersion: 6.3.9600.17476 (winblue_r5.141029-1500)
8624.8454: FileDescription: NT Layer DLL
8624.8454: \SystemRoot\System32\kernel32.dll:
8624.8454: CreationTime: 2015-01-13T07:37:42.036665200Z
8624.8454: LastWriteTime: 2015-01-13T07:37:42.149745600Z
8624.8454: ChangeTime: 2015-01-29T22:28:15.097354500Z
8624.8454: FileAttributes: 0x20
8624.8454: Size: 0x13fc30
8624.8454: NT Headers: 0xf8
8624.8454: Timestamp: 0x545054ca
8624.8454: Machine: 0x8664 - amd64
8624.8454: Timestamp: 0x545054ca
8624.8454: Image Version: 6.3
8624.8454: SizeOfImage: 0x13e000 (1302528)
8624.8454: Resource Dir: 0x12e000 LB 0x518
8624.8454: ProductName: Microsoft® Windows® Operating System
8624.8454: ProductVersion: 6.3.9600.17415
8624.8454: FileVersion: 6.3.9600.17415 (winblue_r4.141028-1500)
8624.8454: FileDescription: Windows NT BASE API Client DLL
8624.8454: \SystemRoot\System32\KernelBase.dll:
8624.8454: CreationTime: 2015-01-13T07:36:21.681849500Z
8624.8454: LastWriteTime: 2015-01-13T07:36:21.682851400Z
8624.8454: ChangeTime: 2015-01-29T22:28:17.206762600Z
8624.8454: FileAttributes: 0x20
8624.8454: Size: 0x114a90
8624.8454: NT Headers: 0xf0
8624.8454: Timestamp: 0x54505737
8624.8454: Machine: 0x8664 - amd64
8624.8454: Timestamp: 0x54505737
8624.8454: Image Version: 6.3
8624.8454: SizeOfImage: 0x115000 (1134592)
8624.8454: Resource Dir: 0x110000 LB 0x3528
8624.8454: ProductName: Microsoft® Windows® Operating System
8624.8454: ProductVersion: 6.3.9600.17415
8624.8454: FileVersion: 6.3.9600.17415 (winblue_r4.141028-1500)
8624.8454: FileDescription: Windows NT BASE API Client DLL
8624.8454: \SystemRoot\System32\apisetschema.dll:
8624.8454: CreationTime: 2013-08-22T12:13:09.745625900Z
8624.8454: LastWriteTime: 2013-08-22T12:35:12.091034400Z
8624.8454: ChangeTime: 2014-07-15T04:03:23.987869200Z
8624.8454: FileAttributes: 0x20
8624.8454: Size: 0x11360
8624.8454: NT Headers: 0xd0
8624.8454: Timestamp: 0x52160049
8624.8454: Machine: 0x8664 - amd64
8624.8454: Timestamp: 0x52160049
8624.8454: Image Version: 6.3
8624.8454: SizeOfImage: 0x13000 (77824)
8624.8454: Resource Dir: 0x11000 LB 0x3f8
8624.8454: ProductName: Microsoft® Windows® Operating System
8624.8454: ProductVersion: 6.3.9600.16384
8624.8454: FileVersion: 6.3.9600.16384 (winblue_rtm.130821-1623)
8624.8454: FileDescription: ApiSet Schema DLL
8624.8454: NtOpenDirectoryObject failed on \Driver: 0xc0000022
8624.8454: supR3HardenedWinFindAdversaries: 0x40
8624.8454: \SystemRoot\System32\drivers\kl1.sys:
8624.8454: CreationTime: 2013-09-05T01:38:46.000000000Z
8624.8454: LastWriteTime: 2013-09-05T01:38:46.000000000Z
8624.8454: ChangeTime: 2014-07-15T00:45:39.166865800Z
8624.8454: FileAttributes: 0x20
8624.8454: Size: 0x75c460
8624.8454: NT Headers: 0xe0
8624.8454: Timestamp: 0x522826d2
8624.8454: Machine: 0x8664 - amd64
8624.8454: Timestamp: 0x522826d2
8624.8454: Image Version: 0.0
8624.8454: SizeOfImage: 0x75e000 (7725056)
8624.8454: Resource Dir: 0x75c000 LB 0x448
8624.8454: ProductName: Kaspersky Anti-Virus
8624.8454: ProductVersion: 6.0.1.990
8624.8454: FileVersion: 6.8.0.27
8624.8454: FileDescription: Kaspersky Unified Driver
8624.8454: \SystemRoot\System32\drivers\klflt.sys:
8624.8454: CreationTime: 2014-07-15T00:45:18.994827300Z
