VirtualBox

Ticket #13187 (new defect)

Opened 3 years ago

Last modified 4 months ago

VirtualBox 4.3.14 can't start VMs on certain Windows hosts

Reported by: AxelFontaine Owned by:
Priority: blocker Component: other
Version: VirtualBox 4.3.14 Keywords:
Cc: Guest type: other
Host type: Windows

Description

Both new and existing VMs cannot be started with VirtualBox 4.3.14 under Win 8.1 x64. Double-clicking on a stopped VM in the GUI gives a popup containing CLI arguments and a message that it failed. Vagrant is broken too. Restarting the system does not fix the issue. Uninstalling and reinstalling 4.3.14 does not fix the issue.

The only fix is to uninstall and reinstall 4.3.12.

Attachments

error.jpg Download (204.7 KB) - added by SquirrellyOne 3 years ago.
extension pack error
EFAIL_95226.png Download (20.9 KB) - added by GRA 3 years ago.
Error E_FAIL, Build 95226, Comodo AV
VBoxStartup.log Download (1.2 KB) - added by GRA 3 years ago.
Build 95226, Comodo AV, Startup Log
VBoxStartup.2.log Download (368.6 KB) - added by jvon 3 years ago.
Win7.64bit_Kaspersky_OVB_Opening_Error.png Download (44.4 KB) - added by northpole 3 years ago.
Error opening VirtualBox on Windows 7 64 bit with Kaspersky Internet Security
sysmon_vbox_problem.jpg Download (18.2 KB) - added by 72gab 3 years ago.
VBoxStartup.3.log Download (426.6 KB) - added by msayed1977 3 years ago.
My startup log
VBox.log Download (56.5 KB) - added by yesoos 3 years ago.
vbox.log, linux mint failing after latest upgrade
VBox.2.log Download (64.2 KB) - added by PassinThru 3 years ago.
Log for Ubuntu 14.04 guest, Win7 host, build 95663
VBoxStartup.zip Download (23.8 KB) - added by PassinThru 3 years ago.
Ubuntu 14.04 guest, Win7 host, build 95663
ErrorWhenSwitchToFullScreen.png Download (23.5 KB) - added by msayed1977 3 years ago.
ANMLogs.zip Download (30.9 KB) - added by AliveNoMore 3 years ago.
error.JPG Download (24.8 KB) - added by Fabian23 3 years ago.
VBoxStartup.4.log Download (150.8 KB) - added by Marki555 3 years ago.
unable to start VM on 4.3.16
VirtualBox - Error.png Download (34.7 KB) - added by Gabee 3 years ago.
VirtualBox - Error E_Fail
VBoxStartup.5.log Download (237.2 KB) - added by wouterk__ 3 years ago.
DOS VM refusing to start with "Exit code 1"
VirtualBox Error.png Download (7.8 KB) - added by IainMD 3 years ago.
verify_process_integrity_error
Failed.jpg Download (18.7 KB) - added by jamestdi 3 years ago.
latest build error
integrity.jpg Download (117.1 KB) - added by jamestdi 3 years ago.
Failed integrity with older builds
VBoxStartup.6.log Download (216.6 KB) - added by GeorgMetzger 3 years ago.
Logfile of .20, still having the same problems as .14-.19
VBoxStartup.7.log Download (23.4 KB) - added by kmiracle 3 years ago.
4.3.20r96997 still fails to load VM
VBoxStartup8.log Download (40.3 KB) - added by Benja 3 years ago.
vm failed to start 4.3.20
PassinThruVBoxStartup-4.3.20.log Download (23.3 KB) - added by PassinThru 3 years ago.
4.3.20 VBoxStartup.log - VM hangs on startup
VBoxStartup.8.log Download (67.6 KB) - added by edgar_ 3 years ago.
VBox 4.3.20 log
VBoxStartup.9.log Download (27.6 KB) - added by Oorgo 3 years ago.
VboxStartup Win7x64
VBoxStartup(4.3.20r96997).log Download (22.0 KB) - added by andreya108 3 years ago.
4.3.20 vm startup failure
VBoxStartup(4.3.20r96997).2.log Download (22.0 KB) - added by andreya108 3 years ago.
4.3.20 vm startup failure
VBoxStartup(4.3.18r96516).log Download (15.6 KB) - added by andreya108 3 years ago.
4.3.18 vm startup failure
Linux Mint 17 Qiana-2014-11-22-13-48-43.log Download (2.7 KB) - added by EvilMrB 3 years ago.
Virtualbox-fault-diags.doc Download (49.5 KB) - added by EvilMrB 3 years ago.
VBoxStartup.10.log Download (74.3 KB) - added by ThomasMoore 3 years ago.
VirtualBox 4.3.20r96997 Startup Failure
VBoxStartup.11.log Download (27.3 KB) - added by dgc 3 years ago.
dgc startup log 4.3.20 Hangs
ss (2014-12-05 at 11.29.13).png Download (23.0 KB) - added by CorruptNova 3 years ago.
Image of error in Vbox.
VBoxStartup.12.log Download (14.9 KB) - added by CorruptNova 3 years ago.
Log of VM startup
VBoxStartup.13.log Download (231.7 KB) - added by glvlad 3 years ago.
VBoxStartup.14.log Download (198.0 KB) - added by luke93 3 years ago.
anybody who still cannot start VMs on Windows with VBox 4.3.20, please attach the VBox 4.3.20 VBoxStartup.log file
VBoxStartup.15.log Download (140.4 KB) - added by nudidudi 3 years ago.
VBoxStartup.16.log Download (17.6 KB) - added by J.H. 3 years ago.
windows_update.png Download (94.7 KB) - added by luke93 3 years ago.
VBox 4.3.20 seems to have been working until these Windows Updates yesterday
VBoxStartup.17.log Download (12.9 KB) - added by tomd 3 years ago.
Failing to start even after the latest windows updates.
VBoxStartup.2.zip Download (3.3 KB) - added by Rb 3 years ago.
VBox 4.3.20 seems to have been working until these Windows Updates yesterday. Windows update removed but still not working. Stuck at - Creating Process for Virtual Machine…
VBoxStartup.18.log Download (264.6 KB) - added by Thad 3 years ago.
Thad Startup Error
2014-12-20-VBox-4.3.20-bsod-summary.zip Download (11.0 KB) - added by AnrDaemon 3 years ago.
VirtualBox r20 startup log and BSOD summary
VBoxStartup.19.log Download (31.2 KB) - added by carfesh 2 years ago.
SEP - failing startup
Windows 8.1-2015-01-27-12-56-20.txt Download (28.5 KB) - added by workingman 2 years ago.
Unable to load r3 model in new test build and others
VBoxStartup.20.log Download (28.8 KB) - added by deaforange 2 years ago.
VBox.3.log Download (3.4 KB) - added by fpabernard 2 years ago.
Vbox.log
Logs.zip Download (31.1 KB) - added by mip1983 2 years ago.
Error starting virtual machine with 4.3.28
VBox-4.3.28r100309_failed_to_start.log Download (112.3 KB) - added by NumericOverflow 2 years ago.
VBox-4.3.28r100309_failed_to_start Log
VBoxStartup.21.log Download (20.9 KB) - added by ErikTheRed 2 years ago.
Startup log for 4.3.28
VBoxStartup.3.zip Download (5.5 KB) - added by Mark Lobo 23 months ago.
VirtualBox_VM_4.3.12_r93733_win_amd64_May_16_2014.log Download (2.4 KB) - added by FeyanGur 23 months ago.
8ab7c520-2442-4b66-8d74-4ff1e195d2b6
VBoxHardening.log Download (31.9 KB) - added by Bill.Coats 20 months ago.
VBoxHardening.log
VBoxHardening.2.log Download (231.0 KB) - added by pa_ 11 months ago.
log
VBoxHardening.3.log Download (210.6 KB) - added by keremer 8 months ago.
VBoxHardening.log Win7 Ultimate causing shell32.dll Hardening error
Andersen2025857-Logs.zip Download (60.9 KB) - added by Andersen2025857 7 months ago.
Rambo_VBoxHardening20161122.zip Download (19.9 KB) - added by rambo_ivanov 7 months ago.
VMs fail to start. Any help will be appreciated. Thanks!

