VirtualBox 4.3.14 can't start VMs on certain Windows hosts

[AxelFontaine]

Both new and existing VMs cannot be started with VirtualBox 4.3.14 under Win 8.1 x64. Double-clicking on a stopped VM in the GUI gives a popup containing CLI arguments and a message that it failed. Vagrant is broken too. Restarting the system does not fix the issue. Uninstalling and reinstalling 4.3.14 does not fix the issue.

The only fix is to uninstall and reinstall 4.3.12.

[yesoos]

This issue was already noticed in 4.3.14 RC1:

​https://forums.virtualbox.org/viewtopic.php?f=15&t=62557 ​https://forums.virtualbox.org/viewtopic.php?f=15&t=62556

Comment that explains this behavior from Frank Mehnert:

"The problem is not the virus scanning engine but the habit of virus scanners to map certain DLLs into Windows processes. VirtualBox 4.3.14 has extended hardening features which may conflict with virus scanners. We did several tests but obviously didn't catch every case. The final 4.3.14 release contains more fixes in this regards but I've read in other topics that certain users have still problems :-("

I'm also having the same issue in final version

[pquiring]

I'm having the same issue on all my systems. One is Win7 x64 and another is Win8 x64. Neither has anti-virus installed (Chrome is my AV). I've gone back to 4.3.12 in the mean time.

[AxelFontaine]

Some here. No AV installed.

[pquiring]

I uninstalled and reinstalled and now it work.

[Frank Mehnert]

Using this ticket as a collection of information. Similar problems reported by other users in tickets #13189, #13193, #13196, #13198, #13200, #13201, #13206, #13208, #13217, #13219.

[Frank Mehnert]

A few general information about this problem with VBox 4.3.14: ​https://forums.virtualbox.org/viewtopic.php?f=25&t=62618

Only VBox on Windows is affected. We are working on releasing an update ASAP but this update should contain fixes for as many setups as possible. Therefore the more detailed information you provide, the better the chance to get your setup considered in the fixed version. Thank you!

[Frank Mehnert]

For all affected users, here is a test build which has the following improvements:

• Startup time, especially the VM selector.
• Issues that the DISABLEUSERCALLBACKEXCEPTION registry change fixes
• supR3HardenedWinReSpawn error -104.
• Norton Endpoint Protect / sysfer.dll

Any feedback is welcome!

[Frank Mehnert]

Please keep in mind that this test build will not fix yet all known problems, only the listed problems above!

[msayed1977]

My issue (#13206) got better, but VM still doesn't start with the test build.

[Frank Mehnert]

msayed1977, could you be more specific? Could you post the error message you see now?

[Frank Mehnert]

Oh sorry, missed #13206.

[Frank Mehnert]

Still, please post the screen shot of the current error message.

[nocnokneo]

VirtualBox-4.3.15-95171-Win.exe fixes the first problem that I was having with 4.3.14 (I wasn't able launch VirtualBox Manager at all), but I get the BSOD when launching my VM.

To help characterize the problem, assuming my issue is virus scanner related, this is what I'm running:

• Windows 7 64-bit
• McAfee Host Intrusion Prevention 8.0
• McAfee Agent 4.6.0.3122
• McAfee VirusScan Enterprise 8.8.0.849
• McAfee Endpoint Encryption Agent 1.2.1.315
• Endpoint Encryption for PC 6.2.1.315

[msayed1977]

I get the following message:

Failed to open a session for the virtual machine Win98SE.

The virtual machine 'Win98SE' has terminated unexpectedly during startup with exit code 1.

Result Code: E_FAIL (0x80004005) Component: Machine Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

The good thing is that I no longer get the error dialog box attached to ticket #13206. Previously, I got the mentioned message after the error dialog box.

[bird]

New build available: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95226-Win.exe

This should hopefully fix some of those E_FAIL issues. For more details see: ​https://forums.virtualbox.org/viewtopic.php?f=6&t=62615&p=294202#p294202

[yesoos]

This new build does the trick with starting for me (win 8.1 x64, Kaspersky Internet Security 2014). Though VMs seem starting up slower than they did.

[msayed1977]

VirtualBox-4.3.15-95226-Win works for me, but I think seams to start VM and Windows slower than VirtualBox 4.3.12 did.

BTW, I use Kaspersky Internet Security 2015, but I am disabling protection.

[MaxR]

VirtualBox-4.3.15-95226-Win works for me, too, but I need to disable USB controller to start VMs because I do not have the corresponding extension pack. That still prevents some Windows VMs to load because I have a USB mouse. The original error seems to have been resolved, though. I am using Kaspersky Internet Security 2014 with protection enabled. Thanks.

[msayed1977]

Replying to MaxR:

VirtualBox-4.3.15-95226-Win works for me, too, but I need to disable USB controller to start VMs because I do not have the corresponding extension pack. That still prevents some Windows VMs to load because I have a USB mouse. The original error seems to have been resolved, though. I am using Kaspersky Internet Security 2014 with protection enabled. Thanks.

I think the test version can work with the extension pack of VirtualBox 4.3.12.

[SquirrellyOne]

extension pack error

[SquirrellyOne]

The 95226 build also seems to have eliminated my errors. I was getting that "terminated unexpectedly" error. My system consists of a Windows 8.1 host running on an Intel J2900 processor with McAfee firewall/virus protection. The Windows XP guest is now running, although there are still glitches I am trying to address. As part of that process, I have attempted to install the extension pack 4.3.14-95030, but I keep getting errors on attempting that, which I mention here because it includes an e_fail like the ones mentioned above. I have attached a picture of the error to this ticket. However, I cannot figure out how to get it to display in this box. Let's see if this works: If it doesn't, check the attachments list or the post right before this one. Anyway, the 95226 build did fix my initial errors.

[GRA]

Error E_FAIL, Build 95226, Comodo AV

[GRA]

Build 95226, Comodo AV, Startup Log

[GRA]

Build 95226 fixes startup error (Failed to install NtCreateSection monitor) when using Comodo AV.

However, when starting a VM in build 95226, error E_FAIL:

Attached VBoxStartup.log

Windows 8.1 x64 + COMODO 7.0.317799.4142 (enabled or disabled, same error)

[bird]

New test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe Should address the E_FAIL / exit code 0xc0000005 issue with Avast! and hopefully some others AV vendors.

Enjoy,

bird.

[smilzo]

Replying to bird:

New test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe Should address the E_FAIL / exit code 0xc0000005 issue with Avast! and hopefully some others AV vendors.

Enjoy,

bird.

Windows 7 pro x64 with Comodo AV 7.0.317799.4142 working, but I cannot start some VM with saved state cause the "Implementation of the USB 2.0 controller non found!" error, and I cannot disable the USB with the saved state (extension 4.3.12). Updated extension to 4.3.14.95030 and it's ok.

[André Filipe Azevedo Sousa]

Replying to smilzo:

Replying to bird:

New test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe Should address the E_FAIL / exit code 0xc0000005 issue with Avast! and hopefully some others AV vendors.

Enjoy,

bird.

Windows 7 pro x64 with Comodo AV 7.0.317799.4142 working, but I cannot start some VM with saved state cause the "Implementation of the USB 2.0 controller non found!" error, and I cannot disable the USB with the saved state (extension 4.3.12). Updated extension to 4.3.14.95030 and it's ok.

Is working with Windows 8.1 Enterprise (64 bits) and Trend Micro.

[Shevchik]

I have BSOD with https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe, when i start guest VM =(( Win7 SP1 x64 Error code 0x0000003b (0x00000000c0000005, 0xfffff88005561c77, 0xfffff88008ae4c50, 0x0000000000000000)

[msayed1977]

I tried the test build, and there is a problem in mouse capturing.

[Flux]

When trying to launch a VM, I get a popup saying "Failed to create a new session." with the following details: [Callee RC: REGDB_E_CLASSNOTREG (0x80040154)]

"Then an additional popup saying "Failed to open a session for the virtual machine MACHINE_NAME. The virtual machine 'MACHINE_NAME' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in X:\MACHINE_LOCATION\MACHINE_NAME\Logs\VBoxStartup.log"

with the following details: [Result Code: E_FAIL (0x80004005) Component: Machine Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}]

I have posted my log here: ​https://paste.ee/r/7ySsH

When exiting VirtualBox after this failure, I get a popup saying "Runtime Error! Program: C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe R6025 -pure virtual function call"

If any other info is required, please contact me directly at kronflux@g mail.com

[northpole]

Error opening VirtualBox on Windows 7 64 bit with Kaspersky Internet Security

[northpole]

I am having similar problem with VirtualBox-4.3.14-95030-Win.exe. After installing the new version, when the application is opened from start menu or desktop icon, I get the following error. Not able to even open the app GUI, forget the VMs. Running on:

• Windows 7 64 bit.
• Kaspersky Internet Security v14.

[paul-sh]

Replying to bird:

New test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe Should address the E_FAIL / exit code 0xc0000005 issue with Avast! and hopefully some others AV vendors.

Enjoy,

bird.

4.3.15-95286 fixed the "supR3HardenedWinReSpawn error -104" problem for me. Windows 7 x64

-- Paul

[72gab]

I am having the same problem when Sysmon is installed from ​http://technet.microsoft.com/en-us/sysinternals/dn798348

Edit: Build 4.3.15-95286 fixed this problem.

[Petr Vones]

Same issue with 4.3.14, Failed to verify process integrity ... Windows 7 x64 host, no third-party AV or firewall installed. Reverted back to 4.3.12.

[Eric McIntyre]

Same issue -- Win 7 Pro, using ESET NOD32 Antivirus 4. Build 4.3.15-95286 also fixed it for me.

