Windows XP Guest crash with Kaspersky 2009 (rdpmc) -> fixed in SVN

Without the VBox.log of the XP VM there's not much we can say.

VBox.log attached, however this bug can always be reproduced.

The crash will probably go away if you turn on VT-x in the VM settings dialog.

VT-x totally enabled : No crash, but Windows XP won't boot, it stays waiting just after the welcome screen, when the desktop should normally appears. VT-x partially enabled : It boots to the desktop and works correctly during a few seconds, then crash with a BSOD VT-x disabled : It boots to the desktop and works correctly during a few seconds, then crash with a BSOD

We have to check this ourselves then. Is there a demo of Kaspersky 2009 and if so, does the problem occur with that version as well?

Also, there's no partial VT-x; it's either enabled or it's not. Can you attach a log when you have VT-x enabled?

I waited 30 minutes for Windows XP to boot, and then attached the VBox.log file, and closed Windows which was still not booted.

Kaspersky free trial version is here : http://usa.kaspersky.com/trials/home-users/anti-virus-7/tp/

You were right, there is no partial VT-x (I thought this because of the grey case). I tested VT-x enabled (don't boot) and disabled (crashes).

Can be still reproduced with 1.6.4 release and up-to-date kaspersky

This bug can still be reproduced in 1.6.6 release when VT-x is enabled. However, the bug is not reproducible anymore with VT-x disabled!

Ah false, the situation improved : The guest system does not immediately crash anymore, but it still crashes with a BSOD on random situations.

I can always reproduce a crash when I try to open any .zip file!

BSOD does not happens when Kaspersky is disabled.

This bug can be still reproduced with 2.0 release when VT-x is enabled. With VT-x disabled, it crashes on some circumstances (ex: when accessing a .zip file). Nothing changed since 1.6.6 release.

The problem that VirtualBox in VT-x disabled and AMD-V mode can't correctly skip and injects #UD then guest execute performance monitoring code - rdpmc instruction and read/write unknown for VirtualBox performance counters MSRs by rdmsr, wrmsr. Kaspersky 2009 use these instructions in kernel mode of heuristic analysis engine.

VirtualBox correctly work with Kaspersky on Intel VTx.

MMh, I just tried 2.0.2 with VT-x enabled (I have a intel core 2 duo CPU) and it still crashes with a BSOD when clicking on .zip archives.

Opps, there is other bug on 2.0.2 with VT-x enabled. Yesterday I check only heuristic analysis engine with VT-x - work correct. Other bug - VBox hangs when guest write to write-protected page (on supervisor level) with WP disabled bit of CR0.

I think your problem is no VT-x, your problem is Guest additions, try to start XP and unistall Gust additions from control panel

No, the bug is identical without guest additions (I just tested). Crash without VT-x when accessing .zip files, doesn't boot with VT-x

2.0.4, not fixed yet.

Replying to oxmosys:

2.0.4, not fixed yet.

Kaspersky just released a new KIS and KAS:

Kiss (firewall and all)

ftp://ftp.kaspersky.com//products/english/homeuser/kis2009/kis8.0.0.506en.exe

Kas (no firewall)

ftp://ftp.kaspersky.com//products/english/homeuser/kav2009/kav8.0.0.506en.exe

Have anyone had a chance to test it yet?

-T

Still reproducible.

Replying to oxmosys:

Still reproducible.

any change under 2.1.0

I'm afraid not since the RDPMC x86 instruction still causes an exception.

We (Kaspersky Lab) can disable certain features of KAV/KIS and not use RDPMC on Virtual Box to avoid the crashes, but to do it, we need a reliable way of detecting Virtual Box "from within". Any ideas?

Unfortunately there's no CPUID bit for RDPMC, so we'll have to properly support this instruction ourselves. I've opened an internal defect for this.

I also get this crash however it could be related to the scanning engine. I only seem to get the crash after about 2 seconds after starting a system scan using Kaspersky. Im not at all an expert on Virtualbox but I thought it would be worth mentioning it. I have Win XP Pro SP3. My settings are near enough default.

STOP: 0x0000008E (0xC000001D, 0xF70213A3, 0xF4233AB0, 0x00000000)

The file which causes the crash as shown on the BSOD is 'KL1.sys'.

I have VirtualBox version 2.1.2 so by the look of it the crash still happens in the latest version. This is not an inportant bug for me since I was only messing around with VirtualBox. I installed the 30 day trial of Kaspersky Internet Security 2009 including all the latest updates for Windows and for Kaspersky. Guest Additions are installed.

Was this fixed in 2.1.4? There is no sigh of bug 1778 in the change log.

If there is no changelog entry then the probability that this was already fixed is low.

Replying to frank:

If there is no changelog entry then the probability that this was already fixed is low.

Any idea if it is in the queues for 2.1.6 (or whatever they are calling the next release)?

Kaspersky Internet Security 2009 (trial version) seems to be happy here.

I confirm that the bug is fixed with VirtualBox 2.2.0

Thanks for the feedback!

Dudes! Guys! This is NOT fixed. Windows XP Pro SP3 and kis8.0.0.506en.exe will only boot up if you turn off VT-x support. And at that it runs like poop (slow, freezes up a lot).

Please fix VT-x support before closing this bug.

Running KAVremover9.exe (in safe mode) and reverting to kis7.0.1.325en.exe for now.

Many thanks, -T

It works here, so some more information is required. VBox.log of such a session and exact Kaspersky version would be helpful.

Reproduced freezing here, thanks.

Replying to sandervl73:

It works here, so some more information is required. VBox.log of such a session and exact Kaspersky version would be helpful.

2) The exact version is kis8.0.0.506en.exe or Kaspersky Internet Security suite Version 8.0.0.506 "english". You can download it from: http://www.kaspersky.com/kis_latest_versions http://www.kaspersky.com/kis_latest_versions?downlink=206910253

1) Please give me exact directions on how to harvest this log (how to clear out the old stuff, where it is located, what format you want it in, etc.).

-T

XP-Pro-SP3, kis8.0.0.506en.exe with VT-x crash log

XP SP3 on Vista X64, kis8.0.0.506de.exe

8.0.0.506 PL (on request by forum user "hiryu")

I have same problem.

VirtualBox 2.2.2 hosted on Ubuntu 9.04 jaunty (official public release) with a Windows XP Pro SP3 guest. Kaspersky (KIS) 8.0.0.506.

Since installing KIS the WinXP guest has become unusable. It just hangs immediately after booting up, with max CPU. Cannot even turn KIS off as it does not respond.

I'll probably trash my WinXP guest and start again with a clean install, only this time I'll take a VirtualBox snapshot before installing KIS. :-)

This bug is affecting my ability to give good tech support to my customers who have purchased Kiss8 from me. Since this is affecting my business, would the developers please consider upping the priority on this?

Many thanks, -T

For anyone moving from Windows to Linux there are almost always going to be Windows applications that they need to continue using, at least for a while. Wine is a solution for some apps but running a virtualized Windows guest [in VirtualBox] may be the only solution for some. I certainly have an app that just won't work in Wine and for which there is no Linux alternative.

If I could run my Windows guest offline that would be a solution. Unfortunately the app needs network access.

Given the above, those same people need the same system security that they had in Windows, in my case the ability to run Kaspersky Internet Security. I've seen similar problems reported for other antivirus software on a Windows guest, e.g. Symantec.

So, this is a serious problem.

I'd consider using a different antivirus if that were possible. Does anyone know of an Internet security app / antivirus that works OK in a Windows XP SP3 guest running in VB on Linux?

Hi Thomas,

Kaspersky version 7 runs fine.

http://www.kaspersky.com/kis_previous_versions

-T

This bug is getting close to a year old (2008-06-26). It is a total pain in the neck! Is there any chance of this being fixed in 2.2.4? This is affecting my business.

ToddAndMargo?, please use more correct language. It wouldn't help showing your emotions here, if you will us pay for our work - it may affect our priorities. Shouting won't.

This isn't fixed in 2.2.0, 2.2.2 and 2.2.4. I have exact the same issue like described above with Kaspersky 2009.

Still happens with 3.0.0 Beta 1.

[quote]2008-12-26 11:18:03 changed by wordmonger ¶

I'm afraid not since the RDPMC x86 instruction still causes an exception.

We (Kaspersky Lab) can disable certain features of KAV/KIS and not use RDPMC on Virtual Box to avoid the crashes, but to do it, we need a reliable way of detecting Virtual Box "from within". Any ideas?/quote

I know that if I look at the bios memory starting at b0000 (video memory) that VirtualBox is shown up there (video card). Perhaps you could use that info? You'll need to see exactly the offset where "VirtualBox" shows up and might have problems with priveledges. I am not sure how you would look at this as it's probably protected memory. Just a suggestion.

From: http://forums.virtualbox.org/viewtopic.php?f=15&t=19292&p=83392#p83392 [quote="sandervl"]... I'll have more time for 3.0.2. Remind me in case I forgot/quote

Hi Sandervl,

3.0 just got announced. Nag, Nag, Nag :-)

Also, Kaspersky announced version 9 (2010): http://www.kaspersky.com/kis_latest_versions

-T

Kaspersky Internet Security version 9 works fine here (XP SP2 guest; VT-x). Trying version 8.0.0.506 next.

Reproduced high cpu load with version 8. Only happens without nested paging here (I have a Core i7 CPU). Investigating.

Ok, found and fixed the problem. Performance is normal now. Fix will be included in 3.0.2, which shouldn't be that far off.

Hi guys!

Today I've installed VB 3.0.0 r49315 in my Vista Ultimate x64. I've created a VM with WinXP SP3, and tried KIS 2009 8.0.0.517/506 and KIS 9.0.0.463 CF1 (beta) and IN BOTH CASES, after a few minutos 2 or 3 of working VB got hunged.

My base system ins a Pentium IV 3,4 Ghz / 4 GB RAM DDR2 800 Mhz.

Any idea? Some months ago I tried an older VB (I think 2.1.2 versión)with a KIS and my virtual XP hunged too.

Any idea?.

Regards.

Replying to harlan4096:

Today I've installed VB 3.0.0 r49315

Yes: see comment #52. Wait for 3.0.2, where to patch will reside. Then test and report.

-T

Replying to ToddAndMargo:

Replying to harlan4096:

Today I've installed VB 3.0.0 r49315

Yes: see comment #52. Wait for 3.0.2, where to patch will reside. Then test and report. -T

Ok, thanks, I saw that comment, but I thought maybe It was maybe a different problem.

Regards.

Windows XP starts further but still hangs shortly after start with Kaspersky 2009 and high cpu usage.

I am using 3.0.2. Can anyone confirm this?

It still doesn't work on 3.0.2 (Windows Vista host, Windows XP SP3 host, KIS 9.0.0.463, VT-x is not available). System first hangs for some time, and later it starts working but KIS is not accessible (i.e. unable to open KIS window). KIS functions are not available (grayed) in Windows Explorer as well.

Replying to unggnu:

Windows XP starts further but still hangs shortly after start with Kaspersky 2009 and high cpu usage. I am using 3.0.2. Can anyone confirm this?

Yes. VBox 3.0.2, Host: CentOS 5.3, Guest: XP-Pro-SP3. Kaspersky Work Space Security (kav6.0.3.837_winwksen.exe). The corporate edition this time. It now has drags and dead stop since the upgrade. Very annoying to have the mouse stop activating buttons and typing stop every three minutes or so.

Work around (not a good one): send a <ctrl><alt><delete> from the "Machine" pull down.

-T

Hi All,

I have a machine I need to update to 3.0.2. Does anyone know if Kaspersky version 7 still runs on 3.0.2? http://www.kaspersky.com/kis_previous_versions. It does under 2.2.4.

-T

VB 3.0.2 doesn't work either with KIS 9.0.0.463 CF1, my virtual XP hunged again ... bug still not fixed.

Regards.

It is working fine with VT-x here. If you report a problem and don't supply a VBox.log then I can't help you unfortunately.

Replying to sandervl73:

It is working fine with VT-x here. If you report a problem and don't supply a VBox.log then I can't help you unfortunately.

Attaching log file ...

Regards.

Problem with KIS 2010 463 CF1 beta & VB 3.0.2

Replying to ToddAndMargo:

Hi All, I have a machine I need to update to 3.0.2. Does anyone know if Kaspersky version 7 still runs on 3.0.2? http://www.kaspersky.com/kis_previous_versions. It does under 2.2.4.

Yes. KIS 7.0.1.325 on WXP Pro SP2 on VBox 3.0.2 on ubuntu 8.04.2.

Hello :-)

Workaround becoming unavailable?

The workaround for this problem -- of using KIS 7 -- is becoming unavailable.

My license is soon to run out so I bought a two year extension only to find it cannot be used on KIS 7. Error message: "This key is not for this application". support@kaspersky.com wrote "About the key problem, each area have itself solution, therefore you'd better contact the local agent/sales or local technical support for help". So I wrote to kaspersky.ie.cs@digitalriver.com asking for an activation code to extend the KIS 7 license but have had no reply > 96 hours later :-(

Best

Charles

Hello :-)

Replying to Serpardum

I know that if I look at the bios memory starting at b0000 (video memory) that VirtualBox is shown up there (video card). Perhaps you could use that info? You'll need to see exactly the offset where "VirtualBox" shows up and might have problems with priveledges. I am not sure how you would look at this as it's probably protected memory. Just a suggestion.

Any progress with that idea, Kaspersky? This bug is more than a year old so either intractable or a low priority for VirtualBox -- so a workaround by Kaspersky would be very welcome.

Best

Charles

Replying to catkin:

Hello :-) Workaround becoming unavailable? The workaround for this problem -- of using KIS 7 -- is becoming unavailable. Charles

Hi Charles,

The keys I sell work with 7, 8, and the unreleased 9. It all depends on how your create the key. Unfortunately, I only sell locally. But, all is not lost, you can contact my supplier and they will gin up a key that will work for you: http://www.useice.com/ 913.268.3250 They are very, very nice people, which is why I use them.

HTH, -T

Replying to ToddAndMargo:

Hi Charles, The keys I sell work with 7, 8, and the unreleased 9. It all depends on how your create the key. Unfortunately, I only sell locally. But, all is not lost, you can contact my supplier and they will gin up a key that will work for you: http://www.useice.com/ 913.268.3250 They are very, very nice people, which is why I use them.

Thanks Todd :)

Thanks for confirming that it is possible to create a key for KIS 7 and suggesting ICE Systems. I'll contact them.

<rant> I'm getting nowhere fast with Kaspersky themselves on this. support@kaspersky.com said it is not a technical issue and referred me to http://www.kaspersky.com/customer_care_cente where it says "for orders placed on or after June 18, 2009, Kaspersky Lab eStore is supported by our trusted e-commerce partner - Digital River." so I wrote to kaspersky.ie.cs@digitalriver.com who took 3 days to reply saying they couldn't find my order despite being given the order reference and activation key. Don, on http://forum.kaspersky.com/index.php?showtopic=126784 suggested contacting Kaspersky via http://www.kaspersky.com/in/contacts (I live in India) which gives sales_india@kaspersky.com for non-technical email but Kaspersky's mail server bounced that address. The story continues ... </rant>

Best

Charles

Hello :-)

Update: the good news is that Kaspersky did issue an activation code for Kaspersky Internet Security 7.

The bad news is <rant>I still haven't had a response from Digital River, despite sending them a .pdf of the paid invoice</rant>. ICE systems were helpful but wanted me to buy another license. It was an email to info@kaspersky.com that produced the activation code along with an explanation that the reason the "customer care center was unable to help you is that you purchased the license through our Indian estore".

Best

Charles

Could you please move the license discussion to the forum? I know you mean well, but it makes the ticket harder to read. Thanks.

Replying to sandervl73:

Could you please move the license discussion to the forum? I know you mean well, but it makes the ticket harder to read. Thanks.

I'm sorry -- I did mean well. For users, bug workarounds can be as important, perhaps more important, than the bug itself, so I thought the license position useful here as well as on the Kaspersky forum. In retrospect I should have waited for the position to be determined before posting any relevant summary here. The position was determined in my last post which would have been my last on the subject.

Replying to catkin:

Replying to sandervl73:

Could you please move the license discussion to the forum? I know you mean well, but it makes the ticket harder to read. Thanks.

I'm sorry -- I did mean well. For users, bug workarounds can be as important, perhaps more important, than the bug itself, so I thought the license position useful here as well as on the Kaspersky forum. In retrospect I should have waited for the position to be determined before posting any relevant summary here. The position was determined in my last post which would have been my last on the subject.

sandervl73, I'm sorry some more and think it's worth adding another reply to say so. I added inappropriate material to this bug report and responded defensively to your gentle message saying so. Sorry. Lesson learned. Bug reports are not BBS threads.

I'm having crashes/hunging system in my virtualized WINXPSP3 + KIS 2010 9.0.0.463.

After some seconds of being started, the system hungs ... and I have to stop/force to stop the virtual machine sesion.

I provide logs of my VB.

Regards.

Windows XP hungs (KIS 2010 9.0.0.463)

Same here. WinXP SP3. Kaspersky 2009. Logs attached below. Summary: windows gets progressively slower, especially when running apps. That seems to speed up the time until it halts.

But KIS 2010 9.0.0.736 is working fine here in VB 3.0.10 and even in 3.0.8 worked fine.

Regards.

Summary:

WinXP Pro SP3 VM hangs with Kaspersky 2009 (specifically kav8.0.0.523en.exe) and GA installed
Related ticket: #4974

Host:

9.10 w/ 2.6.31-14 64-bit kernel w/ VirtualBox 3.0.10r54097 and VirtualBox 3.0.12r54655 (Both versions are having the same issue)

Guest:

WinXP Pro SP3 32-bit w/ Guest Additions, Kaspersky 2009, VT Enabled, 512MB RAM, 10GB disk