Created
March 9, 2016 18:10
-
-
Save KarlBaumann/08c0dcb92df9d4c6ca62 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1b5c.1228: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000020 g_uNtVerCombined=0x611db110 | |
1b5c.1228: \SystemRoot\System32\ntdll.dll: | |
1b5c.1228: CreationTime: 2016-01-29T11:00:26.374196500Z | |
1b5c.1228: LastWriteTime: 2015-12-30T19:05:33.659216000Z | |
1b5c.1228: ChangeTime: 2016-02-02T16:49:16.860375200Z | |
1b5c.1228: FileAttributes: 0x20 | |
1b5c.1228: Size: 0x1a67c0 | |
1b5c.1228: NT Headers: 0xe0 | |
1b5c.1228: Timestamp: 0x568429e5 | |
1b5c.1228: Machine: 0x8664 - amd64 | |
1b5c.1228: Timestamp: 0x568429e5 | |
1b5c.1228: Image Version: 6.1 | |
1b5c.1228: SizeOfImage: 0x1a9000 (1740800) | |
1b5c.1228: Resource Dir: 0x14d000 LB 0x5a028 | |
1b5c.1228: ProductName: Microsoft® Windows® Operating System | |
1b5c.1228: ProductVersion: 6.1.7601.19110 | |
1b5c.1228: FileVersion: 6.1.7601.19110 (win7sp1_gdr.151230-0600) | |
1b5c.1228: FileDescription: NT Layer DLL | |
1b5c.1228: \SystemRoot\System32\kernel32.dll: | |
1b5c.1228: CreationTime: 2016-01-29T11:00:25.410100100Z | |
1b5c.1228: LastWriteTime: 2015-12-30T18:57:55.730000000Z | |
1b5c.1228: ChangeTime: 2016-02-02T16:49:17.453182800Z | |
1b5c.1228: FileAttributes: 0x20 | |
1b5c.1228: Size: 0x11c000 | |
1b5c.1228: NT Headers: 0xe8 | |
1b5c.1228: Timestamp: 0x568429dc | |
1b5c.1228: Machine: 0x8664 - amd64 | |
1b5c.1228: Timestamp: 0x568429dc | |
1b5c.1228: Image Version: 6.1 | |
1b5c.1228: SizeOfImage: 0x11f000 (1175552) | |
1b5c.1228: Resource Dir: 0x116000 LB 0x528 | |
1b5c.1228: ProductName: Microsoft® Windows® Operating System | |
1b5c.1228: ProductVersion: 6.1.7601.19110 | |
1b5c.1228: FileVersion: 6.1.7601.19110 (win7sp1_gdr.151230-0600) | |
1b5c.1228: FileDescription: Windows NT BASE API Client DLL | |
1b5c.1228: \SystemRoot\System32\KernelBase.dll: | |
1b5c.1228: CreationTime: 2016-01-29T11:00:28.073366400Z | |
1b5c.1228: LastWriteTime: 2015-12-30T18:57:55.761000000Z | |
1b5c.1228: ChangeTime: 2016-02-02T16:49:17.468783000Z | |
1b5c.1228: FileAttributes: 0x20 | |
1b5c.1228: Size: 0x67a00 | |
1b5c.1228: NT Headers: 0xe8 | |
1b5c.1228: Timestamp: 0x568429dd | |
1b5c.1228: Machine: 0x8664 - amd64 | |
1b5c.1228: Timestamp: 0x568429dd | |
1b5c.1228: Image Version: 6.1 | |
1b5c.1228: SizeOfImage: 0x6c000 (442368) | |
1b5c.1228: Resource Dir: 0x6a000 LB 0x530 | |
1b5c.1228: ProductName: Microsoft® Windows® Operating System | |
1b5c.1228: ProductVersion: 6.1.7601.19110 | |
1b5c.1228: FileVersion: 6.1.7601.19110 (win7sp1_gdr.151230-0600) | |
1b5c.1228: FileDescription: Windows NT BASE API Client DLL | |
1b5c.1228: \SystemRoot\System32\apisetschema.dll: | |
1b5c.1228: CreationTime: 2016-01-29T11:00:30.573616400Z | |
1b5c.1228: LastWriteTime: 2015-12-30T18:54:58.839000000Z | |
1b5c.1228: ChangeTime: 2016-02-02T16:49:16.439169800Z | |
1b5c.1228: FileAttributes: 0x20 | |
1b5c.1228: Size: 0x1a00 | |
1b5c.1228: NT Headers: 0xc0 | |
1b5c.1228: Timestamp: 0x568428c9 | |