8624.8454: LastWriteTime: 2014-07-15T00:45:18.994827300Z
8624.8454: ChangeTime: 2014-07-15T00:45:22.244853700Z
8624.8454: FileAttributes: 0x20
8624.8454: Size: 0x18060
8624.8454: NT Headers: 0xe8
8624.8454: Timestamp: 0x52399b87
8624.8454: Machine: 0x8664 - amd64
8624.8454: Timestamp: 0x52399b87
8624.8454: Image Version: 6.2
8624.8454: SizeOfImage: 0x24000 (147456)
8624.8454: Resource Dir: 0x22000 LB 0x378
8624.8454: ProductName: Kaspersky™ Anti-Virus ®
8624.8454: ProductVersion: 1.2.0.29
8624.8454: FileVersion: 1.2.0.29
8624.8454: FileDescription: Filter Core [fre_win8_x64]
8624.8454: \SystemRoot\System32\drivers\klif.sys:
8624.8454: CreationTime: 2014-07-15T00:45:18.994827300Z
8624.8454: LastWriteTime: 2014-07-15T00:45:19.010452400Z
8624.8454: ChangeTime: 2014-07-15T00:45:22.244853700Z
8624.8454: FileAttributes: 0x20
8624.8454: Size: 0xa2660
8624.8454: NT Headers: 0xf8
8624.8454: Timestamp: 0x527a56b4
8624.8454: Machine: 0x8664 - amd64
8624.8454: Timestamp: 0x527a56b4
8624.8454: Image Version: 6.2
8624.8454: SizeOfImage: 0xaf000 (716800)
8624.8454: Resource Dir: 0xad000 LB 0x388
8624.8454: ProductName: Kaspersky™ Anti-Virus ®
8624.8454: ProductVersion: 8.12.1.115
8624.8454: FileVersion: 8.12.1.115
8624.8454: FileDescription: Klif Mini-Filter [fre_win8_x64]
8624.8454: \SystemRoot\System32\drivers\klim6.sys:
8624.8454: CreationTime: 2013-07-11T02:54:12.000000000Z
8624.8454: LastWriteTime: 2013-07-11T02:54:12.000000000Z
8624.8454: ChangeTime: 2014-07-15T00:45:38.026232800Z
8624.8454: FileAttributes: 0x20
8624.8454: Size: 0x7660
8624.8454: NT Headers: 0xe0
8624.8454: Timestamp: 0x51de6494
8624.8454: Machine: 0x8664 - amd64
8624.8454: Timestamp: 0x51de6494
8624.8454: Image Version: 6.2
8624.8454: SizeOfImage: 0xa000 (40960)
8624.8454: Resource Dir: 0x8000 LB 0x470
8624.8454: ProductName: Kaspersky Anti-Virus
8624.8454: ProductVersion: 6.0.1.990
8624.8454: FileVersion: 8.0.0.71
8624.8454: FileDescription: Kaspersky Lab Intermediate Network Driver
8624.8454: \SystemRoot\System32\drivers\kneps.sys:
8624.8454: CreationTime: 2013-07-01T08:18:10.000000000Z
8624.8454: LastWriteTime: 2013-07-01T08:18:10.000000000Z
8624.8454: ChangeTime: 2014-07-15T00:45:40.213780500Z
8624.8454: FileAttributes: 0x20
8624.8454: Size: 0x2b660
8624.8454: NT Headers: 0x110
8624.8454: Timestamp: 0x51d1814d
8624.8454: Machine: 0x8664 - amd64
8624.8454: Timestamp: 0x51d1814d
8624.8454: Image Version: 6.1
8624.8454: SizeOfImage: 0x2d000 (184320)
8624.8454: Resource Dir: 0x2b000 LB 0x370
8624.8454: ProductName: Kaspersky™ Anti-Virus ®
8624.8454: ProductVersion: 5.2.1.1
8624.8454: FileVersion: 5.2.1.1 built by: WinDDK
8624.8454: FileDescription: KNEPS Power
8624.8454: Calling main()
8624.8454: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
8624.8454: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
8624.8454: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe)
8624.8454: SUPR3HardenedMain: Respawn #2
8624.8454: supR3HardNtEnableThreadCreation:
8624.8454: supR3HardNtDisableThreadCreation: pvLdrInitThunk=00007ffbca9ca650 pvNtTerminateThread=00007ffbcaa41170
8624.8454: supR3HardenedWinDoReSpawn(2): New child 8938.8260 [kernel32].