[AZ]

4.3.15r95286 still broken for me (Win7 x64, AV tools installed) with an E_FAIL. Critical log section is:

183c.cd8: supR3HardenedWinDoReSpawn(1): New child 15d0.1a80 [kernel32].
183c.cd8: supR3HardenedWinPurifyChild: PebBaseAddress=000007fffffd6000 cbPeb=0x380
183c.cd8: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077070000 uNtDllChildAddr=0000000077070000
183c.cd8: supR3HardNtPuChTriggerInitialImageEvents: pvLdrInitThunk=000000007709c340 pvNtTerminateThread=00000000770c17e0
183c.cd8: Error (rc=-5640):
183c.cd8: More than one thread in process

[AnrDaemon]

VirtualBox-4.3.15-95286-Win

Dr.Web 8

       Dr.Web for Windows 
        Dr.Web for Windows (8.2.1.08220) 

       Dr.Web (R) Virus-Finding Engine 
        drweb32.dll (7.00.9.04080) 

       Dr.Web Scanning Engine 
        dwengine.exe (8.3.0.10280 (Build 9476)) 

       Dr.Web Anti-Rootkit Server 
        dwarkdaemon.exe (8.3.0.10280 (Build 9476)) 

       Dr.Web Anti-rootkit API 
        dwarkapi.dll (8.6.0.20138190) 

       Dr.Web Windows Action Center Integration 
        dwsewsc.exe (9.0.4.10280 (Build 10027)) 

       Dr.Web Control Service 
        dwservice.exe (8.1.0.04300) 

       Dr.Web Updater 
        drwupsrv.exe (8.0.6.10170) 

       SpIDer Agent for Windows 
        spideragent.exe (8.1.1.05122) 

       SpIDer Agent admin-mode module for Windows 
        spideragent_adm.exe (8.1.1.05122) 

       Dr.Web Scanner SE 
        dwscanner.exe (8.3.0.08070) 

       Dr.Web Console Scanner 
        dwscancl.exe (8.3.0.10280 (Build 9476)) 

       Dr.Web File System Monitor 
        spiderg3.sys (8.0.3.01110) 

       Dr.Web Protection for Windows 
        dwprot.sys (8.1.0.01173) 

       Net filtering service 
        dwnetfilter.exe (8.0.7.07121) 

       Dr.Web Net Filter® for Windows driver 
        dw_wfp.sys (8.0.0.08150) 

       Dr.Web ® Shell Extension 
        drwsxtn.dll (8.00.1.201309020) 

       Dr.Web SysInfo 
        dwsysinfo.exe (7.00.3.201204270) 

Unable to launch managing interface. It just doesn't come up. After adding VBoxSVC.exe and VirtualBox.exe to the exclude list, it sometimes start, sometimes not. Often coming with errors described above, i.e.

Waiting for VM "Windows 7" to power on...
VBoxManage.exe: error: The virtual machine 'Windows 7' has terminated unexpectedly during startup with exit code 1 (0x1).  More details may be available in '%USERPROFILE%\VirtualBox VMs\Windows 7\Logs\VBoxStartup.log'
VBoxManage.exe: error: Details: code E_FAIL (0x80004005), component Machine, interface IMachine

but more often it throws a system popup "unable to read from 00000000, call from 00000000".

I don't think zeroing out own process memory serves any good, do you?

Also, FIVE MEGA BYTES of

7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\MirandaIM\Plugins\WinampNotify.dll' (fImage=0 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\MirandaIM\Plugins\WinampNotify.dll' (fImage=1 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\Punto Switcher\pshook.dll' (fImage=0 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\Punto Switcher\pshook.dll' (fImage=1 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\RocketDock\RocketDock.dll' (fImage=0 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\RocketDock\RocketDock.dll' (fImage=1 fExecMap=1 fExecProt=1)

spam in the logs. Really, keyboard switcher/notificator? Now playing plugin? What you are shielding against?... And WHY it crashes at all? You're not antimalware program. Notify the user, and carry on. It's not your responsibility to judge operating system decisions.

[Petr Vones]

I am also wondering what is the feature for ? Providing digitally signed executables is enough from vendor (VirtualBox) side to achieve meaningful level of security. Anything else is user's responsibility. I have no third-party AV (default Windows Defender with disabled real-time protection) and default Windows Firewall. Still having the issue, probably caused by a Lenovo utility or Bluetooth software that hooks into processes.

I am not going to use the 4.3.15 beta because ​there is a report of host BSOD in VBoxDrv.sys.

Please revert it back or make the "verify feature" optional or less intrusive.

Replying to AnrDaemon:

You're not antimalware program. Notify the user, and carry on. It's not your responsibility to judge operating system decisions.

[Ramshankar Venkataraman]

Replying to Petr Vones:

I am also wondering what is the feature for ? Providing digitally signed executables is enough from vendor (VirtualBox) side to achieve meaningful level of security.

Sorry, we are not allowed to provide more details than what's already available here: ​http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

However, I believe Oracle customers may request additional information through existing support channels.

We -are- actively working on fixing this issue pertaining to VirtualBox 4.3.14 and we hope to get in under control soon.

Until then, please continue using 4.3.12 or if you're willing to help out with testing our fixes (we'd much appreciate that), try our the latest test builds from this thread on the forums: ​https://forums.virtualbox.org/viewtopic.php?f=6&t=62615 and provide sufficient, relevant feedback. Thanks!

[Petr Vones]

Thanks, I see. I will wait whether the related CVEs are disclosed, just wondering what is the issue technically. Still can't think of a scenario where VirtualBox process running under limited user account and properly adjusted Software Restriction Policy can be "altered" on image/IAT level. Elevation of privilege via guest additions (CVE-2014-2477) is a different story.

Hope you can resolve it.

Replying to ramshankar:

Sorry, we are not allowed to provide more details than what's already available here

[bird]

Hi all!

Here is a new test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95599-Win.exe

The major fixes since the last test build are:

• The VM processes should start up a bit faster now (at least they do here).
• We've tweaked the way we validate loading of 3rd party DLLs into the process. Must be installed normally and the DLL or their package must be correctly signed. Should help with nvidia detour.dll and a whole bunch of others, we hope. (We won't ever load DLLs without any kind of valid signature.)

Sandboxies users: Don't run VBox in a sandbox, it won't work. Run VBox outside Sandboxie.

We'll be looking closer at the remaining AV issues shortly.

Enjoy, bird.

[AliveNoMore]

The latest build (4.3.15-95599) improves things a little compared to the official 4.3.14 but VMs still don't start here. I haven't tested the rest of the test builds. The error is this:

OS is Windows 8.1 x64 and is completely up-to-date. The only security application installed is Sandboxie but VirtualBox isn't and has never been run inside Sandboxie.

[AnrDaemon]

We've tweaked the way we validate loading of 3rd party DLLs into the process. Must be installed normally and the DLL or their package must be correctly signed.

Translation from technobabble to normal language: "Great news, everyone! We've invented a way to stop individual developers from making useful programs for windows! Who need those losers, when you have a great Oracle, anyway?"

Just to list a few applications, that your stupid "protection" conflict with:

1. Download manager (clipboard and shortcut hooks to catch URL's)
2. Keyboard indicator/switcher. Hotkey hook and more stuff related to layouts and languages. You there in america seems to think that whole world should use one language and be happy? This not gonna work. I use 3 languages and 4 keyboard layouts, and "standard" ways of switching between them doesn't even begin to help.
3. Dictionary/translator program. Shortcut keyboard hook. Terrible as translator, but kinda fine as a dictionary. Faster, than online dictionaries, at least. And it's right on my fingertips.

None of these programs will see updates (companies that made first and last are closed, and developer of second had passed), and there's no replacements that equal the clean utility of them. If I ever to program something to replace them myself, I won't be able to sign them either. Time to find a better virtualization software, it seems. That does not conflict with operating system...

[Frank Mehnert]

The Windows design allowing normal applications to mess with libraries of other applications is stupid. VirtualBox is a system application for running virtual machines next to normal processes. For doing this, it needs to use special system interfaces. You don't want to allow normal applications to hook libraries into such a VM process, believe me.

[DKHR77]

I suggest to implement an additional list of trusted libraries where the vbox user can add such libraries that the hardening feature cannot handle correctly.

The list should be stored encrypted on disk and include hashes for the libraries that the user has trusted explicitely (e.g. by message box "Would you like to trust....Yes/No, Default=No). As long as the hashes still match the tested library, the hardening feature should not raise an error.

[AliveNoMore]

Just to be clear here. At least in my case, the error occurs without any 3rd party libraries loaded/mapped into the process. I checked VirtualBox.exe with Process Explorer and ALL library files loaded belong to either Microsoft or Oracle, nobody else.

[vant]

I had all the .dll errors with 4.3.14 and I have installed the new Test release 4.3.15 and I didn't get the error but only Win 8 and Win 2012 guests couldn't not complete their loading and stuck at a blank screen. While Win 2008 R2 and Linux guests worked fine. I had to roll back to a stable release 4.3.12 and all guests worked fine. My host is Win 7 and my AV is MS Security Essentials.

[msayed1977]

VirtualBox-4.3.15-95599-Win.exe test build does not start VM for me.

VirtualBox-4.3.15-95286-Win.exe test build worked fine for me.

[Frank Mehnert]

msayed1977, any VBoxStartup.log file for the failing attempt available? Thanks!

[yesoos]

Replying to bird:

Hi all!

Here is a new test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95599-Win.exe

The major fixes since the last test build are:

• The VM processes should start up a bit faster now (at least they do here).
• We've tweaked the way we validate loading of 3rd party DLLs into the process. Must be installed normally and the DLL or their package must be correctly signed. Should help with nvidia detour.dll and a whole bunch of others, we hope. (We won't ever load DLLs without any kind of valid signature.)

Sandboxies users: Don't run VBox in a sandbox, it won't work. Run VBox outside Sandboxie.

We'll be looking closer at the remaining AV issues shortly.

Enjoy, bird.

Latest build speeds up startup time for me, no issues with VM startup found. (Win 8.1 x64 host with KIS 2014 latest installed)

[msayed1977]

My startup log

[msayed1977]

Strange thing:

Without any reasonable reason, VirtualBox-4.3.15-95599-Win.exe works now.

I do not know whether my attached file was for the failing or successful startup.

The problem with mouse capturing is still there especially with non-fullscreen mode.

The non-fullscreen mode is not well-sized.

[bird]

Hi All!

The 5th test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95663-Win.exe Compared to the 4th:

• Fixed the -104 respawn errors (still) seen with several AV products.
• Fixed timing problem with the Avast workaround.
• Worked around symantec endpoint protection import table patching bug resulting in: "@!#$%&%!.dll is missing from your system"
• Attempt at curing the sysfrethunk.dll issue (unable to reproduce here).

Please remember to attach an VBoxStartup.log if you want help with your problem. For instance the that div/zero needs more data before I can say whether it has anything to do with the topic here or is a different bug/regression.

Enjoy,

bird.

[AnrDaemon]

Replying to frank:

The Windows design allowing normal applications to mess with libraries of other applications is stupid.

That's your own, subjective opinion.

I, for one, find it convenient, that I do not need to use root privileges to debug application I work with.

VirtualBox is a system application for running virtual machines next to normal processes.

VirtualBox is a complex of aplications. And it's core is a service, which is not run with normal user credentials (and a "normal user" can do very little about it). Not to mention, you gotta find a way to escape DEP first.

For doing this, it needs to use special system interfaces. You don't want to allow normal applications to hook libraries into such a VM process, believe me.

Believe it or not, you have only two options: play by system rules or be deleted from hard disk. A home could only have one owner. If I said "this program is fine", you have no rights to second-guess my decision. This. Is. My. System. Period.

I have enough issues with antivirus software I use, it gives me regular headaches that I report to developers and have constructive discussion with them.

Doesn't bother me much, as it gets better with each bug squashed. But one is enough. Two programs trying to pretend to be "antivirus solutions" will just not work together.

I said it already, but here it is once more: If you suspect something is amiss, report it to the user. You just can't know, what Windows loader will do with your relocation tables to blindly zeroing your process memory. Reads from address 00000000 will never be successful, mind you.

