Issue with Oracle Box/Ubuntu

[cgilmour]

Hi,

We're getting an issue with Oracle Box which seems to hang on loading and points to the hardening log. This has only started happening in the last few weeks.

 

our software is:-

windows 7 enterprise

We run Avast v 17.6.3614.0

We run Oracle box 5.0.8 but tried a more recent version as well

We get as far as pointing to an ubuntu iso Then it hangs with the following message - this happens on differnt computers with the same build and we have had this working in the past until the summer hols.:-

 

"Timed out after 60010 ms waiting for child request #1 (CloseEvents)."

 

I'd be really grateful for any help on where to look to resolve this - thanks in advance

 

(below is the latter part of the relevant hardening logfile)

 

Chris

 

Here's part of the hardening log :-

 

dc.1398: Log file opened: 5.0.8r103449 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db110

dc.1398: supR3HardenedVmProcessInit: uNtDllAddr=0000000077ad0000

8f4.564: supR3HardNtEnableThreadCreation:

dc.1398: ntdll.dll: timestamp 0x598d5074 (rc=VINF_SUCCESS)

dc.1398: New simple heap: #1 0000000000310000 LB 0x400000 (for 1744896 allocation)

dc.1398: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'

dc.1398: System32: \Device\HarddiskVolume2\Windows\System32

dc.1398: WinSxS: \Device\HarddiskVolume2\Windows\winsxs

dc.1398: KnownDllPath: C:\Windows\system32

dc.1398: supR3HardenedVmProcessInit: Opening vboxdrv stub...

dc.1398: supR3HardenedVmProcessInit: Restoring LdrInitializeThunk...

dc.1398: supR3HardenedVmProcessInit: Returning to LdrInitializeThunk...

dc.1398: Registered Dll notification callback with NTDLL.

dc.1398: supHardenedWinVerifyImageByHandle: -> 22900 (\Device\HarddiskVolume2\Windows\System32\kernel32.dll)

dc.1398: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume2\Windows\System32\kernel32.dll

dc.1398: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\kernel32.dll (Input=kernel32.dll, rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000: [calling]

dc.1398: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]

8f4.564: Error (rc=258):

8f4.564: Timed out after 60010 ms waiting for child request #1 (CloseEvents).

8f4.564: Error 258 in supR3HardNtChildWaitFor! (enmWhat=5)

8f4.564: Timed out after 60010 ms waiting for child request #1 (CloseEvents).

[Manny-Tech]

Did you ever solve this?

[Manny-Tech]

I'm getting the same problem:

 

[cgilmour]

Yes we had to put exclusions in impero

On the impero server click on tools injection exclusions and add vbox - I can email you a screenshot if you want?

[Manny-Tech]

That would be great. Thanks!

[cgilmour]

 

Hope this is clear :-)

[Manny-Tech]

Super!