8624.8454: supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: 0xc0000022 (harmless)
8624.8454: supR3HardNtChildGatherData: PebBaseAddress=00007ff619ddf000 cbPeb=0x388
8624.8454: supR3HardNtPuChFindNtdll: uNtDllParentAddr=00007ffbca9b0000 uNtDllChildAddr=00007ffbca9b0000
8624.8454: supR3HardenedWinSetupChildInit: uLdrInitThunk=00007ffbca9ca650
8624.8454: supR3HardenedWinSetupChildInit: Start child.
8624.8454: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
8624.8454: supR3HardNtChildPurify: Startup delay kludge #1/0: 513 ms, 57 sleeps
8624.8454: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
8624.8454: *0000000000000000-ffffffffff79ffff 0x0001/0x0000 0x0000000
8624.8454: *0000000000860000-000000000083ffff 0x0004/0x0004 0x0020000
8624.8454: *0000000000880000-0000000000870fff 0x0002/0x0002 0x0040000
8624.8454: 000000000088f000-000000000088dfff 0x0001/0x0000 0x0000000
8624.8454: *0000000000890000-0000000000793fff 0x0000/0x0004 0x0020000
8624.8454: 000000000098c000-0000000000988fff 0x0104/0x0004 0x0020000
8624.8454: 000000000098f000-000000000098dfff 0x0004/0x0004 0x0020000
8624.8454: *0000000000990000-000000000098bfff 0x0002/0x0002 0x0040000
8624.8454: 0000000000994000-0000000000987fff 0x0001/0x0000 0x0000000
8624.8454: *00000000009a0000-000000000099dfff 0x0004/0x0004 0x0020000
8624.8454: 00000000009a2000-ffffffffa1343fff 0x0001/0x0000 0x0000000
8624.8454: *0000000060000000-000000005fffcfff 0x0080/0x0080 0x0040000 !!
8624.8454: supHardNtVpScanVirtualMemory: Unmapping exec mem at 0000000060000000 (0000000060000000/0000000060000000 LB 0x3000)
8624.8454: 0000000060003000-0000000040025fff 0x0001/0x0000 0x0000000
8624.8454: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
8624.8454: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
8624.8454: 000000007fff0000-ffff800ae622ffff 0x0001/0x0000 0x0000000
8624.8454: *00007ff619db0000-00007ff619d8cfff 0x0002/0x0002 0x0040000
8624.8454: 00007ff619dd3000-00007ff619dc8fff 0x0001/0x0000 0x0000000
8624.8454: *00007ff619ddd000-00007ff619ddafff 0x0004/0x0004 0x0020000
8624.8454: *00007ff619ddf000-00007ff619dddfff 0x0004/0x0004 0x0020000
8624.8454: 00007ff619de0000-00007ff6193dffff 0x0001/0x0000 0x0000000
8624.8454: *00007ff61a7e0000-00007ff61a7defff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a7e1000-00007ff61a75cfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a865000-00007ff61a863fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a866000-00007ff61a828fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8a3000-00007ff61a8a1fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8a4000-00007ff61a8a2fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8a5000-00007ff61a8a2fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8a7000-00007ff61a8a5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8a8000-00007ff61a8a6fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8a9000-00007ff61a8a4fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8ad000-00007ff61a873fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8e6000-00007ff06a81bfff 0x0001/0x0000 0x0000000
8624.8454: *00007ffbca9b0000-00007ffbca9aefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbca9b1000-00007ffbca884fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaadd000-00007ffbcaad6fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaae3000-00007ffbcaad5fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaaf0000-00007ffbcaaeefff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaaf1000-00007ffbcaaedfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaaf4000-00007ffbcaaf2fff 0x0010/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaaf5000-00007ffbcaa8dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcab5c000-00007ff7956d7fff 0x0001/0x0000 0x0000000
8624.8454: *00007ffffffe0000-00007ffffffcffff 0x0001/0x0002 0x0020000
8624.8454: VirtualBox.exe: timestamp 0x54731167 (rc=VINF_SUCCESS)
8624.8454: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
8624.8454: '\Device\HarddiskVolume4\Windows\System32\ntdll.dll' has no imports
8624.8454: supR3HardNtChildPurify: cFixes=1 g_fSupAdversaries=0x40
8624.8454: supR3HardNtChildPurify: Startup delay kludge #1/1: 513 ms, 57 sleeps
8624.8454: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
8624.8454: *0000000000000000-ffffffffff79ffff 0x0001/0x0000 0x0000000
8624.8454: *0000000000860000-000000000083ffff 0x0004/0x0004 0x0020000
8624.8454: *0000000000880000-0000000000870fff 0x0002/0x0002 0x0040000
8624.8454: 000000000088f000-000000000088dfff 0x0001/0x0000 0x0000000
8624.8454: *0000000000890000-0000000000793fff 0x0000/0x0004 0x0020000
8624.8454: 000000000098c000-0000000000988fff 0x0104/0x0004 0x0020000
8624.8454: 000000000098f000-000000000098dfff 0x0004/0x0004 0x0020000