1b5c.1228: Machine: 0x8664 - amd64 | |
1b5c.1228: Timestamp: 0x568428c9 | |
1b5c.1228: Image Version: 6.1 | |
1b5c.1228: SizeOfImage: 0x50000 (327680) | |
1b5c.1228: Resource Dir: 0x30000 LB 0x3f8 | |
1b5c.1228: ProductName: Microsoft® Windows® Operating System | |
1b5c.1228: ProductVersion: 6.1.7601.19110 | |
1b5c.1228: FileVersion: 6.1.7601.19110 (win7sp1_gdr.151230-0600) | |
1b5c.1228: FileDescription: ApiSet Schema DLL | |
1b5c.1228: NtOpenDirectoryObject failed on \Driver: 0xc0000022 | |
1b5c.1228: supR3HardenedWinFindAdversaries: 0x20 | |
1b5c.1228: \SystemRoot\System32\drivers\mfeapfk.sys: | |
1b5c.1228: CreationTime: 2013-07-20T14:58:30.060895000Z | |
1b5c.1228: LastWriteTime: 2015-07-21T15:00:51.100341700Z | |
1b5c.1228: ChangeTime: 2015-07-21T15:01:20.500341700Z | |
1b5c.1228: FileAttributes: 0x20 | |
1b5c.1228: Size: 0x2f000 | |
1b5c.1228: NT Headers: 0xf0 | |
1b5c.1228: Timestamp: 0x54cbd0b9 | |
1b5c.1228: Machine: 0x8664 - amd64 | |
1b5c.1228: Timestamp: 0x54cbd0b9 | |
1b5c.1228: Image Version: 0.0 | |
1b5c.1228: SizeOfImage: 0x2cc80 (183424) | |
1b5c.1228: Resource Dir: 0x2c480 LB 0x340 | |
1b5c.1228: ProductName: SYSCORE | |
1b5c.1228: FileVersion: SYSCORE.15.3.0.672 | |
1b5c.1228: PrivateBuild: SYSCORE.15.3.0.672 F16 | |
1b5c.1228: FileDescription: Access Protection Filter Driver | |
1b5c.1228: \SystemRoot\System32\drivers\mfeavfk.sys: | |
1b5c.1228: CreationTime: 2015-10-15T07:01:42.611950000Z | |
1b5c.1228: LastWriteTime: 2015-10-15T07:01:42.611950000Z | |
1b5c.1228: ChangeTime: 2015-10-15T07:01:58.486028800Z | |
1b5c.1228: FileAttributes: 0x20 | |
1b5c.1228: Size: 0x54e98 | |
1b5c.1228: NT Headers: 0xf8 | |
1b5c.1228: Timestamp: 0x558ddc3c | |
1b5c.1228: Machine: 0x8664 - amd64 | |
1b5c.1228: Timestamp: 0x558ddc3c | |
1b5c.1228: Image Version: 0.0 | |
1b5c.1228: SizeOfImage: 0x50580 (329088) | |
1b5c.1228: Resource Dir: 0x4f700 LB 0x758 | |
1b5c.1228: ProductName: SYSCORE | |
1b5c.1228: ProductVersion: 15.4.0.674 | |
1b5c.1228: FileVersion: SYSCORE.15.4.0.674 | |
1b5c.1228: PrivateBuild: SYSCORE.15.4.0.674 F15,F16,F19 | |
1b5c.1228: FileDescription: Anti-Virus File System Filter Driver | |
1b5c.1228: \SystemRoot\System32\drivers\mfefirek.sys: | |
1b5c.1228: CreationTime: 2015-10-15T09:03:22.992361900Z | |
1b5c.1228: LastWriteTime: 2015-10-15T09:01:49.044361900Z | |
1b5c.1228: ChangeTime: 2015-10-15T09:01:49.044361900Z | |
1b5c.1228: FileAttributes: 0x20 | |
1b5c.1228: Size: 0x794f8 | |
1b5c.1228: NT Headers: 0xe8 | |
1b5c.1228: Timestamp: 0x558ddc7b | |
1b5c.1228: Machine: 0x8664 - amd64 | |
1b5c.1228: Timestamp: 0x558ddc7b | |
1b5c.1228: Image Version: 0.0 | |
1b5c.1228: SizeOfImage: 0x74880 (477312) | |
1b5c.1228: Resource Dir: 0x72000 LB 0x388 | |
1b5c.1228: ProductName: SYSCORE | |
1b5c.1228: ProductVersion: 15.4.0.674 | |
1b5c.1228: FileVersion: SYSCORE.15.4.0.674 | |
1b5c.1228: PrivateBuild: SYSCORE.15.4.0.674 F17,F18 | |
1b5c.1228: FileDescription: McAfee Core Firewall Engine Driver | |
1b5c.1228: \SystemRoot\System32\drivers\mfehidk.sys: | |