Change History

comment:1 follow-up: ↓ 132 Changed 3 years ago by yesoos

This issue was already noticed in 4.3.14 RC1:

 https://forums.virtualbox.org/viewtopic.php?f=15&t=62557  https://forums.virtualbox.org/viewtopic.php?f=15&t=62556

Comment that explains this behavior from Frank Mehnert:

"The problem is not the virus scanning engine but the habit of virus scanners to map certain DLLs into Windows processes. VirtualBox 4.3.14 has extended hardening features which may conflict with virus scanners. We did several tests but obviously didn't catch every case. The final 4.3.14 release contains more fixes in this regards but I've read in other topics that certain users have still problems :-("

I'm also having the same issue in final version

comment:2 Changed 3 years ago by pquiring

I'm having the same issue on all my systems. One is Win7 x64 and another is Win8 x64. Neither has anti-virus installed (Chrome is my AV). I've gone back to 4.3.12 in the mean time.

Last edited 3 years ago by pquiring (previous) (diff)

comment:3 Changed 3 years ago by AxelFontaine

Some here. No AV installed.

comment:4 Changed 3 years ago by pquiring

I uninstalled and reinstalled and now it work.

comment:5 Changed 3 years ago by frank

  • Summary changed from Showstopper! VirtualBox 4.3.14 can't start VMs on Win 8.1 x64 to VirtualBox 4.3.14 can't start VMs on certain Windows hosts

Using this ticket as a collection of information. Similar problems reported by other users in tickets #13189, #13193, #13196, #13198, #13200, #13201, #13206, #13208, #13217, #13219.

comment:6 Changed 3 years ago by frank

A few general information about this problem with VBox 4.3.14:  https://forums.virtualbox.org/viewtopic.php?f=25&t=62618

Only VBox on Windows is affected. We are working on releasing an update ASAP but this update should contain fixes for as many setups as possible. Therefore the more detailed information you provide, the better the chance to get your setup considered in the fixed version. Thank you!

comment:7 Changed 3 years ago by frank

For all affected users, here is a test build which has the following improvements:

  • Startup time, especially the VM selector.
  • Issues that the DISABLEUSERCALLBACKEXCEPTION registry change fixes
  • supR3HardenedWinReSpawn error -104.
  • Norton Endpoint Protect / sysfer.dll

Any feedback is welcome!

comment:8 Changed 3 years ago by frank

Please keep in mind that this test build will not fix yet all known problems, only the listed problems above!

comment:9 Changed 3 years ago by msayed1977

My issue (#13206) got better, but VM still doesn't start with the test build.

comment:10 Changed 3 years ago by frank

msayed1977, could you be more specific? Could you post the error message you see now?

comment:11 Changed 3 years ago by frank

Oh sorry, missed #13206.

comment:12 Changed 3 years ago by frank

Still, please post the screen shot of the current error message.

comment:13 Changed 3 years ago by nocnokneo

VirtualBox-4.3.15-95171-Win.exe fixes the first problem that I was having with 4.3.14 (I wasn't able launch VirtualBox Manager at all), but I get the BSOD when launching my VM.

To help characterize the problem, assuming my issue is virus scanner related, this is what I'm running:

  • Windows 7 64-bit
  • McAfee Host Intrusion Prevention 8.0
  • McAfee Agent 4.6.0.3122
  • McAfee VirusScan Enterprise 8.8.0.849
  • McAfee Endpoint Encryption Agent 1.2.1.315
  • Endpoint Encryption for PC 6.2.1.315
Last edited 3 years ago by nocnokneo (previous) (diff)

comment:14 Changed 3 years ago by msayed1977

I get the following message:

Failed to open a session for the virtual machine Win98SE.

The virtual machine 'Win98SE' has terminated unexpectedly during startup with exit code 1.

Result Code: E_FAIL (0x80004005) Component: Machine Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

The good thing is that I no longer get the error dialog box attached to ticket #13206. Previously, I got the mentioned message after the error dialog box.

Last edited 3 years ago by msayed1977 (previous) (diff)

comment:15 Changed 3 years ago by bird

New build available: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95226-Win.exe

This should hopefully fix some of those E_FAIL issues. For more details see:  https://forums.virtualbox.org/viewtopic.php?f=6&t=62615&p=294202#p294202

comment:16 Changed 3 years ago by yesoos

This new build does the trick with starting for me (win 8.1 x64, Kaspersky Internet Security 2014). Though VMs seem starting up slower than they did.

comment:17 Changed 3 years ago by msayed1977

VirtualBox-4.3.15-95226-Win works for me, but I think seams to start VM and Windows slower than VirtualBox 4.3.12 did.

BTW, I use Kaspersky Internet Security 2015, but I am disabling protection.

Last edited 3 years ago by msayed1977 (previous) (diff)

comment:18 follow-up: ↓ 19 Changed 3 years ago by MaxR

VirtualBox-4.3.15-95226-Win works for me, too, but I need to disable USB controller to start VMs because I do not have the corresponding extension pack. That still prevents some Windows VMs to load because I have a USB mouse. The original error seems to have been resolved, though. I am using Kaspersky Internet Security 2014 with protection enabled. Thanks.

comment:19 in reply to: ↑ 18 Changed 3 years ago by msayed1977

Replying to MaxR:

VirtualBox-4.3.15-95226-Win works for me, too, but I need to disable USB controller to start VMs because I do not have the corresponding extension pack. That still prevents some Windows VMs to load because I have a USB mouse. The original error seems to have been resolved, though. I am using Kaspersky Internet Security 2014 with protection enabled. Thanks.

I think the test version can work with the extension pack of VirtualBox 4.3.12.

Changed 3 years ago by SquirrellyOne

extension pack error

comment:20 Changed 3 years ago by SquirrellyOne

The 95226 build also seems to have eliminated my errors. I was getting that "terminated unexpectedly" error. My system consists of a Windows 8.1 host running on an Intel J2900 processor with McAfee firewall/virus protection. The Windows XP guest is now running, although there are still glitches I am trying to address. As part of that process, I have attempted to install the extension pack 4.3.14-95030, but I keep getting errors on attempting that, which I mention here because it includes an e_fail like the ones mentioned above. I have attached a picture of the error to this ticket. However, I cannot figure out how to get it to display in this box. Let's see if this works: https://www.virtualbox.org/attachment/ticket/13187/error.jpg If it doesn't, check the attachments list or the post right before this one. Anyway, the 95226 build did fix my initial errors.

