Bug: Windows Repair breaks Oracle Virtual Box

[CodeLurker]

Let me first say that Windows Repair is fantastic.  I recently cleaned up a ZeroAccess variant on my machine, and it was the only thing that got the Firewall, Defender, and Update going.  Truly Awesome Work!!!  I'll soon be using it on another machine at our home as well, if needed.

I found that after I had applied the repairs in WR, VirtualBox would not start, saying "Failed to create the VirtualBox COM object".  Fortunately, I backed up my registry and did a system restore point, as prompted by the program.  Looking at the technical support on that issue accomplished nothing.  Uninstalling VB and reinstalling would not make the problem go away.  I restored the registry, and it went away.

I then proceeded to apply the fixes a few at a time, instead of applying the defaults.  I had applied a lot of them, and got most of the non-working services working again, working from the top down; except skipping ones that likely wouldn't be involved.  I got to the item "Repair Proxy Settings"; and remembering that VB installed network adapters to allow the virtual machine to communicate with the outside world, I skipped it, in favor of "Restore Important Windows Services".  This finally had Windows Firewall, Defender, and Update working; AND VB working at the same time.  Whew!  That had been an involved cleanup.

Thus, I think "Repair Proxy Settings" makes VB irreparably broken.  It might be another default setting; but I think it's probably that one.  Ones it certainly is not, are the ones I used the second time around:

Windows Firewall
Windows Update
Remove Policies Set By Infections
Register System Files
WMI
Winsock & DNS Cache
Restore Important Windows Services

Other ones that don't cause the problem are the ones that are not enabled by default - or at least I'm pretty sure they don't.

I'd fool around with it more and see what the problem is, but after that lengthy malware cleanup, I'm spent.  I suspect you'll be able to reproduce the problem; but if not, post here and I can try to narrow it down eventually.  I'm just trying to pay it forward, so we can have the tool that M$ should have made in the beginning, a repair function for Win7, even better.  Keep up the good work :P

[Shane]

The repair proxy is just 1 reg file that is ran. Here is the contents of it, can you check your registry and see if you have something different for those keys with Virtual box installed?

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=dword:00000000
"ProxyServer"=-
"ProxyOverride"=-
"AutoConfigURL"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=dword:00000000
"ProxyServer"=-
"ProxyOverride"=-
"AutoConfigURL"=-

[HKEY_USERS\%replaceme%\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=dword:00000000
"ProxyServer"=-
"ProxyOverride"=-
"AutoConfigURL"=-


The %replaceme% in the last part is where the program replaces it with the SID of the current user

Shane

[Willy2]

It confirms that ZeroAccess places Symbolic Links on the WinDefender folder, that point away from the WinDefend folder.

[CodeLurker]

Currently, VirtualBox works, and I find ProxyEnable missing in HKLM, but present in the other two.  I don't find the other values in any.  I had no idea what an SID was, but sleuthed it out.

[Shane]

I am not sure why that repair would have done anything to it. Very odd. Yet all other repairs worked fine and you had no problem after?

Shane

[CodeLurker]

Well, now that you say what it is, it does sound doubtful.  Since I restored the registry, I did the tweaks I have listed.  I have no problems with my system, except that I uninstalled IE8 ages ago, and no subsequent IE will reinstall.  Punishment for disloyalty to M$, no doubt.  I don't think it's related to Win Repair.  The other issue I had, is it was saying "unknown network" as well as "network access" with a home symbol in the system tray.  I could use the 'Net fine, but I couldn't bring up the network and sharing center.  A few updates later, and it asked me if I wanted to give explorer.exe access to the LAN.  I told it yes, and the center opens up normally, and I just have the one expected connection.  I don't know if that one is related to Win Repair or not.

I'm sure that none of the repairs in the default configuration breaks VirtualBox.  Suggestion: 1) install VirtualBox, 2) check that it runs, if not, you may need a virgin computer, i.e. pre Win Repair.  3) run WinRepair with the defaults, 4) see if VirtualBox runs.

[Shane]

When I get a chance I will try that.

I test all the repair against a fresh install of each version of windows to make sure nothing breaks. After all it is suppose to repair things, so running on a clean system should always be safe, and that is how I test it

Shane

[CodeLurker]

The error comes up right when you start it, so you don't have to know how to use it.  If the main application comes up instead of a pop-up, it is fine.  There is a free download for it also; which is the one I was using.  (I've found it to be much better than VMWare, for any interested.)

[CodeLurker]

My computer is still not running right.  I think after my most recent infections, it started pulling up one out of every four to six webpages as "Problem loading page" in FireFox.  Refreshing these pages later pulls them up promptly.  Pulling up the same page on another computer in my house here comes up quickly.  I don't think this has anything to do with Windows Repair; as I dropped back to a version of the registry before I applied the fixes, and it still did it.

In the course of doing this, I reapplied all off the fixes I listed above as safe, and they worked fine again with VirtualBox.  I tried four more, to try to resolve the problem, and VirtualBox broke.  These were only four more, so I broke it down to see which one was at fault.  It turned out to be "Repair Internet Explorer" which breaks VirtualBox on my machine.  This should save you a little time.

I'm running Win7 Home Premium 32-bit on an Intel Core i3.

[Willy2]

According to my info parts of IE are also used by other Windows (sub-)systems. Perhaps Virtual Box (VB) un-registers one or more of those "IE files". Or perhaps VB registers it own files with the same name. Then running WR re-registers a Windows file with the same name.

"Repair IE" only registers a bunch of windows files with the "Regsvr32" command. You can open the file "IE.txt" (in one of the subfolders) to see which files are registered.

[Shane]

Sorry for the late reply, my wife had our baby

I have seen the page not loading problem on a few of my customer machines. For most of them it was a rootkit infection doing it that only combofix found and nothing else at the time.

A lot of rootkits are so well hidden they are very hard to clean and most of them hijack your network connection to redirect you to other pages with ads on it to try and make money. So because of that you will get random page not loading errors.

Then again on some of the machines it was just a corrupt DNS problem and on 2 of them it was the stupid antivirus firewall doing it.

Sometimes an antivirus can be just as annoying as the virus when it breaks lol

Shane

[Willy2]

@Codelurker:  "Repair Internet Explorer" only registers a bunch of files (~ 120 files). And "Registering" means making/refreshing an entry in the registry. And that entry tells Windows in which folder it can find the files it needs. Your description of the problem would suggest that registering one or more of those ~120 files breaks the socalled "COM" subsystem. That also explains why restoring the registry to a previous state fixes this problem.

First of all: do you have IE installed ? and which version ? do you use it ?
(According to my info parts of IE are used by other programs as well.)

Have you Windows Live Mail installed and do you use it ? or any other Windows Live program ? Or do you use Outlook ?

1. Grab the file in the attachment, give it a *.bat extension and run it with admin rights. It produces a file called "Willy2.txt" in the root directory and when a "Repair IE" related file is present on your system, then "Willy2.txt" tells you where that file is located.
2. Download the 32 bits version of "REGDLLVIEW" from "Nirsoft.net".
3. Run it BEFORE you run "Repair IE". The program tells which files are registered in the registry. Export the info produced to a file that can be imported into a spreadsheet. REGDLLVIEW offers that possibility (somewhere).
4. Run WR's "Repair IE"
5. Run "REGDLLVIEW" once more and export the new info as well.
6. Post all three files produced in the next reply. (I am VERY curious, interested !!!!)
7. Take each file from "willy2.txt" and see whether is wasn't registered before & got registered by running "Repair IE". That/those file(s) is/are responsible for braking the "COM" subsystem and "Virtual Box".

When you know which file(s) break(s) Virtual Box then you can remove all the appropriate "REGSVR32" line(s) from the file "IE.txt" (in the subfolder "files" of WR).

[Willy2]

And DO report what you're experiences are. did these instructions help you ?