1b5c.1228: CreationTime: 2015-10-15T07:01:51.562217200Z | |
1b5c.1228: LastWriteTime: 2015-10-15T07:01:42.565171600Z | |
1b5c.1228: ChangeTime: 2015-10-15T07:01:42.565171600Z | |
1b5c.1228: FileAttributes: 0x20 | |
1b5c.1228: Size: 0xd5d98 | |
1b5c.1228: NT Headers: 0x108 | |
1b5c.1228: Timestamp: 0x558ddbf8 | |
1b5c.1228: Machine: 0x8664 - amd64 | |
1b5c.1228: Timestamp: 0x558ddbf8 | |
1b5c.1228: Image Version: 0.0 | |
1b5c.1228: SizeOfImage: 0xd0880 (854144) | |
1b5c.1228: Resource Dir: 0xcd980 LB 0x758 | |
1b5c.1228: ProductName: SYSCORE | |
1b5c.1228: ProductVersion: 15.4.0.674 | |
1b5c.1228: FileVersion: SYSCORE.15.4.0.674 | |
1b5c.1228: PrivateBuild: SYSCORE.15.4.0.674 F14,F15,F16,F18,F20 | |
1b5c.1228: FileDescription: McAfee Link Driver | |
1b5c.1228: \SystemRoot\System32\drivers\mfewfpk.sys: | |
1b5c.1228: CreationTime: 2015-10-15T09:02:07.597361900Z | |
1b5c.1228: LastWriteTime: 2015-10-15T09:01:48.888361900Z | |
1b5c.1228: ChangeTime: 2015-10-15T09:01:48.888361900Z | |
1b5c.1228: FileAttributes: 0x20 | |
1b5c.1228: Size: 0x54280 | |
1b5c.1228: NT Headers: 0x100 | |
1b5c.1228: Timestamp: 0x558ddc06 | |
1b5c.1228: Machine: 0x8664 - amd64 | |
1b5c.1228: Timestamp: 0x558ddc06 | |
1b5c.1228: Image Version: 0.0 | |
1b5c.1228: SizeOfImage: 0x4f980 (326016) | |
1b5c.1228: Resource Dir: 0x4ef00 LB 0x380 | |
1b5c.1228: ProductName: SYSCORE | |
1b5c.1228: ProductVersion: 15.4.0.674 | |
1b5c.1228: FileVersion: SYSCORE.15.4.0.674 | |
1b5c.1228: PrivateBuild: SYSCORE.15.4.0.674 F17,F18 | |
1b5c.1228: FileDescription: Anti-Virus Mini-Firewall Driver | |
1b5c.1228: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox' | |
1b5c.1228: Calling main() | |
1b5c.1228: SUPR3HardenedMain: pszProgName=VBoxHeadless fFlags=0x0 | |
1b5c.1228: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox' | |
1b5c.1228: SUPR3HardenedMain: Respawn #1 | |
1b5c.1228: System32: \Device\HarddiskVolume2\Windows\System32 | |
1b5c.1228: WinSxS: \Device\HarddiskVolume2\Windows\winsxs | |
1b5c.1228: KnownDllPath: C:\windows\system32 | |
1b5c.1228: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports | |
1b5c.1228: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe) | |
1b5c.1228: supR3HardNtEnableThreadCreation: | |
1b5c.1228: supR3HardNtDisableThreadCreation: pvLdrInitThunk=000000007709b630 pvNtTerminateThread=00000000770bdee0 | |
1b5c.1228: supR3HardenedWinDoReSpawn(1): New child 23bc.2028 [kernel32]. | |
1b5c.1228: supR3HardNtChildGatherData: PebBaseAddress=000007fffffd9000 cbPeb=0x380 | |
1b5c.1228: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077070000 uNtDllChildAddr=0000000077070000 | |
1b5c.1228: supR3HardenedWinSetupChildInit: uLdrInitThunk=000000007709b630 | |
1b5c.1228: supR3HardenedWinSetupChildInit: Start child. | |
1b5c.1228: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms. | |
1b5c.1228: supR3HardNtChildPurify: Startup delay kludge #1/0: 520 ms, 65 sleeps | |
1b5c.1228: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION | |
1b5c.1228: *0000000000000000-fffffffffffeffff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *0000000000010000-fffffffffffeffff 0x0004/0x0004 0x0020000 | |
1b5c.1228: *0000000000030000-000000000002bfff 0x0002/0x0002 0x0040000 | |
1b5c.1228: 0000000000034000-0000000000027fff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *0000000000040000-000000000003efff 0x0004/0x0004 0x0020000 | |
1b5c.1228: 0000000000041000-fffffffffff81fff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *0000000000100000-0000000000003fff 0x0000/0x0004 0x0020000 | |
1b5c.1228: 00000000001fc000-00000000001f8fff 0x0104/0x0004 0x0020000 | |
1b5c.1228: 00000000001ff000-00000000001fdfff 0x0004/0x0004 0x0020000 | |
1b5c.1228: 0000000000200000-ffffffff8938ffff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *0000000077070000-0000000077070fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll | |
1b5c.1228: 0000000077071000-000000007716efff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll | |
1b5c.1228: 000000007716f000-000000007719dfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll | |
1b5c.1228: 000000007719e000-00000000771a5fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll | |
1b5c.1228: 00000000771a6000-00000000771a6fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll | |
1b5c.1228: 00000000771a7000-00000000771a9fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll | |
1b5c.1228: 00000000771aa000-0000000077218fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\ntdll.dll | |
1b5c.1228: 0000000077219000-000000006f451fff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *000000007efe0000-000000007dfdffff 0x0000/0x0002 0x0020000 | |
1b5c.1228: *000000007ffe0000-000000007ffdefff 0x0002/0x0002 0x0020000 | |
1b5c.1228: 000000007ffe1000-000000007ffd1fff 0x0000/0x0002 0x0020000 | |
1b5c.1228: 000000007fff0000-ffffffffc006ffff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *000000013ff70000-000000013ff70fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 000000013ff71000-000000013fff7fff 0x0020/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 000000013fff8000-000000013fff8fff 0x0080/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 000000013fff9000-0000000140043fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 0000000140044000-0000000140044fff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 0000000140045000-0000000140045fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 0000000140046000-000000014004afff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 000000014004b000-000000014004bfff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 000000014004c000-000000014004cfff 0x0004/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 000000014004d000-0000000140050fff 0x0008/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 0000000140051000-000000014009bfff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe | |
1b5c.1228: 000000014009c000-fffff80380da7fff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *000007feff390000-000007feff390fff 0x0002/0x0080 0x1000000 \Device\HarddiskVolume2\Windows\System32\apisetschema.dll | |
1b5c.1228: 000007feff391000-000007fdfe771fff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *000007fffffb0000-000007fffff8cfff 0x0002/0x0002 0x0040000 | |
1b5c.1228: 000007fffffd3000-000007fffffccfff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *000007fffffd9000-000007fffffd7fff 0x0004/0x0004 0x0020000 | |
1b5c.1228: 000007fffffda000-000007fffffd5fff 0x0001/0x0000 0x0000000 | |
1b5c.1228: *000007fffffde000-000007fffffdbfff 0x0004/0x0004 0x0020000 | |
1b5c.1228: *000007fffffe0000-000007fffffcffff 0x0001/0x0002 0x0020000 | |
1b5c.1228: apisetschema.dll: timestamp 0x568428c9 (rc=VINF_SUCCESS) | |
1b5c.1228: VBoxHeadless.exe: timestamp 0x56d9b7eb (rc=VINF_SUCCESS) | |
1b5c.1228: '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox\VBoxHeadless.exe' has no imports | |
1b5c.1228: '\Device\HarddiskVolume2\Windows\System32\apisetschema.dll' has no imports | |
1b5c.1228: '\Device\HarddiskVolume2\Windows\System32\ntdll.dll' has no imports | |
1b5c.1228: supR3HardNtChildPurify: Done after 537 ms and 0 fixes (loop #0). | |
1b5c.1228: supR3HardNtEnableThreadCreation: | |
23bc.2028: Log file opened: 5.0.16r105871 g_hStartupLog=0000000000000004 g_uNtVerCombined=0x611db100 | |
23bc.2028: supR3HardenedVmProcessInit: uNtDllAddr=0000000077070000 g_uNtVerCombined=0x611db100 | |
23bc.2028: ntdll.dll: timestamp 0x568429e5 (rc=VINF_SUCCESS) | |
23bc.2028: New simple heap: #1 0000000000300000 LB 0x400000 (for 1740800 allocation) | |
23bc.2028: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox' | |
23bc.2028: System32: \Device\HarddiskVolume2\Windows\System32 | |
23bc.2028: WinSxS: \Device\HarddiskVolume2\Windows\winsxs | |
23bc.2028: KnownDllPath: C:\windows\system32 | |
23bc.2028: supR3HardenedVmProcessInit: Opening vboxdrv stub... | |
23bc.2028: Error opening VBoxDrvStub: STATUS_OBJECT_NAME_NOT_FOUND | |
23bc.2028: supR3HardenedWinReadErrorInfoDevice: NtCreateFile -> 0xc0000034 | |
23bc.2028: Error -101 in supR3HardenedWinReSpawn! (enmWhat=3) | |
23bc.2028: NtCreateFile(\Device\VBoxDrvStub) failed: 0xc0000034 STATUS_OBJECT_NAME_NOT_FOUND (0 retries) | |
Driver is probably stuck stopping/starting. Try 'sc.exe query vboxdrv' to get more information about its state. Rebooting may actually help. | |
1b5c.1228: supR3HardenedWinCheckChild: enmRequest=2 rc=-101 enmWhat=3 supR3HardenedWinReSpawn: NtCreateFile(\Device\VBoxDrvStub) failed: 0xc0000034 STATUS_OBJECT_NAME_NOT_FOUND (0 retries) | |
Driver is probably stuck stopping/starting. Try 'sc.exe query vboxdrv' to get more information about its state. Rebooting may actually help. | |
1b5c.1228: Error -101 in supR3HardenedWinReSpawn! (enmWhat=3) | |
1b5c.1228: NtCreateFile(\Device\VBoxDrvStub) failed: 0xc0000034 STATUS_OBJECT_NAME_NOT_FOUND (0 retries) | |
Driver is probably stuck stopping/starting. Try 'sc.exe query vboxdrv' to get more information about its state. Rebooting may actually help. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment