Skip to content

Instantly share code, notes, and snippets.

@KarlBaumann
Created March 9, 2016 18:10
Show Gist options
  • Save KarlBaumann/08c0dcb92df9d4c6ca62 to your computer and use it in GitHub Desktop.
Save KarlBaumann/08c0dcb92df9d4c6ca62 to your computer and use it in GitHub Desktop.
1b5c.1228: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000020 g_uNtVerCombined=0x611db110
1b5c.1228: \SystemRoot\System32\ntdll.dll:
1b5c.1228: CreationTime: 2016-01-29T11:00:26.374196500Z
1b5c.1228: LastWriteTime: 2015-12-30T19:05:33.659216000Z
1b5c.1228: ChangeTime: 2016-02-02T16:49:16.860375200Z
1b5c.1228: FileAttributes: 0x20
1b5c.1228: Size: 0x1a67c0
1b5c.1228: NT Headers: 0xe0
1b5c.1228: Timestamp: 0x568429e5
1b5c.1228: Machine: 0x8664 - amd64
1b5c.1228: Timestamp: 0x568429e5
1b5c.1228: Image Version: 6.1
1b5c.1228: SizeOfImage: 0x1a9000 (1740800)
1b5c.1228: Resource Dir: 0x14d000 LB 0x5a028
1b5c.1228: ProductName: Microsoft® Windows® Operating System
1b5c.1228: ProductVersion: 6.1.7601.19110
1b5c.1228: FileVersion: 6.1.7601.19110 (win7sp1_gdr.151230-0600)
1b5c.1228: FileDescription: NT Layer DLL
1b5c.1228: \SystemRoot\System32\kernel32.dll:
1b5c.1228: CreationTime: 2016-01-29T11:00:25.410100100Z
1b5c.1228: LastWriteTime: 2015-12-30T18:57:55.730000000Z
1b5c.1228: ChangeTime: 2016-02-02T16:49:17.453182800Z
1b5c.1228: FileAttributes: 0x20
1b5c.1228: Size: 0x11c000
1b5c.1228: NT Headers: 0xe8
1b5c.1228: Timestamp: 0x568429dc
1b5c.1228: Machine: 0x8664 - amd64
1b5c.1228: Timestamp: 0x568429dc
1b5c.1228: Image Version: 6.1
1b5c.1228: SizeOfImage: 0x11f000 (1175552)
1b5c.1228: Resource Dir: 0x116000 LB 0x528
1b5c.1228: ProductName: Microsoft® Windows® Operating System
1b5c.1228: ProductVersion: 6.1.7601.19110
1b5c.1228: FileVersion: 6.1.7601.19110 (win7sp1_gdr.151230-0600)
1b5c.1228: FileDescription: Windows NT BASE API Client DLL
1b5c.1228: \SystemRoot\System32\KernelBase.dll:
1b5c.1228: CreationTime: 2016-01-29T11:00:28.073366400Z
1b5c.1228: LastWriteTime: 2015-12-30T18:57:55.761000000Z
1b5c.1228: ChangeTime: 2016-02-02T16:49:17.468783000Z
1b5c.1228: FileAttributes: 0x20
1b5c.1228: Size: 0x67a00
1b5c.1228: NT Headers: 0xe8
1b5c.1228: Timestamp: 0x568429dd
1b5c.1228: Machine: 0x8664 - amd64
1b5c.1228: Timestamp: 0x568429dd
1b5c.1228: Image Version: 6.1
1b5c.1228: SizeOfImage: 0x6c000 (442368)
1b5c.1228: Resource Dir: 0x6a000 LB 0x530
1b5c.1228: ProductName: Microsoft® Windows® Operating System
1b5c.1228: ProductVersion: 6.1.7601.19110
1b5c.1228: FileVersion: 6.1.7601.19110 (win7sp1_gdr.151230-0600)
1b5c.1228: FileDescription: Windows NT BASE API Client DLL
1b5c.1228: \SystemRoot\System32\apisetschema.dll:
1b5c.1228: CreationTime: 2016-01-29T11:00:30.573616400Z
1b5c.1228: LastWriteTime: 2015-12-30T18:54:58.839000000Z
1b5c.1228: ChangeTime: 2016-02-02T16:49:16.439169800Z
1b5c.1228: FileAttributes: 0x20
1b5c.1228: Size: 0x1a00
1b5c.1228: NT Headers: 0xc0
1b5c.1228: Timestamp: 0x568428c9
1b5c.1228: Machine: 0x8664 - amd64
1b5c.1228: Timestamp: 0x568428c9
1b5c.1228: Image Version: 6.1
1b5c.1228: SizeOfImage: 0x50000 (327680)
1b5c.1228: Resource Dir: 0x30000 LB 0x3f8
1b5c.1228: ProductName: Microsoft® Windows® Operating System
1b5c.1228: ProductVersion: 6.1.7601.19110
1b5c.1228: FileVersion: 6.1.7601.19110 (win7sp1_gdr.151230-0600)
1b5c.1228: FileDescription: ApiSet Schema DLL
1b5c.1228: NtOpenDirectoryObject failed on \Driver: 0xc0000022
1b5c.1228: supR3HardenedWinFindAdversaries: 0x20
1b5c.1228: \SystemRoot\System32\drivers\mfeapfk.sys:
1b5c.1228: CreationTime: 2013-07-20T14:58:30.060895000Z
1b5c.1228: LastWriteTime: 2015-07-21T15:00:51.100341700Z
1b5c.1228: ChangeTime: 2015-07-21T15:01:20.500341700Z
1b5c.1228: FileAttributes: 0x20
1b5c.1228: Size: 0x2f000
1b5c.1228: NT Headers: 0xf0
1b5c.1228: Timestamp: 0x54cbd0b9
1b5c.1228: Machine: 0x8664 - amd64
1b5c.1228: Timestamp: 0x54cbd0b9
1b5c.1228: Image Version: 0.0
1b5c.1228: SizeOfImage: 0x2cc80 (183424)
1b5c.1228: Resource Dir: 0x2c480 LB 0x340
1b5c.1228: ProductName: SYSCORE
1b5c.1228: FileVersion: SYSCORE.15.3.0.672
1b5c.1228: PrivateBuild: SYSCORE.15.3.0.672 F16
1b5c.1228: FileDescription: Access Protection Filter Driver
1b5c.1228: \SystemRoot\System32\drivers\mfeavfk.sys:
1b5c.1228: CreationTime: 2015-10-15T07:01:42.611950000Z
1b5c.1228: LastWriteTime: 2015-10-15T07:01:42.611950000Z
1b5c.1228: ChangeTime: 2015-10-15T07:01:58.486028800Z
1b5c.1228: FileAttributes: 0x20
1b5c.1228: Size: 0x54e98
1b5c.1228: NT Headers: 0xf8
1b5c.1228: Timestamp: 0x558ddc3c
1b5c.1228: Machine: 0x8664 - amd64
1b5c.1228: Timestamp: 0x558ddc3c
1b5c.1228: Image Version: 0.0
1b5c.1228: SizeOfImage: 0x50580 (329088)
1b5c.1228: Resource Dir: 0x4f700 LB 0x758
1b5c.1228: ProductName: SYSCORE
1b5c.1228: ProductVersion: 15.4.0.674
1b5c.1228: FileVersion: SYSCORE.15.4.0.674
1b5c.1228: PrivateBuild: SYSCORE.15.4.0.674 F15,F16,F19
1b5c.1228: FileDescription: Anti-Virus File System Filter Driver
1b5c.1228: \SystemRoot\System32\drivers\mfefirek.sys:
1b5c.1228: CreationTime: 2015-10-15T09:03:22.992361900Z
1b5c.1228: LastWriteTime: 2015-10-15T09:01:49.044361900Z
1b5c.1228: ChangeTime: 2015-10-15T09:01:49.044361900Z
1b5c.1228: FileAttributes: 0x20
1b5c.1228: Size: 0x794f8
1b5c.1228: NT Headers: 0xe8
1b5c.1228: Timestamp: 0x558ddc7b
1b5c.1228: Machine: 0x8664 - amd64
1b5c.1228: Timestamp: 0x558ddc7b
1b5c.1228: Image Version: 0.0
1b5c.1228: SizeOfImage: 0x74880 (477312)
1b5c.1228: Resource Dir: 0x72000 LB 0x388
1b5c.1228: ProductName: SYSCORE
1b5c.1228: ProductVersion: 15.4.0.674
1b5c.1228: FileVersion: SYSCORE.15.4.0.674
1b5c.1228: PrivateBuild: SYSCORE.15.4.0.674 F17,F18
1b5c.1228: FileDescription: McAfee Core Firewall Engine Driver
1b5c.1228: \SystemRoot\System32\drivers\mfehidk.sys:
1b5c.1228: CreationTime: 2015-10-15T07:01:51.562217200Z
1b5c.1228: LastWriteTime: 2015-10-15T07:01:42.565171600Z
1b5c.1228: ChangeTime: 2015-10-15T07:01:42.565171600Z
1b5c.1228: FileAttributes: 0x20
1b5c.1228: Size: 0xd5d98
1b5c.1228: NT Headers: 0x108
1b5c.1228: Timestamp: 0x558ddbf8
1b5c.1228: Machine: 0x8664 - amd64
1b5c.1228: Timestamp: 0x558ddbf8
1b5c.1228: Image Version: 0.0
1b5c.1228: SizeOfImage: 0xd0880 (854144)
1b5c.1228: Resource Dir: 0xcd980 LB 0x758
1b5c.1228: ProductName: SYSCORE
1b5c.1228: ProductVersion: 15.4.0.674
1b5c.1228: FileVersion: SYSCORE.15.4.0.674
1b5c.1228: PrivateBuild: SYSCORE.15.4.0.674 F14,F15,F16,F18,F20
1b5c.1228: FileDescription: McAfee Link Driver
1b5c.1228: \SystemRoot\System32\drivers\mfewfpk.sys:
1b5c.1228: CreationTime: 2015-10-15T09:02:07.597361900Z
1b5c.1228: LastWriteTime: 2015-10-15T09:01:48.888361900Z
1b5c.1228: ChangeTime: 2015-10-15T09:01:48.888361900Z
1b5c.1228: FileAttributes: 0x20
1b5c.1228: Size: 0x54280
1b5c.1228: NT Headers: 0x100
1b5c.1228: Timestamp: 0x558ddc06
1b5c.1228: Machine: 0x8664 - amd64
1b5c.1228: Timestamp: 0x558ddc06
1b5c.1228: Image Version: 0.0
1b5c.1228: SizeOfImage: 0x4f980 (326016)
1b5c.1228: Resource Dir: 0x4ef00 LB 0x380
1b5c.1228: ProductName: SYSCORE
1b5c.1228: ProductVersion: 15.4.0.674
1b5c.1228: FileVersion: SYSCORE.15.4.0.674
1b5c.1228: PrivateBuild: SYSCORE.15.4.0.674 F17,F18
1b5c.1228: FileDescription: Anti-Virus Mini-Firewall Driver
1b5c.1228: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
1b5c.1228: Calling main()
1b5c.1228: SUPR3HardenedMain: pszProgName=VBoxHeadless fFlags=0x0
1b5c.1228: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
1b5c.1228: SUPR3HardenedMain: Respawn #1
1b5c.1228: System32: \Device\HarddiskVolume2\Windows\System32
1b5c.1228: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
1b5c.1228: KnownDllPath: C:\windows\system32
1b5c.1228: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
1b5c.1228: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe)
1b5c.1228: supR3HardNtEnableThreadCreation:
1b5c.1228: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007709b630 pvNtTerminateThread=00000000770bdee0
1b5c.1228: supR3HardenedWinDoReSpawn(1): New child 23bc.2028 [kernel32].
1b5c.1228: supR3HardNtChildGatherData: PebBaseAddress=000007fffffd9000 cbPeb=0x380
1b5c.1228: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077070000 uNtDllChildAddr=0000000077070000
1b5c.1228: supR3HardenedWinSetupChildInit: uLdrInitThunk=000000007709b630
1b5c.1228: supR3HardenedWinSetupChildInit: Start child.