[bird]

msayed1977, I've had a look at your logfile (VBoxStartup.3.log). Looks like your windows\system32\user32.dll isn't owned by TrustedInstaller as we expect, but the group Admins. The next test build (6th) will be include a fix for this. Thanks very much for the report.

AnrDaemon, this isn't a discussion forum. While I personally share your opinion about your PC being yours, the security researchers doesn't. These annoying changes we've made to VirtualBox on Windows are in response to reports from these guys. Oracle policy does not allow us to discuss the details, though a summary can be found in the july2014 oracle critical patch update: ​http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html#AppendixOVIR

[yesoos]

vbox.log, linux mint failing after latest upgrade

[yesoos]

Replying to bird:

Hi All!

The 5th test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95663-Win.exe Compared to the 4th:

• Fixed the -104 respawn errors (still) seen with several AV products.
• Fixed timing problem with the Avast workaround.
• Worked around symantec endpoint protection import table patching bug resulting in: "@!#$%&%!.dll is missing from your system"
• Attempt at curing the sysfrethunk.dll issue (unable to reproduce here).

Please remember to attach an VBoxStartup.log if you want help with your problem. For instance the that div/zero needs more data before I can say whether it has anything to do with the topic here or is a different bug/regression.

Enjoy,

bird.

In latest version when starting linux mint guest (win 8.1 x64 host with kis 2014) I get software exception (0xc00000094) in location 0x4252af9f. Log file attached. This does not happen instantly, only after you try to log on guest machine.

[yesoos]

Replying to yesoos:

Replying to bird:

Hi All!

The 5th test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95663-Win.exe Compared to the 4th:

• Fixed the -104 respawn errors (still) seen with several AV products.
• Fixed timing problem with the Avast workaround.
• Worked around symantec endpoint protection import table patching bug resulting in: "@!#$%&%!.dll is missing from your system"
• Attempt at curing the sysfrethunk.dll issue (unable to reproduce here).

Please remember to attach an VBoxStartup.log if you want help with your problem. For instance the that div/zero needs more data before I can say whether it has anything to do with the topic here or is a different bug/regression.

Enjoy,

bird.

In latest version when starting linux mint guest (win 8.1 x64 host with kis 2014) I get software exception (0xc00000094) in location 0x4252af9f. Log file attached. This does not happen instantly, only after you try to log on guest machine.

Same issue with CentOS 7 guest.

[AliveNoMore]

My error didn't mention any log file. What should I upload then?

[Scott Hankin]

Log for Ubuntu 14.04 guest, Win7 host, build 95663

[Scott Hankin]

Ubuntu 14.04 guest, Win7 host, build 95663

[Scott Hankin]

The exception Integer division by zero. (0xc0000094) occurred in the application at location 0xda02af9f.

Running Windows 7 64 with Symantec Endpoint. I see the same failure running my Ubuntu 14.04 x64 guest as yesoos mentioned in comment 52. I've attached the Vbox.log and VboxStartup.zip.

I've moved back to the 95286 build, the last one I could successfully boot.

[Scott Hankin]

BTW, uninstalling 95663 requires force closing by the uninstall process of the VirtualBox Interface, followed by a mandatory reboot.

[bird]

Here's a new test build, the 6th: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95713-Win.exe

Fixes compared to the 5th:

• Fixed 3D regression that often manifested itself as a zero division crash.
• Relaxed ownership requirements a little to allow Tumbleweed Desktop Validator CAPI dlls to load. (DLL owner must be TrustedInstaller or System now.)

Hope this solves the outstanding issues for most of you.

Enjoy,

bird.

[msayed1977]

In the sixth build:

When I go from windowed to fullscreen, I get the attached error.(ErrorWhenSwitchToFullScreen.png)

[AliveNoMore]

Even with the latest build I still get the same error. I have attached an archive with fresh logs (ANMLogs.zip).

[bird]

AliveNoMore: Could you attach c:\windows\system32\uxtheme.dll, please? Would also (or alternatively) be real cool if you could check what SysInternals sigcheck ( ​http://technet.microsoft.com/en-us/sysinternals/bb897441.aspx ) has to say about it: sigcheck -i -a -h c:\windows\system32\uxtheme.dll

[AliveNoMore]

If all you need to know is whether the file has been modified, I can tell you right now that I have indeed patched it with a patcher so I can use other themes. I can attach it and/or run Sigcheck if you still need more than the information I gave you.

[Valerio Messina]

in this related bug https://www.virtualbox.org/ticket/13317 the error appear on every starting of VirtualBox application, while then starting a VM work as exected.

[vmuser2014]

The latest update, build 6, does not resolve this problem for me. I can not start VMs.

• Installed: VirtualBox-4.3.15-95713-Win
• OS: Windows 7 64bit
• Virus Scanner: Microsoft System CenterEndpoint
• Also Installed: Digital Guardian from Verdasys

Error Prompt: "The instruction at 0x00030288 referenced memory at 0x00030288. The memory could not be written."

Result Code: E_FAIL (0x80004005)

[Danial]

I have found a bug in VirtualBox-4.3.15-95713-Win involving the ICH8 sata controller and mapping optical drives to drives on the host.

The bug causes the guest to crash immediately after the Oracle Virtualbox boot screen.

The issue is not present when the mapped drive is hosted on the emulated IDE controller, nor was it present in 4.3.14. It does not affect directly mounted iso's either.

edit Checking passthrough appears to make the host mapped drives work on the vbox sata controller

[AliveNoMore]

Replying to bird:

AliveNoMore: Could you attach c:\windows\system32\uxtheme.dll, please? Would also (or alternatively) be real cool if you could check what SysInternals sigcheck ( ​http://technet.microsoft.com/en-us/sysinternals/bb897441.aspx ) has to say about it: sigcheck -i -a -h c:\windows\system32\uxtheme.dll

So, will there be a fix for this problem? If not, are there any workarounds for it?

[msayed1977]

In the seventh test release:

Still makes an error and stops VM when switching from windowed to fullscreen. There are still mouse capturing problems.

[Frank Mehnert]

VBox 4.3.16 released. It should fix the problems reported in this ticket for many users. Feedback welcome!

[ScottDeagan]

Just installed 4.3.16 - I have a number of Ubuntu 14.04 Server (64 bit) guests on a Windows 8.1 host, all worked first time. Nice work, many thanks :)

Replying to frank:

VBox 4.3.16 released. It should fix the problems reported in this ticket for many users. Feedback welcome!

[AliveNoMore]

The problem I was having (presumable with the patched uxtheme.dll) is not gone, and the VM actually runs. However, it is quite slow to start: from the moment I click Start to the moment it begins to actually load the guest OS it takes a while, before it needed a few seconds.

[Fabian23]

Hi, I've just uploaded a screenshot of the error I'm having when trying to start any VM. here the details:

Failed to open a session for the virtual machine test.

The virtual machine 'test' has terminated unexpectedly during startup with exit code 1.

Result Code: E_FAIL (0x80004005) Component: Machine Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

i have Trend micro office scan enabled but it doesn't report any issues during operations. Any help? thanks

[yesoos]

Still having random "Memory could not be read" errors during VM runtime (mostly when stopping them). Latest 4.3.16 build, Win 8.1 6rbit host, KIS 2014

[Fabian23]

Replying to Fabian23:

Hi, I've just uploaded a screenshot of the error I'm having when trying to start any VM. here the details:

Failed to open a session for the virtual machine test.

The virtual machine 'test' has terminated unexpectedly during startup with exit code 1.

Result Code: E_FAIL (0x80004005) Component: Machine Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

i have Trend micro office scan enabled but it doesn't report any issues during operations. Any help? thanks

UPDATE:VBox 4.3.16 release fixed my issue!!!

[GoldieLin]

Confirmed, 4.3.16 works again.

OS: Windows 7 Pro 64bit. AntiVirus: Avira Free Antivirus.

4.3.12 works fine, 4.3.14 not worked, 4.3.16 works again.

[smilzo]

With 4.3.16 my virtual machines do not start, stuck on "Creating process for virtual machine xxx (GUI/QT) ... (1/2)"

OS: Windows 7 Pro 64bit. AntiVirus: Avast free

Replaced Avast with Comodo Antivirus and works fine. Before full O.S. reinstall, with avast installation, 4.3.14 was not working with Comodo, but solved with 4.3.15 update.

Looks like ticket #13367

[te7]

4.3.16 doesn't work on Windows 7 SP1 64 bit Home Premium host. Using Norton Internet Security 2014. 4.3.12 works fine. With 4.3.16 VMs never open, with nothing but spinning circle. Can't stop virtualbox.exe processes in task manager. Have to reboot host with power button.

[Marki555]

unable to start VM on 4.3.16

[Gabee]

VirtualBox - Error E_Fail

[Gabee]

Hi my problem this: Uninstall ad reinstall (delete .virtualbox folder and vm machine folder)VirtualBox 4.3.16 and problem not solved!

[Wouter Kariboe]

On both my main machines (ASUS motherboards with AMD processors) I get the same "exit code 1" error message as Gabee when I try to start any VM (existing and newly created ones alike).

The VBoxStartup.log I'm attaching occurred with an old DOS VM (which I haven't touched in years), but it's basically the same for all my VMs: obviously the error occurs before the state of the actual VM comes into play.

This problem was definitely introduced in 4.3.16: reverting to 4.3.14 resolves this problem.

Host OS: Windows 7 64-bit Professional + SP1 with all the latest Windows Update patches applied
Anti-virus software: none

[Wouter Kariboe]

DOS VM refusing to start with "Exit code 1"

[CED]

Win 7 64bit Host same problems

update vbox to 4.3.16 give errors

update microsoft Security Essential to 4.6.305 breaks vbox 4.3.14, vbox 4.3.12 seems safe

[Wouter Kariboe]

I've discovered that my "exit code 1" error concerned comctl32.dll, and that it is fixed by bird's "test build #1", https://www.virtualbox.org/download/testcase/VirtualBox-4.3.17-96047-Win.exe, mentioned in ​https://forums.virtualbox.org/viewtopic.php?f=6&t=63556.

With this test build #1 all things are working for me again. Thanks!

@Gabee and CED: you may want to look at the above-mentioned thread: other tests builds are available that may fix your problems too.

[Eric McIntyre]

I did a straight upgrade from the 4.3.15 test build to 4.3.16 and the problem returned. I uninstalled VirtualBox, restarted the system, and installed 4.3.16 again. After that, I was able to launch my virtual machines.

My configuration again: Win 7 Pro, ESET NOD32 Antivirus 4.

[fcporto]

I too have this problem with version 4.3.16 running on window 7 x64, but not when i downgrade to version 4.3.12. I also have avast AV running.

Is there a solution other than running 4.3.12?

Also, i am able to stop the process virtualbox.exe, which in turn prevents windows from shutting down properly; i'm forced to do a hard reset (this only happens after i try to run a VM).

[IainMD]

verify_process_integrity_error

[IainMD]

I too have an AV related error:

Failed to verify process integrity:(rc=-5662) Please try reinstalling VirtualBox.

Windows 8.1 Enterprise with Update Symantec Endpoint Protection 12.1.3001.165 VirtualBox anything newer than 4.3.12

[SWAT]

Virtualbox 4.3.16 is still broken with the same error as is detailed in this bug report. OS: Windows 7 professional, 64-bit AV: Trend Micro OfficeScan

[Frank Mehnert]

Could you check the latest Windows test build from here?

[fcporto]

Hi Frank,

The latest build (Windows, r96235 or VirtualBox-4.3.17-96235-Win) worked for me; i was able to start the VMs without any issues.

THX :)

Running windows 7 Ultimate x64 SP1 with Avast AV

[Frank Mehnert]

New test build here. This fixes some problems with NAT (see #13292) as well as a few other problems. Feedback welcome!

[Svyat]

I figured out what makes this issue to be on my system. This is because of patched system files like uxtheme.dll, setupapi.dll, kernel32.dll, msvcrt.dll. I applied several WinXP patches that brakes digital signature, but I suppose that these patches are vital: 1) UxTheme.dll patch to support unsigned themes. 2) setupapi.dll patch to disable splash of Driver Installation Wizard. 3) kernel32.dll patch to extend kernel functions like GetTickCount64 etc. 4) msvcrt.dll patch to extend msvc functions like _except_handrel4_common etc.

I think there should be some commits to skip digital signature checking for those files I have listed above.

I know that these patches are unofficial, but they are popular, lots of people are using them, specially UxTheme and setupapi patch. Also many people patching shell32.dll to change its resources and other resource depending files. So I suppose this digital signature "update" has much lower severity than failures that people may face.

[jamestdi]

latest build error

[jamestdi]

Failed integrity with older builds

[jamestdi]

Just tried the latest build 4.3.17-96342 and still get the same failure error, with the installation never completing as the rollback kicks in . I tried installing older builds (both 4.x and 3.x) and would then get the "failed to verify process integrity" error (see my attachments). Can't win.

BTW - I'm running the McAfee endpoint suite 8.0 (AV, Anti-spyware, Endpoint Encryption).

[fcporto]

I see people are still having issues, i can definitely say build 4.3.17-96235 worked for me; is there a big difference between 4.3.17-96342 and 4.3.17-96235?

[Oli Howson]

Just tried 3.1.17-96342 After trying to upgrade to 3.1.16 and getting the error:

Failed to open a session for the virtual machine Media.

The VM session was aborted.

Result Code: E_FAIL (0x80004005) Component: SessionMachine Interface: ISession {12f4dcdb-12b2-4ec1-b7cd-ddd9f6c5bf4d}

Host: Win7 x64 Client: WinXP (multiple machines tried) AVG installed / disabled.

[Frank Mehnert]

Here is a new test build. It hopefully fixes more problems. Feedback welcome!

[xorred]

Windows 8.1 Enterprise + Webroot AV - stuck on "Creating Process for virtual machine". VirtualBox 4.3.16 and your latest test image too (https://www.virtualbox.org/download/testcase/VirtualBox-4.3.17-96443-Win.exe) After reboot 1 virtual machine can start. Shut it down, start another - it says "creating process for virtual machine" forever. On reboot shows some error messages I cannot screenshot because... its on reboot.

[Svyat]

VBOX 4.3.17-96443-Win Windows Server 2003 SP2 x86 RUS (patched msvcrt.dll, kernel32.dll, uxtheme.dll, setupapi.dll) Failed to start Virtual Machine.

logs and screenshot: ​http://rghost.ru/58435042

[jandesen]

I have the same issue as xorred, except I have avast! Antivirus. My issue is more extreme in that it does not stop creating the process (even if I hit cancel), and the process will not close. If I attempt to shut down my computer the computer will not shut down because Windows cannot close the process (and thus can't shut down) so I have to power off the computer manually. This started in 4.3.14 and has persisted in 4.3.16 . One thing I have noticed is that if the video memory is set to 16 MB (the default) the VMs usually work, however anything above that causes the indefinite creating process issue. My computer can handle the 128-256MB video memory because I've never had problems with it before and nothing significant has changed about my setup. I have reintalled 4.3.16 multiple times to no avail. I'm attempting to install 4.3.17 however it keeps failing to install and the 4.3.16 uninstaller says it works but doesn't actually do anything.

[fcporto]

@ jandesen....go with version 4.3.17-96235....it works

[jandesen]

4.3.17-96342 fixed the problem for me

[Frank Mehnert]

VBox 4.3.18 contains the latest fixes.

[xorred]

4.3.18 does not fix anything for me. Same as above, same as the jandesen issue plus more info - I started 3 VMs in parallel (after upgrading and rebooting) - just fine. As soon as I shut one of them off - no other VM could be started, even though the other 2 were still running. It does not matter which guest OS is shut. As soon as you shut one - can't start another. THat was the same before as well. Oh, this just in - they can't be shut down fully either. As soon as the issue appears - shutdown never finishes (linux, windows guests) - can't even use the close button of the guest OS and have to reboot the host by force.

Here are what my processes look like: ​http://s8.postimg.org/orl983eo5/Capture.png

[Svyat]

GOOD JOB VBOX TEAM! 4.3.18 finally fixed this issue for me on Windows Server 2003 with patched system files!

[Flos]

May I know if the root cause of this issue is really found? Or the related code is pinpointed? Thanks!

[ntk]

Having this issue after an upgrade from VB 4.3.12 to 4.3.18, Windows 7 Pro x64 host (version 6.1 Build 7601 SP1), using UltraUXThemePatcher to customize themes/uxtheme.dll

Error dialog:

Failed to open a session for the virtual machine XXXXXX.

Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790 (VERR_UNRESOLVED_ERROR).

Result Code: E_FAIL (0x80004005)
Component: Console
Interface: IConsole {8ab7c520-2442-4b66-8d74-4ff1e195d2b6}

VBox.log:

00:00:02.095148 VMSetError: C:\tinderbox\win-4.3\src\VBox\VMM\VMMR3\PDMLdr.cpp(307) int __cdecl pdmR3LoadR3U(struct UVM *,const char *,const char *); rc=VERR_UNRESOLVED_ERROR
00:00:02.095155 VMSetError: Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790
00:00:02.097166 ERROR [COM]: aRC=E_FAIL (0x80004005) aIID={8ab7c520-2442-4b66-8d74-4ff1e195d2b6} aComponent={Console} aText={Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790 (VERR_UNRESOLVED_ERROR)}, preserve=false
00:00:02.136170 Power up failed (vrc=VERR_UNRESOLVED_ERROR, rc=E_FAIL (0X80004005))
00:00:02.159682 UIMachineView::storeGuestSizeHint: Storing guest size-hint for screen 0 as 640x480
00:00:02.167189 supR3HardenedErrorV: supR3HardenedScreenImage/LdrLoadDll: cached rc=VERR_LDRVI_NOT_SIGNED fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=512 \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
00:00:02.167268 supR3HardenedErrorV: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\system32\uxtheme.dll': rcNt=0xc0000190

sigcheck:

 sigcheck -i -a -h c:/windows/system32/uxtheme.dll

Sigcheck v2.1 - File version and signature viewer
Copyright (C) 2004-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

c:\windows\system32\uxtheme.dll:
        Verified:       Unsigned
        Link date:      9:34 PM 7/13/2009
        Publisher:      Microsoft Corporation
        Description:    Microsoft UxTheme Library
        Product:        Microsoft▒ Windows▒ Operating System
        Prod version:   6.1.7600.16385
        File version:   6.1.7600.16385 (win7_rtm.090713-1255)
        MachineType:    64-bit
        Binary Version: 6.1.7600.16385
        Original Name:  UxTheme.dll.mui
        Internal Name:  UxTheme.dll
        Copyright:      ▒ Microsoft Corporation. All rights reserved.
        Comments:       n/a
        Entropy:        6.318
        MD5:    2E08363A75712E753F4D5B3B34531584
        SHA1:   323190CD2C21152DF3DEDFEE1CA701F11E355A01
        PESHA1: 578AB85BF149ED25EA7FF460A4A5587C358F87A2
        PE256:  ED5609FFC7BAE0ED78268412C94F4C9DCC9846373D5FC0D19E577B2F7825ED71
        SHA256: 66FD0A342D0C56F2D73EDC7EE4C0F7DC3C8AB3AB77BE1A8F5083F6984F4BE754

[Mihai Hanor]

@ntk
After modifying its content, the file must be re-signed. The existing signature is not valid. If you look closer at the sigcheck output, you'll see the line "Verified: Unsigned".

[Ritter]

Alright, I jumped through all the hoops to digitally sign both the 32-bit and the 64-bit versions of my uxtheme.dll. It's my only modified system DLL.

It seems that may not have been the problem causing this error on my system, since the log doesn't actually mention it.

Using vbox 4.3.18 r96516

00:00:01.725588 VMSetError: C:\tinderbox\win-4.3\src\VBox\VMM\VMMR3\PDMLdr.cpp(307) int __cdecl pdmR3LoadR3U(struct UVM *,const char *,const char *); rc=VERR_UNRESOLVED_ERROR
00:00:01.725594 VMSetError: Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790
00:00:01.851856 ERROR [COM]: aRC=E_FAIL (0x80004005) aIID={8ab7c520-2442-4b66-8d74-4ff1e195d2b6} aComponent={Console} aText={Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790 (VERR_UNRESOLVED_ERROR)}, preserve=false
00:00:01.899456 Power up failed (vrc=VERR_UNRESOLVED_ERROR, rc=E_FAIL (0X80004005))
00:00:02.108378 UIMachineView::storeGuestSizeHint: Storing guest size-hint for screen 0 as 640x480

[Ritter]

Ah, no, indeed. It's rejecting an Explorer extension. Had to look in the VBoxStartup.log file which I just learned is separate from the VBox.log file and it not listed in the "show log" dialog box. What a stupid hassle. edit: I mean, the whole process (including setting up a certificate) has felt like a needless waste of time. The fact that the log isn't listed with the others is only a minor thing.

I'm not feeling particularly "safe" now from an unspecified threat that Oracle won't even tell me about. I'm just feeling annoyed. RIP, Sun.

I'd like to know how to disable this antivirus feature of VirtualBox, please. I'm no stranger to compiling, so if making a source change and building it myself is necessary, go on.

[TGP1994]

@Ritter Supposedly, VBox 4.3.12 is the latest version that does not have this new security feature - in the interest of keeping you running, have you tried downgrading to that version while a fix is being developed? (There is a test build ​4.3.19 (rev 96923) that may potentially fix the problem, if you're feeling adventurous.)

[Ritter]

Hmm. It's unclear to me whether the fact that we can't have modified DLL's loaded by Windows is considered a "problem" that is currently in the process of being fixed. Your post suggests that, but the impression I get from the rest of the discussion is that it's a design decision that isn't going away.

4.3.12 is working. 4.3.19 continues to reject an Explorer extension I have that adds the ability to right-click the minimize button on a window to "minimize" it to the notification area.

[TGP1994]

Glad the older one is working for you! Sorry for any confusion I may have caused in my previous post, I totally agree that this feature is most likely not going away.

I think by "fixing" the problem, what I meant to say is that developers are most likely looking for a solution - whatever it may be - to the current problem, that is, quite a few VirtualBox users can no longer start their virtual machines (at least, the ones who are posting about it). I would imagine that, or at least hope, that the solution is not for people to uninstall their Anti-Virus software (what seems to be a big cause according to the forums), along with whatever other software or files that may be tripping up the hardened security feature.

Since I am not even close to being a developer though, I think I will stop throwing around theories at this point, and let official news be the main source of information. :)

Replying to Ritter:

Hmm. It's unclear to me whether the fact that we can't have modified DLL's loaded by Windows is considered a "problem" that is currently in the process of being fixed. Your post suggests that, but the impression I get from the rest of the discussion is that it's a design decision that isn't going away.

4.3.12 is working. 4.3.19 continues to reject an Explorer extension I have that adds the ability to right-click the minimize button on a window to "minimize" it to the notification area.

[Greg Searle]

Same issue. Downgrading to 4.3.12 eliminated the error and my VM's can start up.

[raylo]

I used to use 4.3.16 without any problem until today I have updated my anti-virus software Avast 2015 (2015.10.0.2208) and the VM has no longer be able to be launched. I have tried to uninstalled it and install 4.3.18 and it got :

00:00:02.807280 VM: fHMEnabled=true  (configured) fRecompileUser=false fRecompileSupervisor=false
00:00:02.807282 VM: fRawRing1Enabled=false CSAM=true  PATM=true 
00:00:02.807456 VMSetError: C:\tinderbox\win-4.3\src\VBox\VMM\VMMR3\HM.cpp(532) int __cdecl HMR3Init(struct VM *); rc=VERR_VMX_MSR_VMXON_DISABLED
00:00:02.807488 VMSetError: VT-x is disabled in the BIOS.
00:00:02.933201 ERROR [COM]: aRC=E_FAIL (0x80004005) aIID={8ab7c520-2442-4b66-8d74-4ff1e195d2b6} aComponent={Console} aText={VT-x is disabled in the BIOS. (VERR_VMX_MSR_VMXON_DISABLED)}, preserve=false
00:00:03.002192 Power up failed (vrc=VERR_VMX_MSR_VMXON_DISABLED, rc=E_FAIL (0X80004005))
00:00:03.200889 UIMachineView::storeGuestSizeHint: Storing guest size-hint for screen 0 as 640x480

While I am sure that I enabled VT-x in BIOS.

Checked with release note of Avast, it got a "NG service" for sandbox technology with a VM at the background (according to my understanding) and I have modified the installation to remove it and everything works as expected now.

My OS is Win 8.1 update 3 (nov update) x64 en. Wish this helps for investigation.

[Frank Mehnert]

Sorry, these "me too" reports without any further information don't help. Anybody who still has such problems on Windows, please provide the VBoxStartup.log file and make sure to test VBox 4.3.18.

raylo, your problem is completely unrelated to this ticket! Please create a separate ticket.

[Frank Mehnert]

VBox 4.3.20 contains further updates. Please give it a try.

[GeorgMetzger]

Still the same issue as with .14, .16, .18, .19...

.12 is still working nicely, although it slowly gets annoying to have to constantly re-install it... :-(

I attached the logfile, I hope it helps...

Hm, maybe some more details could help...
Win7 64Bit. .20 installed, installer did NOT tell me to reboot. Started VBox, VMs were running correctly (VM with saved state did not load, had to reboot the VM). Network access did not work, though.
After reboot VBox did not start any VMs anymore, I reinstalled .12 and was told to reboot the host. Did so and everything was working as expected again...

[GeorgMetzger]

Logfile of .20, still having the same problems as .14-.19

[AnrDaemon]

@frank, I'm wondering, when you finally understand, that your fiddling with fundamental operating system functionality won't do you any good? The only real solution to any security concerns of yours is to make the user aware of them, not to try to "fix" them and fail over and over again. You can't be smarter than operating system itself, unless you wrote that operating system yourself.

[GeorgMetzger]

@AnrDaemon: I fully agree

@frank: It is a pity what is going on, really. I was trusting deeply in VirtualBox to be a very stable, very good solution. The VM-not-starting-issue introduced with .14 results in me loosing trust in the software.
Wouldn't it be possible to let the user decide whether he wants to have this additional security thing or not? Could be a setting in the VM config, maybe...

[Scott Hankin]

Like .18, .20 doesn't start my VM (Ubuntu 14.10 64-bit, 2GB, 2 CPU). Clicking the Start arrow leads to a long delay (20-30 seconds) followed by a "Ubuntu 14.10: Starting VM" progress box. This stays at 0%, with the message, "Creating process for virtual machine "Ubuntu 14.10"(GUI/Qt) ... (1/2)" - it never progresses. The hardware is a Dell Latitude E6420 laptop (8GB, i5-2530M CPU@ 2.5GHz) running Windows 7 SP1 64-bit. Symantec EndPoint Protection is installed. All software is up-to-date.

Moving back to 4.3.16.

[kmiracle]

4.3.20r96997 still fails to load VM

[kmiracle]

Echoing what's observed by @PassinThru. Only .12 release works with my environment (with Symantec Endpoint Protection). .14-.20 still unable to start my VM. Log file is attached above.

[Frank Mehnert]

PassinThru and anybody who still cannot start VMs on Windows with VBox 4.3.20, please attach the VBox 4.3.20 VBoxStartup.log file.

[Benjamin]

vm failed to start 4.3.20

[Scott Hankin]

4.3.20 VBoxStartup.log - VM hangs on startup

[Scott Hankin]

Added my VBoxStartup.log. I should mention two things: 1) after cancelling the start up dialog, shutdown of my laptop fails. It never completes. I gave it 10 minutes before forcibly powering it down. 2) The attached log mentions "(lacks WinVerifyTrust)" when loading apphelp.dll. Related?

[edgar_]

VBox 4.3.20 log

[Oorgo]

I am also stuck on 4.3.12 as any update to Virtualbox stops my VMs from starting, it slowly displays a message that the service is being created and never gets any farther. The host is Windows 7 x64, and I have approximately 10 VMs, the only way I'm able to fix this is system restore to the point where 4.3.20 is installed.

[Oorgo]

VboxStartup Win7x64

[andreya108]

4.3.20 vm startup failure

[andreya108]

4.3.20 vm startup failure

[andreya108]

4.3.18 vm startup failure

[andreya108]

Under win 8.1x64 VB fails to start any VM after upgrade. Rolled back to 4.3.10. Here are logs from 4.3.18 and 4.3.20 (the same issue): VBoxStartup(4.3.18r96516).log and VBoxStartup(4.3.20r96997).log No 3rd party AV software installed.

[DanielTest]

I have Win 7x64 HomePremium 4.3.20 vm startup failure (Update at 11/26/2014)

---

Unable to load R3 module C:\Program Files\Oracle VM VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790 (VERR_UNRESOLVED_ERROR).

Fehlercode:E_FAIL (0x80004005) Komponente:Console Interface:IConsole {8ab7c520-2442-4b66-8d74-4ff1e195d2b6}

---

also with AV disabled and start with admin rights

[doublemeat]

I solved this problem by disabling MacType (​https://code.google.com/p/mactype/, which I run to "fix" Windows hideous font rendering. The clue for me was people having problems with unsigned DLLs running in the VirtualBox process space - which MacType does. (I suppose I could also self-sign the DLL.)

Makes sense that a serious product would not want unsigned code running in its process space. But there should most definitely be a global opt-out at least, for the hobbyist who isn't running a uranium centrifuge. A "per-DLL signature" whitelist might be OK for uranium centrifuge VMs, but way too burdensome for the hobbyist.

[Klaus Espenlaub]

The log attached by EvilMrB is a totally unrelated issue, it's trying to start a VM with USB2 enabled but without having the extension pack installed. This gives a very clear error message: "Implementation of the USB 2.0 controller not found!

Because the USB 2.0 controller state is part of the saved VM state, the VM cannot be started. To fix this problem, either install the 'Oracle VM VirtualBox Extension Pack' or disable USB 2.0 support in the VM settings (VERR_NOT_FOUND)".

If this would be a generic bug (broken extension pack) then lots of people would complain, but you're the first.

[ThomasMoore]

VirtualBox 4.3.20r96997 Startup Failure

[dgc]

dgc startup log 4.3.20 Hangs

[dgc]

VirtualBox 4.3.20 r96997 Hang on Startup (Worked with 3.14+ test version, failed differently with 3.14) https://www.virtualbox.org/attachment/ticket/13187/VBoxStartup.11.log

[CorruptNova]

Image of error in Vbox.

[CorruptNova]

Log of VM startup

[CorruptNova]

Seems that I can't start any VM on 4.3.20r96997. I don't have any security software installed nor sandbox applications.

[glvlad]

VBox V4.3.20r96997 on WIndows7

Не удалось открыть сессию для виртуальной машины WindowsXP. (Failed to open session to VM WindowsXP)

The virtual machine 'WindowsXP' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'D:\vms\WindowsXP\Logs\VBoxStartup.log'.

Код ошибки: E_FAIL (0x80004005) Компонент: Machine Интерфейс: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

[malanpa]

hi, recently download the latest version of virtualbox, the installation of the software is perfect but when you try to install any operating system, giving me an error, initiating and from there does not allow me to advance ...

[luke93]

anybody who still cannot start VMs on Windows with VBox 4.3.20, please attach the VBox 4.3.20 VBoxStartup.log file

[luke93]

VBox 4.3.20 seems to have been working until these Windows Updates yesterday

[Frank Mehnert]

Please don't use this defect for reporting the recent breakage due to Microsofts update. This is already described in #13677 and Microsoft just blocked that update for Windows 7.

[tomd]

Failing to start even after the latest windows updates.

[tomd]

Here is the output of the command it told me to run:

C:\Users\tom>sc.exe query vboxdrv

SERVICE_NAME: vboxdrv
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

[CharlieQ]

Any fix for the above R3 module error yet? >.>

[Rb]

Virtual Machine is stuck at - Creating process for virtual machine.......... 0%

VBox version: 4.3.20 Host OS: Windows 7 Enterprise Service Pack 1 AV: Symantec Endpoint Protection Latest Windows Security Update: KB3011780(12/5/2014)

1e0c.1e10: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\apphelp.dll 1e0c.1e10: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling] 1e0c.1e10: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\apphelp.dll [lacks WinVerifyTrust] 1e0c.1e10: supR3HardenedDllNotificationCallback: load 000007fefd1d0000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0] 1e0c.1e10: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\apphelp.dll [lacks WinVerifyTrust] 1e0c.1e10: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd1d0000 'C:\Windows\system32\apphelp.dll'

Anybody familiar with similar issues ?

[Rb]

VBox 4.3.20 seems to have been working until these Windows Updates yesterday. Windows update removed but still not working. Stuck at - Creating Process for Virtual Machine...

[Thad]

Thad Startup Error

[Thad]

Just started seeing this error on r96997 today. Can't boot any existing machines/ boot any new machines, totally broken & I can't access my files on VM.

[Frank Mehnert]

Thad, according to the VBoxStartup.log, the file WS2_32.dll is not signed. Please check the digital signature of this file. It might be modified by a malicious application.

[Klaus Espenlaub]

FYI: it is often possible to have Windows restore the officially distributed variant of the system DLLs by running the command "sfc /scannow" in an admin cmd.exe. Often needs a reboot afterwards to fully restore the default state. The command is definitely worth a try.

[Danial]

DO NOT, run sfc until you have ensured you do not have KB3004394 installed.

This update invalidates or damages a certificate chain utilised by many Windows 7 dll's and executables.

If you have or have had KB3004394, uninstalling is it is known to NOT FIX the error in some cases, only a system restore prior to this patches installation will return your system to functioning order.

KB3004394 is known to prevent VirtualBox from working on Windows 7.

[AnrDaemon]

968.c04: Log file opened: 4.3.20r96997 g_hStartupLog=00000fe8 g_uNtVerCombined=0x510a2830
968.c04: \SystemRoot\System32\ntdll.dll:
968.c04:     CreationTime:    2008-04-14T17:40:20.000000000Z
968.c04:     LastWriteTime:   2010-12-09T15:15:19.000000000Z
968.c04:     ChangeTime:      2011-03-03T13:25:18.734375000Z
968.c04:     FileAttributes:  0x20
968.c04:     Size:            0xb0600
968.c04:     NT Headers:      0xd0
968.c04:     Timestamp:       0x4d00f287
968.c04:     Machine:         0x14c - i386
968.c04:     Timestamp:       0x4d00f287
968.c04:     Image Version:   5.1
968.c04:     SizeOfImage:     0xb3000 (733184)
968.c04:     Resource Dir:    0x83000 LB 0x2cf58
968.c04: \SystemRoot\System32\kernel32.dll:
968.c04:     CreationTime:    2008-04-14T17:40:40.000000000Z
968.c04:     LastWriteTime:   2014-03-12T10:47:47.000000000Z
968.c04:     ChangeTime:      2014-07-02T19:16:43.507548900Z
968.c04:     FileAttributes:  0x20
968.c04:     Size:            0xf4000
968.c04:     NT Headers:      0xf0
968.c04:     Timestamp:       0x53203b53
968.c04:     Machine:         0x14c - i386
968.c04:     Timestamp:       0x53203b53
968.c04:     Image Version:   5.1
968.c04:     SizeOfImage:     0xf8000 (1015808)
968.c04:     Resource Dir:    0x8a000 LB 0x6773c
968.c04: NtOpenDirectoryObject failed on \Driver: 0xc0000022
968.c04: supR3HardenedWinFindAdversaries: 0x0
968.c04: Calling main()
968.c04: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
968.c04: SUPR3HardenedMain: Respawn #1
968.c04: System32:  \Device\HarddiskVolume1\WINDOWS\system32
968.c04: WinSxS:    \Device\HarddiskVolume1\WINDOWS\WinSxS
968.c04: KnownDllPath: C:\WINDOWS\system32
968.c04: '\Device\HarddiskVolume1\Program Files\VirtualBox\VirtualBox.exe' has no imports
968.c04: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Program Files\VirtualBox\VirtualBox.exe)
968.c04: supR3HardNtEnableThreadCreation:
968.c04: supR3HardNtDisableThreadCreation: pvLdrInitThunk=7c901166 pvNtTerminateThread=7c90de7e
968.c04: supR3HardenedWinDoReSpawn(1): New child 8ec.bd4 [kernel32].
968.c04: supR3HardNtChildGatherData: PebBaseAddress=7ffd8000 cbPeb=0x20c
968.c04: supR3HardNtPuChFindNtdll: uNtDllParentAddr=7c900000 uNtDllChildAddr=7c900000
968.c04: supR3HardenedWinSetupChildInit: uLdrInitThunk=7c901166
968.c04: supR3HardenedWinSetupChildInit: Start child.
968.c04: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 15 ms.

Then the host abruptly reboot. The log is actually longer than that, containing a lot of \000's.

[AnrDaemon]

VirtualBox r20 startup log and BSOD summary

[John Dan]

Please review/link this ticket #13659 (the same problem module - hardened, but other issue -- garbage memory read to get a module name to check its digital signature)

[carfesh]

SEP - failing startup

[carfesh]

on my system (SEP is installed, I imagine that may be the reason) it will still fail to start VMs; I have attached the log.

[workingman]

Unable to load r3 model in new test build and others

[Klaus Espenlaub]

People running into VM start timeouts with Symantec Endpoint protection should try the following workarounds (we'll try to fix this rather recent hiccup of course, but this can take a while):

Follow the below Tech Note if you are using SEP Enterprise Edition: ​http://www.symantec.com/business/support/index?page=content&id=TECH225620

If you are using standalone or unmanaged SEP then remove "Application and Device control":

1. You can remove by going to Programs and Features, selecting "Change" on SEP -> Select Modify option
2. Set Proactive Threat Protection -> Application and Device control to "Entire Feature will be unavailable".
3. Finish the setup + reboot the system

[deaforange]

All versions of Virtualbox since 4.3.14 crashed my Win8.0 host to BSOD trying to start a VM. Now I'm on Win8.1 and 4.3.20 still can't start any VM.

[GeorgMetzger]

Hm, I am starting to get a bit depressed... The .22 still has exactly the same issues as .20! And .18, .16, .14 by the way... I believe it is about time to disable this "advanced" security features, maybe with a setting. I will have to switch to VMWare otherwise...

Regarding the changelog, there was not even something TRIED to circumvent or solve the problem. If I would develop my software this way, I would have been fired some months ago...

[Klaus Espenlaub]

Please. We're working hard on ironing out issues with hardening, which we can't all list in the changelog. Also, we said so many times that all this effort isn't "just for fun" (or to have '"advanced" security features), it's done to address a genuine security issue which was reported by a 3rd party. To be honest, I wouldn't be surprised if VMware Workstation is affected (NOTE: I have no proof, and I don't have time to do any checks of 3rd party software) as well by the underlying very generic vulnerability.

If we add a way to disable the hardening (forget about pointing out that Administrator is trustworthy - on Windows it isn't, everyone is an admin and UAC is a fig leaf), then the security fix is effectively removed.

I won't comment on the criticism about our software development style. Users of the free, open source product are encouraged to work with us constructively, and paying customers have additional channels to make themselves heard. Sorry, but there's an economic part of software development as well. Especially for free and open source software.

[wunjo]

I also met this bug. When I do an install of one of the affected versions and I go right on starting vBox after install, the bug isn't there. It appears only if I start the vBox the next time.

Win 7 pro -64, AMD A8-3870

8,00 GB DDR3 @ 666MHz (9-9-9-24)

Motherboard

ASUSTeK COMPUTER INC. F1A75-M LE (FM1 )

[Scott Hankin]

The 4.3.22 release fixed my problem with SEP. My VMs work flawlessly now. Thanks for the fix!

[GeorgMetzger]

@klaus: You are right, I picked the wrong tone. Sorry for that!

I was just upset that the problem still exists. I really like VirtualBox, and I hate not being able to use all the new features...

The modification is about a security issue, ok.

I understand that this should be fixed.

But I honestly must say that I would prefer to work with the latest version of your software *with* security issues instead of working with the OLD version *with* security issues, too...

The .12 had the security problem, I am still running it since the new versions do not work. So I effectively have the problem.

I repeat my request to make the modification somehow switchable, if I switch it off, it is not any more problematic than using the older version...

[oppiman]

I had a similar problem with VirtualBox >4.3.12 and a patched uxtheme.dll

1) My input to a possible solution provided by Oracle: It would make sense to have the dll verification switched off when needed. To avoid security problems, when switched off a clearly visible message should be displayed in e.g. VirtualBox status bars.

2) My input to a possible solution for some affected users: If the problem is "only" about a patched uxtheme.dll, then restore the original uxtheme.dll first. Then download and install a tool from uxstyle.com. It will allow the use of themes without the need of tampering with dlls. Worked for me and I can happily use the latest version of VirtualBox and have a modified theme.

Regards Michael

[GeorgMetzger]

Michael: How did you find out the reason for the problem? All I get is the info that the program will not run, but not a reason for it...

[oppiman]

Replying to GeorgMetzger:

Michael: How did you find out the reason for the problem? All I get is the info that the program will not run, but not a reason for it...

the log files point to uxtheme.dll

00:00:02.167189 supR3HardenedErrorV: supR3HardenedScreenImage/LdrLoadDll: cached rc=VERR_LDRVI_NOT_SIGNED fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=512 \Device\HarddiskVolume2\Windows\System32\uxtheme.dll 00:00:02.167268 supR3HardenedErrorV: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\system32\uxtheme.dll': rcNt=0xc0000190

VirtualBox is actually checking the signature on several dlls. The uxtheme.dll sig was broken dur to patching, therefore it got rejected.

[GeorgMetzger]

Replying to oppiman:

the log files point to uxtheme.dll

00:00:02.167189 supR3HardenedErrorV: supR3HardenedScreenImage/LdrLoadDll: cached rc=VERR_LDRVI_NOT_SIGNED fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=512 \Device\HarddiskVolume2\Windows\System32\uxtheme.dll 00:00:02.167268 supR3HardenedErrorV: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\system32\uxtheme.dll': rcNt=0xc0000190

Ok, I should check the log then! Many thanks!!

[John Dan]

Please review this one details about:

• AppInit_Dlls
• probably, incorrect filenames Querying from OS
• request for more details in logs

Problem is still actual for 4.3.22:

https://www.virtualbox.org/ticket/13659#comment:5

[GeorgMetzger]

Replying to oppiman:

Replying to GeorgMetzger:

Michael: How did you find out the reason for the problem? All I get is the info that the program will not run, but not a reason for it...

the log files point to uxtheme.dll

Sorry, but could you maybe check my attached log (VBoxStartup.6.log) for a problem? I can not find the reason for the issue. There are several DLLs listed, but these are all standard and not modified, as far as I can tell...

By the way, somebody tried the .24? Is the problem fixed?

[oppiman]

Replying to GeorgMetzger: ...

the log files point to uxtheme.dll

Sorry, but could you maybe check my attached log (VBoxStartup.6.log) for a problem? I can not find the reason for the issue. There are several DLLs listed, but these are all standard and not modified, as far as I can tell...

I don't see anything being rejected, so maybe you have a different problem.

By the way, somebody tried the .24? Is the problem fixed?

Nope, and won't do that. I'm verry happy to have a working system right now and I don't see anything in the changelog that would encourage me to test again.

BTW, I just noticed today, that .22 had a problem with some Nvidia files as well. I think it is odd that vbox thinks they can achieve something MS hasn't for years...

[littleperry]

4.3.24 still not fix this issue.

[Frank Mehnert]

VirtualBox 4.3.24 contains fixes for Windows hardening as all releases since 4.3.14 before. The fixes in 4.3.24 were done for a very specific problem so we didn't add a changelog entry but a fix can always have side effects.

[GeorgMetzger]

Replying to frank:

VirtualBox 4.3.24 contains fixes for Windows hardening as all releases since 4.3.14 before. The fixes in 4.3.24 were done for a very specific problem so we didn't add a changelog entry but a fix can always have side effects.

_

I think that after some many months with the same issues, it is time to give us an option to disable hardening. Maybe with the suggested option of displaying a warning if hardening is off...

_

@oppiman: thanks for your help!

[Frank Mehnert]

Replying to GeorgMetzger:

I think that after some many months with the same issues, it is time to give us an option to disable hardening. Maybe with the suggested option of displaying a warning if hardening is off...

What you denote as the 'same issue for months' is actually a problem with many different flavors. And the root of the problem is the Windows design and the policy of various virus scanners on Windows.

Again, there will be no option to disable VirtualBox hardening on Windows. There is an Oracle policy that prevents us shipping from software which has know security problems.

[oppiman]

Replying to frank:

but a fix can always have side effects.

Very true. So you will go on "fixing specific problems" possibly causing side effects for anybody else (without detailed documentation?

Replying to frank:

... And the root of the problem is the Windows design and the policy of various virus scanners on Windows.

Again very true. But you try to ship around that design flaw in order to achieve something MS never achieved themselves. And you will compete with the constantly changing environment virtualbox has to run in. (lot of work ahead)

Again, there will be no option to disable VirtualBox hardening on Windows. There is an Oracle policy that prevents us shipping from software which has know security problems.

Ok, so you try to circumvent DLL hijacking and/or injection. While that is very much appreciated, VirtualBox is a product often used for testing and/or in lab environments. VirtualBox isn't really a tool meant to run productive financial systems... So I still think the user should have the option to decide - but oh well... (could be implemented in a way, that changes to hardening only are possible while no VM is running and a clear message in status bar or menues which mode you are in to prevent unrecognized tampering - or maybe call it dev or debug mode to make clear it is not for productive use)

[Frank Mehnert]

Replying to oppiman:

Replying to frank:

but a fix can always have side effects.

Very true. So you will go on "fixing specific problems" possibly causing side effects for anybody else (without detailed documentation)?

That's not what I said. Sometimes there is a small fix which isn't mentioned in the changelog because the impact is treated as very limited. It's definitely possible that such a fix which fixes the problems of other users. I think that's not something to complain about.

Replying to frank:

... And the root of the problem is the Windows design and the policy of various virus scanners on Windows.

Again very true. But you try to ship around that design flaw in order to achieve something MS never achieved themselves. And you will compete with the constantly changing environment virtualbox has to run in. (lot of work ahead)

Sorry, we have no choice.

Again, there will be no option to disable VirtualBox hardening on Windows. There is an Oracle policy that prevents us shipping from software which has know security problems.

Ok, so you try to circumvent DLL hijacking and/or injection. While that is very much appreciated, VirtualBox is a product often used for testing and/or in lab environments. VirtualBox isn't really a tool meant to run productive financial systems... So I still think the user should have the option to decide - but oh well... (could be implemented in a way, that changes to hardening only are possible while no VM is running and a clear message in status bar or menues which mode you are in to prevent unrecognized tampering - or maybe call it dev or debug mode to make clear it is not for productive use)

Why I completely understand that some users don't care about these security aspects at all because, for instance, their Windows computer runs in a private network without any connection to the outside and they never install any malicious software on it and therefore completely trust their Windows box (but is that really realistic?) we are still not allowed to ship such a software. The consequence of having a switch to disable hardening in VirtualBox would be that every VirtualBox FAQ would list this switch as the most prominent item and most users would just use this switch to circumvent any possible compatibility problem.

[GeorgMetzger]

Replying to frank:

Why I completely understand that some users don't care about these security aspects at all because, for instance, their Windows computer runs in a private network without any connection to the outside and they never install any malicious software on it and therefore completely trust their Windows box (but is that really realistic?) we are still not allowed to ship such a software. The consequence of having a switch to disable hardening in VirtualBox would be that every VirtualBox FAQ would list this switch as the most prominent item and most users would just use this switch to circumvent any possible compatibility problem.

Well, yes, I trust my PC. And it is not Oracles cause to doubt this or to declare something being good or not. Oracle is not god. With your reply you imply that there really is some need for this switch...

Maybe you could start by informing those who have posted logs about their specific problem? Currently I am sitting here completely blind, having no idea what I could do except for begging you (or your bosses) to get reasonable.

Could you provide contact information for somebody responsible for the development? I know that sometimes the workers in a company are not heard, but the customers are...

I am well aware that VirtualBox is for free and I am not a paying customer. But it was Oracles decision to go this way of distribution. I am sure it would not help sending you money, so the price is not an argument. You should provide a working piece of software or no software at all. There are alternatives. Currently for me it's just convenient to stick to a piece of software I know and basically like very much and HOPE that the problem will be fixed. But if the problem will not be fixed, I will switch and others will, also.

I repeat the request to get information for each users specific problem. Many thanks in advance for this!

[oppiman]

Replying to frank:

Why I completely understand that some users don't care about these security aspects at all

I guess you got me wrong here. I do care very much about security - where I need it. And I want to control the level of security that I apply. I don't want some software to do something that ends up in unexpected results.

In another reply I said I would be a happy user as I got .22 working. Well I was wrong. It was working, but without audio. I don't care too much about audio on VMs so I did not notice right away. Now I testest .22, .24 and for sure .12. Guess what, audio works in all of my guests (Windows and Linux) using .12. Audio does not work with .22 and .24. When I say audio does not work I mean there simply is no sound hearable. No error message.

I tested that back and forth including the installation/uninstall of guest additions.

The only thing that has changed on my host over the last few weeks was the installation of Lync. I don't know if that might be related and I can't go back before the point in time Lync has been installed.

Anyway, .12 works and so I reverted back to .12.

:(

[Valerio Messina]

I can confirm the problem is related to Windows host only. I just upgraded VB to 4.3.24 on a Linux box, and can run without trouble VM with both Windows and Linux.
About the apparently related bug https://www.virtualbox.org/ticket/13317, VB 4.3.16 solved the issue with Sophos.

[fpabernard]

Same error after upgrading from 4.3.12

Échec de l'ouverture de session pour la machine virtuelle Openmediavault Kralizec 1.0.

The configuration constructor in main failed due to a COM error. Check the release log of the VM for further details. (VERR_MAIN_CONFIG_CONSTRUCTOR_COM_ERROR).

Code d'erreur : E_FAIL (0x80004005) Composant : Console Interface : IConsole {8ab7c520-2442-4b66-8d74-4ff1e195d2b6}

[fpabernard]

Vbox.log

[frickenate]

I'm another user stuck on 4.3.12. The fact of the matter is that many of us download custom themes for Windows which patch system DLL files. You are telling all of us that your product can no longer be used by people such as ourselves. I really cannot handle Windows without my theme alterations, so the simplest maneuver is to not upgrade from 4.3.12. The day this version is no longer viable and you continue to refuse to provide a workaround, I and many others will simply abandon your product.

You say "it's done to address a genuine security issue which was reported by a 3rd party. To be honest, I wouldn't be surprised if VMware Workstation is affected". You make this sound like it would be a terrible thing for them, that VMWare would be inferior. And yet: if their product works with my operating system (security concerns be damned), then they have a product I am interested in and it is your product that appears to be "affected".

Please reconsider. A patched DLL file is not a security vulnerability in and of itself, if the user has explicitly taken the risk to install said patch. If a genuine virus patches a file without the user's consent, it is not up to each application to harden against this. If Windows itself is infected, what's the point in hardening the guest? Who cares if an infected Windows machine results in an infected/exploitable guest? No worse off... except perhaps to the ego of the security team at VirtualBox.

Please reconsider.

[Frank Mehnert]

Sorry but an infected DLL is a security threat when used together with VirtualBox. In contrast to a regular user process (if a malicious theme DLL does evil things with calc.exe this is annoying but wouldn't affect the whole system), the VirtualBox process needs to run at system privileges. If malicious code is able to attack the VM process then this is a threat to your system, not only to the current user and not only to the files the current user has access to.

[Danial]

You don't have to patch files to load unsigned themes....

the UXStyle service and driver work without any alterations to system files and i can confirm that it works just fine with Virtualbox.

[oppiman]

So .26 came out and I gave it a try. I don't have any theme customizations anymore, even so the UX Style service worked nicely with .14+ My next problem was no audio on windows or linux clients on a w7 64bit host with any version beyond .12 And it still is here, even with new guest additions. So trashed .26 again, went back to .12 and all is ok again. This is no fun.

[Danial]

what audio device are you emulating in the virtualbox settings?

[oppiman]

Replying to Squall Leonhart:

what audio device are you emulating in the virtualbox settings?

ICH AC97 - never used anything else for years. Actually I am using the VMs pretty much with template default settings.

My VMs did not change recently.

To double check I installed a fresh Mint 17.1 64bit. With .12 Audio, with anything later no. I tried the Mint default guest additions and purging all and installing from virtual cd drive. Both same.

I looked through the logs, compared those from .12 to .26, could not find anything that would point to audio problems.

One thing I noticed, it is not just that audio doesn't work, when using Sound/Hardware/Test Speakers it seems the vm is hanging a bit.

The only thing I am not sure about: I recently installed Office 2013 and Lync on my host. Lync has some weird ways to grab audio, so not sure if that might play into the game. Anyway, .12 not affected.

P.S. I'll try later today on another W7 64bit host without Lync and a fresh Mint 17.1 install.

P.P.S In case you think Mint is the problem... No, an old 32bit XP VM behaves the same.

[oppiman]

Ok, apparantly I have found the root cause of the problem. Even so I reverted to a Windows Standard Theme and made sure I unpatched the related files, one thing still was there. A modification of the start button. Once removed, audio was back.

But gents, how crazy is that. I understand the idea behind hardening, but no guest audio because of a formerly modified host start button and no log entries that would point to the problem? Come on...

I admit one should not tamper with system files, but honestly Oracle should not claim to know things better than Microsoft. All you can do is try and error arround the system and AV programs and other tools that hook up deep inside the OS.

So my problem is solved. Not counting the hours wasted. Thanks anyway.

[frickenate]

@frank And just how did that DLL manage to get infected in the first place? Oh that's right, via escalated privileges, which means the system is already compromised. The fact that a specific attack vector might require a process with the loaded DLL to run with escalated privileges is fairly besides the point. A user on the machine has already granted the permission to install an infected DLL, and it is not Virtualbox's job to police the entire operating system. You are telling a portion of your customer base that your product has reached end of life. That just doesn't make sense.

[GeorgMetzger]

@frickenate: I absolutely agree! I do not understand how Oracle can be so blindfolded. Some are complaining, but many more users will just not try VirtualBox again after they failed to make any post .12 version run.

They will simply got to VMWare Player and stay there.

Oracle is destroying its own userbase step by step and we who are warning them, are "the bad guys trying to use an unsecure Windows".

All Oracle would have to do is to add a messagebox when the "security problem" is detected, informing the user. SIMILAR To WHAT WINDOWS DOES: "This program requests Admin rights. Do you grant these...".

I have posted my logfile months ago, nobody felt obliged to check it and inform me about the reason for my problem. I have no modified start buttons, no virus scanner, no nonsense software installed.

I have the feeling Oracle is not taking our pleas seriously.

@frank: If I am wrong, then please get us a person of higher rank to this forum, have him read the posts and have him tell us why he thinks he knows better... I bet this will not happen. Because you do not care about your userbase!

[Suo]

The discussion about these issues has been continuing in the forums: ​https://forums.virtualbox.org/viewtopic.php?f=6&t=66639

[Frank Mehnert]

New test build available which fixes a bug in the VBox code which was triggered in conjunction with some Microsoft security fixes (KB3045999).

[prymshbmg]

No VMs are loading on Vbox 4.3.26 resulting error with RC=-1912

[mip1983]

Error starting virtual machine with 4.3.28

[mip1983]

I've attached my logs in the post above. Just to add to that, virtual box works fine on my machine at home, on my work machine I have to use 4.3.12 which comes with it's own issues. The work machine is Windows 7 Enterprise with some McAfee Enterprise software, a fairly locked down machine.

[NumericOverflow]

Replying to mip1983:

I've attached my logs in the post above. Just to add to that, virtual box works fine on my machine at home, on my work machine I have to use 4.3.12 which comes with it's own issues. The work machine is Windows 7 Enterprise with some McAfee Enterprise software, a fairly locked down machine.

Same issues here and similar setup (Win7x64 with McAfee Enterprise suite in a corporate environment).

[NumericOverflow]

VBox-4.3.28r100309_failed_to_start Log

[NumericOverflow]

Replying to frank:

New test build available which fixes a bug in the VBox code which was triggered in conjunction with some Microsoft security fixes (KB3045999).

FYI - just tried latest beta (VirtualBox-4.3.29-100331-Win.exe) and it doesn't work either.

Side Note: Your download link on the test builds page is wrong (URL has 4.3.27 not 4.3.29 for the windows build which is 404 not found). Should be fixed to this: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.29-100331-Win.exe

[ErikTheRed]

Startup log for 4.3.28

[Beezle]

I can no longer start any of my VMs under win 8.1 64. I have read through this thread and looked at the log file. It seems to be complaining kernel32.dll lacks WinVerifyTrust.

Dear Oracle - it is not your job to verify the integerity or security of my installation (which by all other indications is perfectly fine). If you feel you must look at these things, you are doing a great disservice to your customers/users by preventing them from running Virtualbox. The administrator and/or end-user should have the final say - not Oracle. If you want to put up a one time "warning" that the system may be compromised, fine ok, do that. And then let the user decide whether to go forward. When did Oracle become the arbiter of whether a Windows installation is not compromised?

So now I am faced with the difficult choice of running an OUTDATED and INSECURE version of Virtualbox or look for another virtualization solution and waste more of my time switching over. Oracle is not a loved company and this type of heavy handedness only furthers that dislike (and that is not a jab at the coders).

[BGarber]

4.3.29 is just as useless.

[Valerio Messina]

I can confirm the problem is related to Windows host only. I just upgraded VB to 4.3.28 on a Linux box, and can run without trouble VM with both Windows and Linux.

[EduardoDiaz]

I confirm the problem in Virtual Box 5.0.

My windows have the files patched I have the original files on my webpage but you must replace the files yourself.

​http://www.pk25.com/monivideos/ThemeFiles.zip

Now is running.

[ErikTheRed]

I am still seeing this issue in both 4.3.30 and 5.0, kernel32.dll is getting a lacksWinVerify trust error.

Windows 7 x64 Enterprise Fully Patched

[Mark Lobo]

Problem started recently. Tried VB versions 4.3.22, 4.3.30, 5.0 and 5.0.1r102010. All fail to start with the same error. Log file attached. Any ideas how to fix this issue?

Failed to open a session for the virtual machine CentOS67.

The virtual machine 'CentOS67' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'C:\Users\xyz\VirtualBox VMs\CentOS67\Logs\VBoxStartup.log'.

Result Code: E_FAIL (0x80004005) Component: MachineWrap Interface: IMachine {f30138d4-e5ea-4b3a-8858-a059de4c93fd}

[FeyanGur]

8ab7c520-2442-4b66-8d74-4ff1e195d2b6

[FeyanGur]

Problem started recently. Tried VB versions 4.3.12, 4.3.30, 5.0.2 with installed Oracle VM VirtualBox Extension Pack. All fail to start with the same error. Log file attached. Any ideas how to fix this issue?

[Jan Elznic]

Replying to EduardoDiaz:

My windows have the files patched I have the original files on my webpage but you must replace the files yourself.

​http://www.pk25.com/monivideos/ThemeFiles.zip

Now is running.

Where can I replace this files? Can you describe the location path, please?

[mjbrown]

Replying to doublemeat:

I solved this problem by disabling MacType [...]

All you need to do in MacType is add VirtualBox.exe to the [UnloadDll] section of the active MacType profile (.ini file).

[Bill.Coats]

VBoxHardening.log

[Bill.Coats]

I can not get Any virtual machines to boot. I have tried uninstalling and reinstalling VirtualBox with no luck. I keep receiving an error that it failed to open a session for the virtual machine. I have a fully patched Windows 8.1 machine with System Center Endpoint Protection 4.8.204.0. I am running VirtualBox 5.0.10. I have attached the log file that is created when I try to start VirtualBox.

[Ty66]

I am also having the DLL lacks WinVerifyTrust issue with VB 5.0.16 (and 4.3.36) on a Windows 7 machine with McAfee 5.0.2.132. Does anyone know if there is any resolution coming for this?

[pa_]

log

[pa_]

vb 5.1, win7, no antivir

The virtual machine 'lotus' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'C:\VM\lotus\Logs\VBoxHardening.log'.

Код ошибки: E_FAIL (0x80004005) Компонент: MachineWrap Интерфейс: IMachine {b2547866-a0a1-4391-8b86-6952d82efaa0}

https://www.virtualbox.org/attachment/ticket/13187/VBoxHardening.2.log

[Harps]

Earlier than today. Virtual machines worked well. Until now, when I fixed the Windows Update error 80070003 by this video ​https://www.youtube.com/watch?v=4PKJUxalYss, They won't work. I restarted the PC, It won't work. I used System Restore, It won't work, I uninstalled Norton, It won't work. Please help me fix the error 0x80004005 please

Operating System: Windows 7 Home Premium Service Pack 1 64-bit Anti-Virus Software: Norton Internet Security.

[Valerio Messina]

As now I'm keeping old 4.3.16 on Win7 64bit, that is the last one 4.x correctly start VM on my installation

It is not clear if current 5.x solve this trouble.

[Valerio Messina]

just upgraded to VirtualBox 5.1.4 on my Win7 - 64 bit All my prev virtual machines works well. Are:

Linux Ubuntu 12.04LTS - 32 bit
Linux MintDEmate201404 - 32 bit
Linux Debian7 - 32 bit
Linux Debian8 - 32 bit
Linux Debian8 - 64 bit
Linux DebianTesting - 32 bit

Bidirectional shared clipboard still doesn't work as in prev version

[keremer]

Today I've upgraded from 4.3.30 to 5.1. over Windows 7 Ultimate up-to-date. The result is still the same. It is not possible to start any virtual machines. I am using ESET Smat Secuirty. But uninstalling would not help. Logs are attached.

[keremer]

VBoxHardening.log Win7 Ultimate causing shell32.dll Hardening error

[Andersen2025857]

I have one VM. When I start it, it will show error. Only this VM get error. The others is fine. Anyone can help me ? My attachment is "Andersen2025857-Logs.zip".

[rambo_ivanov]

VMs fail to start. Any help will be appreciated. Thanks!

[lubosdz]

Cannot start VB 5.1.8 and 5.1.10 (tested both). Logged error is rejecting 'C:\Windows\system32\user32.dll'. Using Windows 7 x64, using Vagrant 1.8.6 and 1.9.0 (tested both with same issue).

Why would be user32.dll rejected? This error did not occur in older versions VB 4.x (I must have reinstalled whole notebook).

Last 10 lines from VBoxHardening.log:

1640.d40: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
1640.d40: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=000000000084fc50:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\Driver;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\nodejs\;d:\wamp\bin\php\php7.0\;C:\Program Files\Git\cmd;C:\Program Files\Git\usr\bin;C:\Program Files\TortoiseGit\bin;C:\Program Files (x86)\vagrant\bin;C:\Users\XL\AppData\Roaming\npm [calling]
1640.d40: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbfb0000 'C:\Windows\system32\uxtheme.dll'
1640.d40: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
1640.d40: Error (rc=0):
1640.d40: supR3HardenedScreenImage/LdrLoadDll: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=32 \Device\HarddiskVolume2\Windows\System32\user32.dll
1640.d40: Error (rc=0):
1640.d40: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\system32\user32.dll' (C:\Windows\system32\user32.dll): rcNt=0xc0000190
1640.d40: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'C:\Windows\system32\user32.dll'
1598.11d4: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 892 ms, the end);
c7c.c84: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1505 ms, the end);

[Logik]

Facing same error on VB 5.1.10 on windows 7 Ultimate. Just updated today from 5.0.28 to latest stable. Can't even launch VM

[Elise Benine]

had similar issue few months ago. my development VM for ​http://schipholparkerenvergelijken.nl/ couldn't start, turned out to be a network card related bug. nothing helped, had to downgrade virtualbox

[naskovz]

FYI - I have had this issue since 4.3.18, and was only able to boot up my VMs by downgrading to 4.3.12...

I just tried VirtualBox-6.0.0-127566-Win (on windows 10) and it seems to work without issues...