Last edited 3 years ago by SquirrellyOne (previous) (diff)

Changed 3 years ago by GRA

Error E_FAIL, Build 95226, Comodo AV

Changed 3 years ago by GRA

Build 95226, Comodo AV, Startup Log

comment:21 Changed 3 years ago by GRA

Build 95226 fixes startup error (Failed to install NtCreateSection monitor) when using Comodo AV.

However, when starting a VM in build 95226, error E_FAIL: Error E_FAIL, Build 95226, Comodo AV

Attached VBoxStartup.log

Windows 8.1 x64 + COMODO 7.0.317799.4142 (enabled or disabled, same error)

Last edited 3 years ago by GRA (previous) (diff)

comment:22 follow-ups: ↓ 23 ↓ 29 Changed 3 years ago by bird

New test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe Should address the E_FAIL / exit code 0xc0000005 issue with Avast! and hopefully some others AV vendors.

Enjoy,

bird.

comment:23 in reply to: ↑ 22 ; follow-up: ↓ 24 Changed 3 years ago by smilzo

Replying to bird:

New test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe Should address the E_FAIL / exit code 0xc0000005 issue with Avast! and hopefully some others AV vendors.

Enjoy,

bird.

Windows 7 pro x64 with Comodo AV 7.0.317799.4142 working, but I cannot start some VM with saved state cause the "Implementation of the USB 2.0 controller non found!" error, and I cannot disable the USB with the saved state (extension 4.3.12).

Version 2, edited 3 years ago by smilzo (previous) (next) (diff)

comment:24 in reply to: ↑ 23 Changed 3 years ago by speedre

Replying to smilzo:

Replying to bird:

New test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe Should address the E_FAIL / exit code 0xc0000005 issue with Avast! and hopefully some others AV vendors.

Enjoy,

bird.

Windows 7 pro x64 with Comodo AV 7.0.317799.4142 working, but I cannot start some VM with saved state cause the "Implementation of the USB 2.0 controller non found!" error, and I cannot disable the USB with the saved state (extension 4.3.12). Updated extension to 4.3.14.95030 and it's ok.

Is working with Windows 8.1 Enterprise (64 bits) and Trend Micro.

comment:25 Changed 3 years ago by Shevchik

I have BSOD with https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe, when i start guest VM =(( Win7 SP1 x64 Error code 0x0000003b (0x00000000c0000005, 0xfffff88005561c77, 0xfffff88008ae4c50, 0x0000000000000000)

Last edited 3 years ago by Shevchik (previous) (diff)

comment:26 Changed 3 years ago by msayed1977

I tried the test build, and there is a problem in mouse capturing.

Changed 3 years ago by jvon

comment:27 Changed 3 years ago by Flux

When trying to launch a VM, I get a popup saying "Failed to create a new session." with the following details: [Callee RC: REGDB_E_CLASSNOTREG (0x80040154)]

"Then an additional popup saying "Failed to open a session for the virtual machine MACHINE_NAME. The virtual machine 'MACHINE_NAME' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in X:\MACHINE_LOCATION\MACHINE_NAME\Logs\VBoxStartup.log"

with the following details: [Result Code: E_FAIL (0x80004005) Component: Machine Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}]

I have posted my log here:  https://paste.ee/r/7ySsH

When exiting VirtualBox after this failure, I get a popup saying "Runtime Error! Program: C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe R6025 -pure virtual function call"

If any other info is required, please contact me directly at kronflux@g mail.com

Last edited 3 years ago by Flux (previous) (diff)

Changed 3 years ago by northpole

Error opening VirtualBox on Windows 7 64 bit with Kaspersky Internet Security

comment:28 follow-up: ↓ 31 Changed 3 years ago by northpole

I am having similar problem with VirtualBox-4.3.14-95030-Win.exe. After installing the new version, when the application is opened from start menu or desktop icon, I get the following error. Not able to even open the app GUI, forget the VMs. Running on:

  • Windows 7 64 bit.
  • Kaspersky Internet Security v14.

Error opening VirtualBox on Windows 7 64 bit with Kaspersky Internet Security

comment:29 in reply to: ↑ 22 Changed 3 years ago by paul-sh

Replying to bird:

New test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95286-Win.exe Should address the E_FAIL / exit code 0xc0000005 issue with Avast! and hopefully some others AV vendors.

Enjoy,

bird.

4.3.15-95286 fixed the "supR3HardenedWinReSpawn error -104" problem for me. Windows 7 x64

-- Paul

Changed 3 years ago by 72gab

comment:30 Changed 3 years ago by 72gab

I am having the same problem when Sysmon is installed from  http://technet.microsoft.com/en-us/sysinternals/dn798348

Edit: Build 4.3.15-95286 fixed this problem.

Last edited 3 years ago by 72gab (previous) (diff)

comment:31 in reply to: ↑ 28 Changed 3 years ago by Petr Vones

Same issue with 4.3.14, Failed to verify process integrity ... Windows 7 x64 host, no third-party AV or firewall installed. Reverted back to 4.3.12.

Last edited 3 years ago by Petr Vones (previous) (diff)

comment:32 Changed 3 years ago by Eric McIntyre

Same issue -- Win 7 Pro, using ESET NOD32 Antivirus 4. Build 4.3.15-95286 also fixed it for me.

comment:33 Changed 3 years ago by AZ

4.3.15r95286 still broken for me (Win7 x64, AV tools installed) with an E_FAIL. Critical log section is:

183c.cd8: supR3HardenedWinDoReSpawn(1): New child 15d0.1a80 [kernel32].
183c.cd8: supR3HardenedWinPurifyChild: PebBaseAddress=000007fffffd6000 cbPeb=0x380
183c.cd8: supR3HardNtPuChFindNtdll: uNtDllParentAddr=0000000077070000 uNtDllChildAddr=0000000077070000
183c.cd8: supR3HardNtPuChTriggerInitialImageEvents: pvLdrInitThunk=000000007709c340 pvNtTerminateThread=00000000770c17e0
183c.cd8: Error (rc=-5640):
183c.cd8: More than one thread in process

comment:34 follow-up: ↓ 35 Changed 3 years ago by AnrDaemon

VirtualBox-4.3.15-95286-Win

Dr.Web 8

       Dr.Web for Windows 
        Dr.Web for Windows (8.2.1.08220) 

       Dr.Web (R) Virus-Finding Engine 
        drweb32.dll (7.00.9.04080) 

       Dr.Web Scanning Engine 
        dwengine.exe (8.3.0.10280 (Build 9476)) 

       Dr.Web Anti-Rootkit Server 
        dwarkdaemon.exe (8.3.0.10280 (Build 9476)) 

       Dr.Web Anti-rootkit API 
        dwarkapi.dll (8.6.0.20138190) 

       Dr.Web Windows Action Center Integration 
        dwsewsc.exe (9.0.4.10280 (Build 10027)) 

       Dr.Web Control Service 
        dwservice.exe (8.1.0.04300) 

       Dr.Web Updater 
        drwupsrv.exe (8.0.6.10170) 

       SpIDer Agent for Windows 
        spideragent.exe (8.1.1.05122) 

       SpIDer Agent admin-mode module for Windows 
        spideragent_adm.exe (8.1.1.05122) 

       Dr.Web Scanner SE 
        dwscanner.exe (8.3.0.08070) 

       Dr.Web Console Scanner 
        dwscancl.exe (8.3.0.10280 (Build 9476)) 

       Dr.Web File System Monitor 
        spiderg3.sys (8.0.3.01110) 

       Dr.Web Protection for Windows 
        dwprot.sys (8.1.0.01173) 

       Net filtering service 
        dwnetfilter.exe (8.0.7.07121) 

       Dr.Web Net Filter® for Windows driver 
        dw_wfp.sys (8.0.0.08150) 

       Dr.Web ® Shell Extension 
        drwsxtn.dll (8.00.1.201309020) 

       Dr.Web SysInfo 
        dwsysinfo.exe (7.00.3.201204270) 

Unable to launch managing interface. It just doesn't come up. After adding VBoxSVC.exe and VirtualBox.exe to the exclude list, it sometimes start, sometimes not. Often coming with errors described above, i.e.

Waiting for VM "Windows 7" to power on...
VBoxManage.exe: error: The virtual machine 'Windows 7' has terminated unexpectedly during startup with exit code 1 (0x1).  More details may be available in '%USERPROFILE%\VirtualBox VMs\Windows 7\Logs\VBoxStartup.log'
VBoxManage.exe: error: Details: code E_FAIL (0x80004005), component Machine, interface IMachine

but more often it throws a system popup "unable to read from 00000000, call from 00000000".

I don't think zeroing out own process memory serves any good, do you?

Also, FIVE MEGA BYTES of

7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\MirandaIM\Plugins\WinampNotify.dll' (fImage=0 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\MirandaIM\Plugins\WinampNotify.dll' (fImage=1 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\Punto Switcher\pshook.dll' (fImage=0 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\Punto Switcher\pshook.dll' (fImage=1 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\RocketDock\RocketDock.dll' (fImage=0 fExecMap=1 fExecProt=1)
7c4.4c4: Error (rc=0):
7c4.4c4: supR3HardenedMonitor_NtCreateSection: Not a trusted location: '\Device\HarddiskVolume1\Program Files\RocketDock\RocketDock.dll' (fImage=1 fExecMap=1 fExecProt=1)

spam in the logs. Really, keyboard switcher/notificator? Now playing plugin? What you are shielding against?... And WHY it crashes at all? You're not antimalware program. Notify the user, and carry on. It's not your responsibility to judge operating system decisions.

comment:35 in reply to: ↑ 34 ; follow-up: ↓ 36 Changed 3 years ago by Petr Vones

I am also wondering what is the feature for ? Providing digitally signed executables is enough from vendor (VirtualBox) side to achieve meaningful level of security. Anything else is user's responsibility. I have no third-party AV (default Windows Defender with disabled real-time protection) and default Windows Firewall. Still having the issue, probably caused by a Lenovo utility or Bluetooth software that hooks into processes.

I am not going to use the 4.3.15 beta because  there is a report of host BSOD in VBoxDrv.sys.

Please revert it back or make the "verify feature" optional or less intrusive.

Replying to AnrDaemon:

You're not antimalware program. Notify the user, and carry on. It's not your responsibility to judge operating system decisions.

comment:36 in reply to: ↑ 35 ; follow-up: ↓ 37 Changed 3 years ago by ramshankar

Replying to Petr Vones:

I am also wondering what is the feature for ? Providing digitally signed executables is enough from vendor (VirtualBox) side to achieve meaningful level of security.


Sorry, we are not allowed to provide more details than what's already available here:  http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

However, I believe Oracle customers may request additional information through existing support channels.

We -are- actively working on fixing this issue pertaining to VirtualBox 4.3.14 and we hope to get in under control soon.

Until then, please continue using 4.3.12 or if you're willing to help out with testing our fixes (we'd much appreciate that), try our the latest test builds from this thread on the forums:  https://forums.virtualbox.org/viewtopic.php?f=6&t=62615 and provide sufficient, relevant feedback. Thanks!

comment:37 in reply to: ↑ 36 Changed 3 years ago by Petr Vones

Thanks, I see. I will wait whether the related CVEs are disclosed, just wondering what is the issue technically. Still can't think of a scenario where VirtualBox process running under limited user account and properly adjusted Software Restriction Policy can be "altered" on image/IAT level. Elevation of privilege via guest additions (CVE-2014-2477) is a different story.

Hope you can resolve it.

Replying to ramshankar:

Sorry, we are not allowed to provide more details than what's already available here

comment:38 follow-up: ↓ 47 Changed 3 years ago by bird

Hi all!

Here is a new test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95599-Win.exe

The major fixes since the last test build are:

  • The VM processes should start up a bit faster now (at least they do here).
  • We've tweaked the way we validate loading of 3rd party DLLs into the process. Must be installed normally and the DLL or their package must be correctly signed. Should help with nvidia detour.dll and a whole bunch of others, we hope. (We won't ever load DLLs without any kind of valid signature.)

Sandboxies users: Don't run VBox in a sandbox, it won't work. Run VBox outside Sandboxie.

We'll be looking closer at the remaining AV issues shortly.

Enjoy, bird.

Last edited 3 years ago by bird (previous) (diff)

comment:39 Changed 3 years ago by AliveNoMore

The latest build (4.3.15-95599) improves things a little compared to the official 4.3.14 but VMs still don't start here. I haven't tested the rest of the test builds. The error is this:

http://i.imgur.com/BduK2RO.png

OS is Windows 8.1 x64 and is completely up-to-date. The only security application installed is Sandboxie but VirtualBox isn't and has never been run inside Sandboxie.

comment:40 Changed 3 years ago by AnrDaemon

We've tweaked the way we validate loading of 3rd party DLLs into the process. Must be installed normally and the DLL or their package must be correctly signed.

Translation from technobabble to normal language: "Great news, everyone! We've invented a way to stop individual developers from making useful programs for windows! Who need those losers, when you have a great Oracle, anyway?"

Just to list a few applications, that your stupid "protection" conflict with:

  1. Download manager (clipboard and shortcut hooks to catch URL's)
  2. Keyboard indicator/switcher. Hotkey hook and more stuff related to layouts and languages. You there in america seems to think that whole world should use one language and be happy? This not gonna work. I use 3 languages and 4 keyboard layouts, and "standard" ways of switching between them doesn't even begin to help.
  3. Dictionary/translator program. Shortcut keyboard hook. Terrible as translator, but kinda fine as a dictionary. Faster, than online dictionaries, at least. And it's right on my fingertips.

None of these programs will see updates (companies that made first and last are closed, and developer of second had passed), and there's no replacements that equal the clean utility of them. If I ever to program something to replace them myself, I won't be able to sign them either. Time to find a better virtualization software, it seems. That does not conflict with operating system...

Last edited 3 years ago by AnrDaemon (previous) (diff)

comment:41 Changed 3 years ago by frank

The Windows design allowing normal applications to mess with libraries of other applications is stupid. VirtualBox is a system application for running virtual machines next to normal processes. For doing this, it needs to use special system interfaces. You don't want to allow normal applications to hook libraries into such a VM process, believe me.

comment:42 Changed 3 years ago by DKHR77

I suggest to implement an additional list of trusted libraries where the vbox user can add such libraries that the hardening feature cannot handle correctly.