1b5c.1228: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
1b5c.1228: supR3HardNtChildPurify: Startup delay kludge #1/0: 520 ms, 65 sleeps
1b5c.1228: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
1b5c.1228: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000
1b5c.1228: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000
1b5c.1228: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000
1b5c.1228: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000
1b5c.1228: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000
1b5c.1228: 0000000000041000-fffffffffff81fff 0x0001/0x0000 0x0000000
1b5c.1228: *0000000000100000-0000000000003fff 0x0000/0x0004 0x0020000
1b5c.1228: 00000000001fc000-00000000001f8fff 0x0104/0x0004 0x0020000
1b5c.1228: 00000000001ff000-00000000001fdfff 0x0004/0x0004 0x0020000
1b5c.1228: 0000000000200000-ffffffff8938ffff 0x0001/0x0000 0x0000000
1b5c.1228: *0000000077070000-0000000077070fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1b5c.1228: 0000000077071000-000000007716efff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1b5c.1228: 000000007716f000-000000007719dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1b5c.1228: 000000007719e000-00000000771a5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1b5c.1228: 00000000771a6000-00000000771a6fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1b5c.1228: 00000000771a7000-00000000771a9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1b5c.1228: 00000000771aa000-0000000077218fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll
1b5c.1228: 0000000077219000-000000006f451fff 0x0001/0x0000 0x0000000
1b5c.1228: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000
1b5c.1228: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000
1b5c.1228: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000
1b5c.1228: 000000007fff0000-ffffffffc006ffff 0x0001/0x0000 0x0000000
1b5c.1228: *000000013ff70000-000000013ff70fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 000000013ff71000-000000013fff7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 000000013fff8000-000000013fff8fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 000000013fff9000-0000000140043fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 0000000140044000-0000000140044fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 0000000140045000-0000000140045fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 0000000140046000-000000014004afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 000000014004b000-000000014004bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 000000014004c000-000000014004cfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 000000014004d000-0000000140050fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 0000000140051000-000000014009bfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
1b5c.1228: 000000014009c000-fffff80380da7fff 0x0001/0x0000 0x0000000
1b5c.1228: *000007feff390000-000007feff390fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll
1b5c.1228: 000007feff391000-000007fdfe771fff 0x0001/0x0000 0x0000000
1b5c.1228: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000
1b5c.1228: 000007fffffd3000-000007fffffccfff 0x0001/0x0000 0x0000000
1b5c.1228: *000007fffffd9000-000007fffffd7fff 0x0004/0x0004 0x0020000
1b5c.1228: 000007fffffda000-000007fffffd5fff 0x0001/0x0000 0x0000000
1b5c.1228: *000007fffffde000-000007fffffdbfff 0x0004/0x0004 0x0020000
1b5c.1228: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000
1b5c.1228: apisetschema.dll: timestamp 0x568428c9 (rc=VINF_SUCCESS)
1b5c.1228: VBoxHeadless.exe: timestamp 0x56d9b7eb (rc=VINF_SUCCESS)
1b5c.1228: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports
1b5c.1228: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports
1b5c.1228: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports
1b5c.1228: supR3HardNtChildPurify: Done after 537 ms and 0 fixes (loop #0).
1b5c.1228: supR3HardNtEnableThreadCreation:
23bc.2028: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100
23bc.2028: supR3HardenedVmProcessInit: uNtDllAddr=0000000077070000 g_uNtVerCombined=0x611db100
23bc.2028: ntdll.dll: timestamp 0x568429e5 (rc=VINF_SUCCESS)
23bc.2028: New simple heap: #1 0000000000300000 LB 0x400000 (for 1740800 allocation)
23bc.2028: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'
23bc.2028: System32: \Device\HarddiskVolume2\Windows\System32
23bc.2028: WinSxS: \Device\HarddiskVolume2\Windows\winsxs
23bc.2028: KnownDllPath: C:\windows\system32
23bc.2028: supR3HardenedVmProcessInit: Opening vboxdrv stub...
23bc.2028: Error opening VBoxDrvStub: STATUS_OBJECT_NAME_NOT_FOUND
23bc.2028: supR3HardenedWinReadErrorInfoDevice: NtCreateFile -> 0xc0000034
23bc.2028: Error -101 in supR3HardenedWinReSpawn! (enmWhat=3)
23bc.2028: NtCreateFile(\Device\VBoxDrvStub) failed: 0xc0000034 STATUS_OBJECT_NAME_NOT_FOUND (0 retries)
Driver is probably stuck stopping/starting. Try 'sc.exe query vboxdrv' to get more information about its state. Rebooting may actually help.
1b5c.1228: supR3HardenedWinCheckChild: enmRequest=2 rc=-101 enmWhat=3 supR3HardenedWinReSpawn: NtCreateFile(\Device\VBoxDrvStub) failed: 0xc0000034 STATUS_OBJECT_NAME_NOT_FOUND (0 retries)
Driver is probably stuck stopping/starting. Try 'sc.exe query vboxdrv' to get more information about its state. Rebooting may actually help.
1b5c.1228: Error -101 in supR3HardenedWinReSpawn! (enmWhat=3)
1b5c.1228: NtCreateFile(\Device\VBoxDrvStub) failed: 0xc0000034 STATUS_OBJECT_NAME_NOT_FOUND (0 retries)
Driver is probably stuck stopping/starting. Try 'sc.exe query vboxdrv' to get more information about its state. Rebooting may actually help.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment