NAT not working due to hardening error

[samjervis]

I am running VirtualBox 5.0.6 on Windows 10. None of my guest operating systems are able to ping external IPs via VB's NAT connection type. They work fine via a Bridged Network, but this is not ideal for how I want to use VirtualBox. Guests that I've tried include Ubuntu and FreeBSD.

After some extensive googling I tracked down the problem to this error in the VM's logs:

Code: Select all

6f0.1af8: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Program Files\BullGuard Ltd\BullGuard\spamfilter\LittleHook.dll' (C:\Program Files\BullGuard Ltd\BullGuard\spamfilter\LittleHook.dll): rcNt=0xc0000190
6f0.1af8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'C:\Program Files\BullGuard Ltd\BullGuard\spamfilter\LittleHook.dll'

It looks like there is something about this dll which VirtualBox doesn't like. I've so far been unable to find a good explanation of what this error means, but other posts seem to hint that it may be due to an improperly signed dll. However, viewing the file properties for this dll in Windows Explorer seems to say that it is properly signed by GlobalSign, and Windows seems quite happy with the certificate chain.

As an experiment I uninstalled VirtualBox and installed an older version (4.3.10) which predates the hardening features - and NAT worked fine for my guests with that. However, I don't want to run an outdated VirtualBox - I want to understand this problem and fix it!

I'd really appreciate it if anyone can help me find a fix for this problem. I'd also like to better understand what this problem really means:

• What exactly does this error code mean? Is it actually a signature problem, or is it something else?
  Why does VirtualBox need to load a dll associated with the spamfilter anyway?

Thanks!

[mpack]

Why does VirtualBox need to load a dll associated with the spamfilter anyway?

It doesn't. You have it the wrong way round. The DLL injects itself into the VirtualBox execution space (and presumably every other host program), which is exactly the kind of malware-like activity that VirtualBox finds suspicious in an unsigned DLL. It's clear from the DLL name that its overt purpose is to hook into the host internet API and filter out "spam"... whatever that means in the context of internet browsing. I assume it blocks URLs to suspicious websites.

It's possible that part of your problem is that you are using a Windows 10 host, as that OS is not yet officially supported as a host OS.