The list should be stored encrypted on disk and include hashes for the libraries that the user has trusted explicitely (e.g. by message box "Would you like to trust....Yes/No, Default=No). As long as the hashes still match the tested library, the hardening feature should not raise an error.

comment:43 Changed 3 years ago by AliveNoMore

Just to be clear here. At least in my case, the error occurs without any 3rd party libraries loaded/mapped into the process. I checked VirtualBox.exe with Process Explorer and ALL library files loaded belong to either Microsoft or Oracle, nobody else.

comment:44 Changed 3 years ago by vant

I had all the .dll errors with 4.3.14 and I have installed the new Test release 4.3.15 and I didn't get the error but only Win 8 and Win 2012 guests couldn't not complete their loading and stuck at a blank screen. While Win 2008 R2 and Linux guests worked fine. I had to roll back to a stable release 4.3.12 and all guests worked fine. My host is Win 7 and my AV is MS Security Essentials.

comment:45 Changed 3 years ago by msayed1977

VirtualBox-4.3.15-95599-Win.exe test build does not start VM for me.

VirtualBox-4.3.15-95286-Win.exe test build worked fine for me.

comment:46 Changed 3 years ago by frank

msayed1977, any VBoxStartup.log file for the failing attempt available? Thanks!

comment:47 in reply to: ↑ 38 Changed 3 years ago by yesoos

Replying to bird:

Hi all!

Here is a new test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95599-Win.exe

The major fixes since the last test build are:

  • The VM processes should start up a bit faster now (at least they do here).
  • We've tweaked the way we validate loading of 3rd party DLLs into the process. Must be installed normally and the DLL or their package must be correctly signed. Should help with nvidia detour.dll and a whole bunch of others, we hope. (We won't ever load DLLs without any kind of valid signature.)

Sandboxies users: Don't run VBox in a sandbox, it won't work. Run VBox outside Sandboxie.

We'll be looking closer at the remaining AV issues shortly.

Enjoy, bird.

Latest build speeds up startup time for me, no issues with VM startup found. (Win 8.1 x64 host with KIS 2014 latest installed)

Changed 3 years ago by msayed1977

My startup log

comment:48 Changed 3 years ago by msayed1977

Strange thing:

Without any reasonable reason, VirtualBox-4.3.15-95599-Win.exe works now.

I do not know whether my attached file was for the failing or successful startup.

The problem with mouse capturing is still there especially with non-fullscreen mode.

The non-fullscreen mode is not well-sized.

comment:49 follow-up: ↓ 52 Changed 3 years ago by bird

Hi All!

The 5th test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95663-Win.exe Compared to the 4th:

  • Fixed the -104 respawn errors (still) seen with several AV products.
  • Fixed timing problem with the Avast workaround.
  • Worked around symantec endpoint protection import table patching bug resulting in: "@!#$%&%!.dll is missing from your system"
  • Attempt at curing the sysfrethunk.dll issue (unable to reproduce here).

Please remember to attach an VBoxStartup.log if you want help with your problem. For instance the that div/zero needs more data before I can say whether it has anything to do with the topic here or is a different bug/regression.

Enjoy,

bird.

comment:50 Changed 3 years ago by AnrDaemon

Replying to frank:

The Windows design allowing normal applications to mess with libraries of other applications is stupid.


That's your own, subjective opinion.

I, for one, find it convenient, that I do not need to use root privileges to debug application I work with.

VirtualBox is a system application for running virtual machines next to normal processes.


VirtualBox is a complex of aplications. And it's core is a service, which is not run with normal user credentials (and a "normal user" can do very little about it). Not to mention, you gotta find a way to escape DEP first.

For doing this, it needs to use special system interfaces. You don't want to allow normal applications to hook libraries into such a VM process, believe me.


Believe it or not, you have only two options: play by system rules or be deleted from hard disk. A home could only have one owner. If I said "this program is fine", you have no rights to second-guess my decision. This. Is. My. System. Period.

I have enough issues with antivirus software I use, it gives me regular headaches that I report to developers and have constructive discussion with them.

Doesn't bother me much, as it gets better with each bug squashed. But one is enough. Two programs trying to pretend to be "antivirus solutions" will just not work together.

I said it already, but here it is once more: If you suspect something is amiss, report it to the user. You just can't know, what Windows loader will do with your relocation tables to blindly zeroing your process memory. Reads from address 00000000 will never be successful, mind you.

comment:51 Changed 3 years ago by bird

msayed1977, I've had a look at your logfile (VBoxStartup.3.log). Looks like your windows\system32\user32.dll isn't owned by TrustedInstaller as we expect, but the group Admins. The next test build (6th) will be include a fix for this. Thanks very much for the report.

AnrDaemon, this isn't a discussion forum. While I personally share your opinion about your PC being yours, the security researchers doesn't. These annoying changes we've made to VirtualBox on Windows are in response to reports from these guys. Oracle policy does not allow us to discuss the details, though a summary can be found in the july2014 oracle critical patch update:  http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html#AppendixOVIR

Changed 3 years ago by yesoos

vbox.log, linux mint failing after latest upgrade

comment:52 in reply to: ↑ 49 ; follow-up: ↓ 53 Changed 3 years ago by yesoos

Replying to bird:

Hi All!

The 5th test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95663-Win.exe Compared to the 4th:

  • Fixed the -104 respawn errors (still) seen with several AV products.
  • Fixed timing problem with the Avast workaround.
  • Worked around symantec endpoint protection import table patching bug resulting in: "@!#$%&%!.dll is missing from your system"
  • Attempt at curing the sysfrethunk.dll issue (unable to reproduce here).

Please remember to attach an VBoxStartup.log if you want help with your problem. For instance the that div/zero needs more data before I can say whether it has anything to do with the topic here or is a different bug/regression.

Enjoy,

bird.

In latest version when starting linux mint guest (win 8.1 x64 host with kis 2014) I get software exception (0xc00000094) in location 0x4252af9f. Log file attached. This does not happen instantly, only after you try to log on guest machine.

comment:53 in reply to: ↑ 52 Changed 3 years ago by yesoos

Replying to yesoos:

Replying to bird:

Hi All!

The 5th test build: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95663-Win.exe Compared to the 4th:

  • Fixed the -104 respawn errors (still) seen with several AV products.
  • Fixed timing problem with the Avast workaround.
  • Worked around symantec endpoint protection import table patching bug resulting in: "@!#$%&%!.dll is missing from your system"
  • Attempt at curing the sysfrethunk.dll issue (unable to reproduce here).

Please remember to attach an VBoxStartup.log if you want help with your problem. For instance the that div/zero needs more data before I can say whether it has anything to do with the topic here or is a different bug/regression.

Enjoy,

bird.

In latest version when starting linux mint guest (win 8.1 x64 host with kis 2014) I get software exception (0xc00000094) in location 0x4252af9f. Log file attached. This does not happen instantly, only after you try to log on guest machine.

Same issue with CentOS 7 guest.

comment:54 Changed 3 years ago by AliveNoMore

My error didn't mention any log file. What should I upload then?

Changed 3 years ago by PassinThru

Log for Ubuntu 14.04 guest, Win7 host, build 95663

Changed 3 years ago by PassinThru

Ubuntu 14.04 guest, Win7 host, build 95663

comment:55 Changed 3 years ago by PassinThru

The exception Integer division by zero. (0xc0000094) occurred in the application at location 0xda02af9f.