8624.8454: *0000000000990000-000000000098bfff 0x0002/0x0002 0x0040000
8624.8454: 0000000000994000-0000000000987fff 0x0001/0x0000 0x0000000
8624.8454: *00000000009a0000-000000000099dfff 0x0004/0x0004 0x0020000
8624.8454: 00000000009a2000-ffffffff81363fff 0x0001/0x0000 0x0000000
8624.8454: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
8624.8454: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
8624.8454: 000000007fff0000-ffff800ae622ffff 0x0001/0x0000 0x0000000
8624.8454: *00007ff619db0000-00007ff619d8cfff 0x0002/0x0002 0x0040000
8624.8454: 00007ff619dd3000-00007ff619dc8fff 0x0001/0x0000 0x0000000
8624.8454: *00007ff619ddd000-00007ff619ddafff 0x0004/0x0004 0x0020000
8624.8454: *00007ff619ddf000-00007ff619dddfff 0x0004/0x0004 0x0020000
8624.8454: 00007ff619de0000-00007ff6193dffff 0x0001/0x0000 0x0000000
8624.8454: *00007ff61a7e0000-00007ff61a7defff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a7e1000-00007ff61a75cfff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a865000-00007ff61a863fff 0x0040/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a866000-00007ff61a828fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8a3000-00007ff61a898fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8ad000-00007ff61a873fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: 00007ff61a8e6000-00007ff06a81bfff 0x0001/0x0000 0x0000000
8624.8454: *00007ffbca9b0000-00007ffbca9aefff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbca9b1000-00007ffbca884fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaadd000-00007ffbcaad6fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaae3000-00007ffbcaad5fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaaf0000-00007ffbcaaebfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaaf4000-00007ffbcaaf2fff 0x0010/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcaaf5000-00007ffbcaa8dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume4\Windows\System32\ntdll.dll
8624.8454: 00007ffbcab5c000-00007ff7956d7fff 0x0001/0x0000 0x0000000
8624.8454: *00007ffffffe0000-00007ffffffcffff 0x0001/0x0002 0x0020000
8624.8454: supR3HardNtChildPurify: Done after 1059 ms and 1 fixes (loop #1).
8938.8260: Log file opened: 4.3.20r96997 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x63258000
8938.8260: supR3HardenedVmProcessInit: uNtDllAddr=00007ffbca9b0000
8624.8454: supR3HardenedEarlyCompact: Removed heap 1 (0x00000000df0000 LB 0x400000)
8938.8260: ntdll.dll: timestamp 0x54516b13 (rc=VINF_SUCCESS)
8938.8260: New simple heap: #1 0000000000ab0000 LB 0x400000 (for 1753088 allocation)
8624.8454: supR3HardNtEnableThreadCreation:
8938.8260: System32: \Device\HarddiskVolume4\Windows\System32
8938.8260: WinSxS: \Device\HarddiskVolume4\Windows\WinSxS
8938.8260: KnownDllPath: C:\WINDOWS\system32
8938.8260: supR3HardenedVmProcessInit: Opening vboxdrv...
8938.8260: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...
8938.8260: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...
8938.8260: Registered Dll notification callback with NTDLL.
8938.8260: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\kernel32.dll)
8938.8260: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\kernel32.dll
8938.8260: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\system32\KERNEL32.DLL (Input=KERNEL32.DLL, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000801:<flags> [calling]
8938.8260: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
8938.8260: supR3HardenedDllNotificationCallback: load 00007ffbc7a20000 LB 0x00115000 C:\WINDOWS\system32\KERNELBASE.dll [fFlags=0x0]
8938.8260: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Windows\System32\KernelBase.dll)
8938.8260: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Windows\System32\KernelBase.dll
8938.8260: supR3HardenedDllNotificationCallback: load 00007ffbc8e50000 LB 0x0013e000 C:\WINDOWS\system32\KERNEL32.DLL [fFlags=0x0]
8938.8260: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
8938.8260: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffbc8e50000 'C:\WINDOWS\system32\KERNEL32.DLL'
8938.8260: supR3HardenedDllNotificationCallback: load 00007ff61a7e0000 LB 0x00106000 C:\Program Files\Oracle\VirtualBox\VirtualBox.exe [fFlags=0x0]
8938.8260: '\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe' has no imports
8938.8260: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe)
8938.8260: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe
8624.8454: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0xc0000005 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 89 ms, CloseEvents);
869c.8544: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0xc0000005 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1341 ms, the end);