Running Windows 7 64 with Symantec Endpoint. I see the same failure running my Ubuntu 14.04 x64 guest as yesoos mentioned in comment 52. I've attached the Vbox.log and VboxStartup.zip.

I've moved back to the 95286 build, the last one I could successfully boot.

comment:56 Changed 3 years ago by PassinThru

BTW, uninstalling 95663 requires force closing by the uninstall process of the VirtualBox Interface, followed by a mandatory reboot.

comment:57 Changed 3 years ago by bird

Here's a new test build, the 6th: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.15-95713-Win.exe

Fixes compared to the 5th:

  • Fixed 3D regression that often manifested itself as a zero division crash.
  • Relaxed ownership requirements a little to allow Tumbleweed Desktop Validator CAPI dlls to load. (DLL owner must be TrustedInstaller or System now.)

Hope this solves the outstanding issues for most of you.

Enjoy,

bird.

Last edited 3 years ago by bird (previous) (diff)

comment:58 Changed 3 years ago by msayed1977

In the sixth build:

When I go from windowed to fullscreen, I get the attached error.(ErrorWhenSwitchToFullScreen.png)

Changed 3 years ago by msayed1977

Changed 3 years ago by AliveNoMore

comment:59 Changed 3 years ago by AliveNoMore

Even with the latest build I still get the same error. I have attached an archive with fresh logs (ANMLogs.zip).

comment:60 follow-up: ↓ 65 Changed 3 years ago by bird

AliveNoMore: Could you attach c:\windows\system32\uxtheme.dll, please? Would also (or alternatively) be real cool if you could check what SysInternals sigcheck (  http://technet.microsoft.com/en-us/sysinternals/bb897441.aspx ) has to say about it: sigcheck -i -a -h c:\windows\system32\uxtheme.dll

comment:61 Changed 3 years ago by AliveNoMore

If all you need to know is whether the file has been modified, I can tell you right now that I have indeed patched it with a patcher so I can use other themes. I can attach it and/or run Sigcheck if you still need more than the information I gave you.

Last edited 3 years ago by AliveNoMore (previous) (diff)

comment:62 Changed 3 years ago by efa

in this related bug https://www.virtualbox.org/ticket/13317 the error appear on every starting of VirtualBox application, while then starting a VM work as exected.

comment:63 Changed 3 years ago by vmuser2014

The latest update, build 6, does not resolve this problem for me. I can not start VMs.

  • Installed: VirtualBox-4.3.15-95713-Win
  • OS: Windows 7 64bit
  • Virus Scanner: Microsoft System CenterEndpoint
  • Also Installed: Digital Guardian from Verdasys

Error Prompt: "The instruction at 0x00030288 referenced memory at 0x00030288. The memory could not be written."

Result Code: E_FAIL (0x80004005)

comment:64 Changed 3 years ago by Squall Leonhart

I have found a bug in VirtualBox-4.3.15-95713-Win involving the ICH8 sata controller and mapping optical drives to drives on the host.

The bug causes the guest to crash immediately after the Oracle Virtualbox boot screen.

The issue is not present when the mapped drive is hosted on the emulated IDE controller, nor was it present in 4.3.14. It does not affect directly mounted iso's either.

edit Checking passthrough appears to make the host mapped drives work on the vbox sata controller

Last edited 3 years ago by Squall Leonhart (previous) (diff)

comment:65 in reply to: ↑ 60 Changed 3 years ago by AliveNoMore

Replying to bird:

AliveNoMore: Could you attach c:\windows\system32\uxtheme.dll, please? Would also (or alternatively) be real cool if you could check what SysInternals sigcheck (  http://technet.microsoft.com/en-us/sysinternals/bb897441.aspx ) has to say about it: sigcheck -i -a -h c:\windows\system32\uxtheme.dll

So, will there be a fix for this problem? If not, are there any workarounds for it?

comment:66 Changed 3 years ago by msayed1977

In the seventh test release:

Still makes an error and stops VM when switching from windowed to fullscreen. There are still mouse capturing problems.

Last edited 3 years ago by msayed1977 (previous) (diff)

comment:67 follow-up: ↓ 68 Changed 3 years ago by frank

VBox 4.3.16 released. It should fix the problems reported in this ticket for many users. Feedback welcome!

comment:68 in reply to: ↑ 67 Changed 3 years ago by ScottDeagan

Just installed 4.3.16 - I have a number of Ubuntu 14.04 Server (64 bit) guests on a Windows 8.1 host, all worked first time. Nice work, many thanks :)

Replying to frank:

VBox 4.3.16 released. It should fix the problems reported in this ticket for many users. Feedback welcome!

comment:69 Changed 3 years ago by AliveNoMore

The problem I was having (presumable with the patched uxtheme.dll) is not gone, and the VM actually runs. However, it is quite slow to start: from the moment I click Start to the moment it begins to actually load the guest OS it takes a while, before it needed a few seconds.

Changed 3 years ago by Fabian23

comment:70 follow-up: ↓ 72 Changed 3 years ago by Fabian23

Hi, I've just uploaded a screenshot of the error I'm having when trying to start any VM. here the details:

Failed to open a session for the virtual machine test.

The virtual machine 'test' has terminated unexpectedly during startup with exit code 1.

Result Code: E_FAIL (0x80004005) Component: Machine Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

i have Trend micro office scan enabled but it doesn't report any issues during operations. Any help? thanks

comment:71 Changed 3 years ago by yesoos

Still having random "Memory could not be read" errors during VM runtime (mostly when stopping them). Latest 4.3.16 build, Win 8.1 6rbit host, KIS 2014

comment:72 in reply to: ↑ 70 Changed 3 years ago by Fabian23

Replying to Fabian23:

Hi, I've just uploaded a screenshot of the error I'm having when trying to start any VM. here the details:

Failed to open a session for the virtual machine test.

The virtual machine 'test' has terminated unexpectedly during startup with exit code 1.

Result Code: E_FAIL (0x80004005) Component: Machine Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

i have Trend micro office scan enabled but it doesn't report any issues during operations. Any help? thanks

UPDATE:VBox 4.3.16 release fixed my issue!!!

comment:73 Changed 3 years ago by GoldieLin

Confirmed, 4.3.16 works again.

OS: Windows 7 Pro 64bit. AntiVirus: Avira Free Antivirus.

4.3.12 works fine, 4.3.14 not worked, 4.3.16 works again.

comment:74 Changed 3 years ago by smilzo

With 4.3.16 my virtual machines do not start, stuck on "Creating process for virtual machine xxx (GUI/QT) ... (1/2)"

OS: Windows 7 Pro 64bit. AntiVirus: Avast free

Replaced Avast with Comodo Antivirus and works fine. Before full O.S. reinstall, with avast installation, 4.3.14 was not working with Comodo, but solved with 4.3.15 update.

Looks like ticket #13367

comment:75 Changed 3 years ago by te7

4.3.16 doesn't work on Windows 7 SP1 64 bit Home Premium host. Using Norton Internet Security 2014. 4.3.12 works fine. With 4.3.16 VMs never open, with nothing but spinning circle. Can't stop virtualbox.exe processes in task manager. Have to reboot host with power button.

Changed 3 years ago by Marki555

unable to start VM on 4.3.16

Changed 3 years ago by Gabee

VirtualBox - Error E_Fail

comment:76 Changed 3 years ago by Gabee

Hi my problem this: https://www.virtualbox.org/attachment/ticket/13187/VirtualBox%20-%20Error.png Uninstall ad reinstall (delete .virtualbox folder and vm machine folder)VirtualBox 4.3.16 and problem not solved!

comment:77 Changed 3 years ago by wouterk__

On both my main machines (ASUS motherboards with AMD processors) I get the same "exit code 1" error message as Gabee when I try to start any VM (existing and newly created ones alike).

The VBoxStartup.log I'm attaching occurred with an old DOS VM (which I haven't touched in years), but it's basically the same for all my VMs: obviously the error occurs before the state of the actual VM comes into play.

This problem was definitely introduced in 4.3.16: reverting to 4.3.14 resolves this problem.

Host OS: Windows 7 64-bit Professional + SP1 with all the latest Windows Update patches applied
Anti-virus software: none

Changed 3 years ago by wouterk__

DOS VM refusing to start with "Exit code 1"

comment:78 Changed 3 years ago by CED

Win 7 64bit Host same problems

update vbox to 4.3.16 give errors

update microsoft Security Essential to 4.6.305 breaks vbox 4.3.14, vbox 4.3.12 seems safe

comment:79 Changed 3 years ago by wouterk__

I've discovered that my "exit code 1" error concerned comctl32.dll, and that it is fixed by bird's "test build #1", https://www.virtualbox.org/download/testcase/VirtualBox-4.3.17-96047-Win.exe, mentioned in  https://forums.virtualbox.org/viewtopic.php?f=6&t=63556.

With this test build #1 all things are working for me again. Thanks!

@Gabee and CED: you may want to look at the above-mentioned thread: other tests builds are available that may fix your problems too.

Last edited 3 years ago by wouterk__ (previous) (diff)

comment:80 Changed 3 years ago by Eric McIntyre

I did a straight upgrade from the 4.3.15 test build to 4.3.16 and the problem returned. I uninstalled VirtualBox, restarted the system, and installed 4.3.16 again. After that, I was able to launch my virtual machines.

My configuration again: Win 7 Pro, ESET NOD32 Antivirus 4.

comment:81 Changed 3 years ago by fcporto

I too have this problem with version 4.3.16 running on window 7 x64, but not when i downgrade to version 4.3.12. I also have avast AV running.

Is there a solution other than running 4.3.12?

Also, i am able to stop the process virtualbox.exe, which in turn prevents windows from shutting down properly; i'm forced to do a hard reset (this only happens after i try to run a VM).

Changed 3 years ago by IainMD

verify_process_integrity_error

comment:82 Changed 3 years ago by IainMD

https://www.virtualbox.org/attachment/ticket/13187/VirtualBox%20Error.png

I too have an AV related error:

Failed to verify process integrity:(rc=-5662) Please try reinstalling VirtualBox.

Windows 8.1 Enterprise with Update Symantec Endpoint Protection 12.1.3001.165 VirtualBox anything newer than 4.3.12

comment:83 Changed 3 years ago by SWAT

Virtualbox 4.3.16 is still broken with the same error as is detailed in this bug report. OS: Windows 7 professional, 64-bit AV: Trend Micro OfficeScan

comment:84 Changed 3 years ago by frank

Could you check the latest Windows test build from here?

comment:85 Changed 3 years ago by fcporto

Hi Frank,

The latest build (Windows, r96235 or VirtualBox-4.3.17-96235-Win) worked for me; i was able to start the VMs without any issues.

THX :)

Running windows 7 Ultimate x64 SP1 with Avast AV

comment:86 Changed 3 years ago by frank

New test build here. This fixes some problems with NAT (see #13292) as well as a few other problems. Feedback welcome!

comment:87 Changed 3 years ago by Svyat

I figured out what makes this issue to be on my system. This is because of patched system files like uxtheme.dll, setupapi.dll, kernel32.dll, msvcrt.dll. I applied several WinXP patches that brakes digital signature, but I suppose that these patches are vital: 1) UxTheme.dll patch to support unsigned themes. 2) setupapi.dll patch to disable splash of Driver Installation Wizard. 3) kernel32.dll patch to extend kernel functions like GetTickCount64 etc. 4) msvcrt.dll patch to extend msvc functions like _except_handrel4_common etc.

I think there should be some commits to skip digital signature checking for those files I have listed above.

I know that these patches are unofficial, but they are popular, lots of people are using them, specially UxTheme and setupapi patch. Also many people patching shell32.dll to change its resources and other resource depending files. So I suppose this digital signature "update" has much lower severity than failures that people may face.

Last edited 3 years ago by Svyat (previous) (diff)

Changed 3 years ago by jamestdi

latest build error

Changed 3 years ago by jamestdi

Failed integrity with older builds

comment:88 Changed 3 years ago by jamestdi

Just tried the latest build 4.3.17-96342 and still get the same failure error, with the installation never completing as the rollback kicks in . I tried installing older builds (both 4.x and 3.x) and would then get the "failed to verify process integrity" error (see my attachments). Can't win.

BTW - I'm running the McAfee endpoint suite 8.0 (AV, Anti-spyware, Endpoint Encryption).

Last edited 3 years ago by jamestdi (previous) (diff)

comment:89 Changed 3 years ago by fcporto

I see people are still having issues, i can definitely say build 4.3.17-96235 worked for me; is there a big difference between 4.3.17-96342 and 4.3.17-96235?

comment:90 Changed 3 years ago by Oli

Just tried 3.1.17-96342 After trying to upgrade to 3.1.16 and getting the error:

Failed to open a session for the virtual machine Media.

The VM session was aborted.

Result Code: E_FAIL (0x80004005) Component: SessionMachine Interface: ISession {12f4dcdb-12b2-4ec1-b7cd-ddd9f6c5bf4d}

Host: Win7 x64 Client: WinXP (multiple machines tried) AVG installed / disabled.

comment:91 Changed 3 years ago by frank

Here is a new test build. It hopefully fixes more problems. Feedback welcome!

comment:92 Changed 3 years ago by xorred

Windows 8.1 Enterprise + Webroot AV - stuck on "Creating Process for virtual machine". VirtualBox 4.3.16 and your latest test image too (https://www.virtualbox.org/download/testcase/VirtualBox-4.3.17-96443-Win.exe) After reboot 1 virtual machine can start. Shut it down, start another - it says "creating process for virtual machine" forever. On reboot shows some error messages I cannot screenshot because... its on reboot.

Last edited 3 years ago by xorred (previous) (diff)

comment:93 Changed 3 years ago by Svyat

VBOX 4.3.17-96443-Win Windows Server 2003 SP2 x86 RUS (patched msvcrt.dll, kernel32.dll, uxtheme.dll, setupapi.dll) Failed to start Virtual Machine.

logs and screenshot:  http://rghost.ru/58435042

comment:94 Changed 3 years ago by jandesen

I have the same issue as xorred, except I have avast! Antivirus. My issue is more extreme in that it does not stop creating the process (even if I hit cancel), and the process will not close. If I attempt to shut down my computer the computer will not shut down because Windows cannot close the process (and thus can't shut down) so I have to power off the computer manually. This started in 4.3.14 and has persisted in 4.3.16 . One thing I have noticed is that if the video memory is set to 16 MB (the default) the VMs usually work, however anything above that causes the indefinite creating process issue. My computer can handle the 128-256MB video memory because I've never had problems with it before and nothing significant has changed about my setup. I have reintalled 4.3.16 multiple times to no avail. I'm attempting to install 4.3.17 however it keeps failing to install and the 4.3.16 uninstaller says it works but doesn't actually do anything.

comment:95 Changed 3 years ago by fcporto

@ jandesen....go with version 4.3.17-96235....it works

comment:96 Changed 3 years ago by jandesen

4.3.17-96342 fixed the problem for me

comment:97 Changed 3 years ago by frank

VBox 4.3.18 contains the latest fixes.

comment:98 Changed 3 years ago by xorred

4.3.18 does not fix anything for me. Same as above, same as the jandesen issue plus more info - I started 3 VMs in parallel (after upgrading and rebooting) - just fine. As soon as I shut one of them off - no other VM could be started, even though the other 2 were still running. It does not matter which guest OS is shut. As soon as you shut one - can't start another. THat was the same before as well. Oh, this just in - they can't be shut down fully either. As soon as the issue appears - shutdown never finishes (linux, windows guests) - can't even use the close button of the guest OS and have to reboot the host by force.

Here are what my processes look like:  http://s8.postimg.org/orl983eo5/Capture.png

Last edited 3 years ago by xorred (previous) (diff)

comment:99 Changed 3 years ago by Svyat

GOOD JOB VBOX TEAM! 4.3.18 finally fixed this issue for me on Windows Server 2003 with patched system files!

comment:100 Changed 3 years ago by Flos

May I know if the root cause of this issue is really found? Or the related code is pinpointed? Thanks!

comment:101 follow-up: ↓ 102 Changed 3 years ago by ntk

Having this issue after an upgrade from VB 4.3.12 to 4.3.18, Windows 7 Pro x64 host (version 6.1 Build 7601 SP1), using UltraUXThemePatcher to customize themes/uxtheme.dll

Error dialog:

Failed to open a session for the virtual machine XXXXXX.

Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790 (VERR_UNRESOLVED_ERROR).

Result Code: E_FAIL (0x80004005)
Component: Console
Interface: IConsole {8ab7c520-2442-4b66-8d74-4ff1e195d2b6}

VBox.log:

00:00:02.095148 VMSetError: C:\tinderbox\win-4.3\src\VBox\VMM\VMMR3\PDMLdr.cpp(307) int __cdecl pdmR3LoadR3U(struct UVM *,const char *,const char *); rc=VERR_UNRESOLVED_ERROR
00:00:02.095155 VMSetError: Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790
00:00:02.097166 ERROR [COM]: aRC=E_FAIL (0x80004005) aIID={8ab7c520-2442-4b66-8d74-4ff1e195d2b6} aComponent={Console} aText={Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790 (VERR_UNRESOLVED_ERROR)}, preserve=false
00:00:02.136170 Power up failed (vrc=VERR_UNRESOLVED_ERROR, rc=E_FAIL (0X80004005))
00:00:02.159682 UIMachineView::storeGuestSizeHint: Storing guest size-hint for screen 0 as 640x480
00:00:02.167189 supR3HardenedErrorV: supR3HardenedScreenImage/LdrLoadDll: cached rc=VERR_LDRVI_NOT_SIGNED fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=512 \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
00:00:02.167268 supR3HardenedErrorV: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\system32\uxtheme.dll': rcNt=0xc0000190

sigcheck:

 sigcheck -i -a -h c:/windows/system32/uxtheme.dll

Sigcheck v2.1 - File version and signature viewer
Copyright (C) 2004-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

c:\windows\system32\uxtheme.dll:
        Verified:       Unsigned
        Link date:      9:34 PM 7/13/2009
        Publisher:      Microsoft Corporation
        Description:    Microsoft UxTheme Library
        Product:        Microsoft▒ Windows▒ Operating System
        Prod version:   6.1.7600.16385
        File version:   6.1.7600.16385 (win7_rtm.090713-1255)
        MachineType:    64-bit
        Binary Version: 6.1.7600.16385
        Original Name:  UxTheme.dll.mui
        Internal Name:  UxTheme.dll
        Copyright:      ▒ Microsoft Corporation. All rights reserved.
        Comments:       n/a
        Entropy:        6.318
        MD5:    2E08363A75712E753F4D5B3B34531584
        SHA1:   323190CD2C21152DF3DEDFEE1CA701F11E355A01
        PESHA1: 578AB85BF149ED25EA7FF460A4A5587C358F87A2
        PE256:  ED5609FFC7BAE0ED78268412C94F4C9DCC9846373D5FC0D19E577B2F7825ED71
        SHA256: 66FD0A342D0C56F2D73EDC7EE4C0F7DC3C8AB3AB77BE1A8F5083F6984F4BE754

Last edited 3 years ago by ntk (previous) (diff)

comment:102 in reply to: ↑ 101 Changed 3 years ago by mhanor

@ntk
After modifying its content, the file must be re-signed. The existing signature is not valid. If you look closer at the sigcheck output, you'll see the line "Verified: Unsigned".

comment:103 Changed 3 years ago by Ritter

Alright, I jumped through all the hoops to digitally sign both the 32-bit and the 64-bit versions of my uxtheme.dll. It's my only modified system DLL.

It seems that may not have been the problem causing this error on my system, since the log doesn't actually mention it.

Using vbox 4.3.18 r96516

00:00:01.725588 VMSetError: C:\tinderbox\win-4.3\src\VBox\VMM\VMMR3\PDMLdr.cpp(307) int __cdecl pdmR3LoadR3U(struct UVM *,const char *,const char *); rc=VERR_UNRESOLVED_ERROR
00:00:01.725594 VMSetError: Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790
00:00:01.851856 ERROR [COM]: aRC=E_FAIL (0x80004005) aIID={8ab7c520-2442-4b66-8d74-4ff1e195d2b6} aComponent={Console} aText={Unable to load R3 module C:\Program Files\Oracle\VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790 (VERR_UNRESOLVED_ERROR)}, preserve=false
00:00:01.899456 Power up failed (vrc=VERR_UNRESOLVED_ERROR, rc=E_FAIL (0X80004005))
00:00:02.108378 UIMachineView::storeGuestSizeHint: Storing guest size-hint for screen 0 as 640x480

comment:104 Changed 3 years ago by Ritter

Ah, no, indeed. It's rejecting an Explorer extension. Had to look in the VBoxStartup.log file which I just learned is separate from the VBox.log file and it not listed in the "show log" dialog box. What a stupid hassle. edit: I mean, the whole process (including setting up a certificate) has felt like a needless waste of time. The fact that the log isn't listed with the others is only a minor thing.

I'm not feeling particularly "safe" now from an unspecified threat that Oracle won't even tell me about. I'm just feeling annoyed. RIP, Sun.

I'd like to know how to disable this antivirus feature of VirtualBox, please. I'm no stranger to compiling, so if making a source change and building it myself is necessary, go on.

Last edited 3 years ago by Ritter (previous) (diff)

comment:105 Changed 3 years ago by tgp1994

@Ritter Supposedly, VBox 4.3.12 is the latest version that does not have this new security feature - in the interest of keeping you running, have you tried downgrading to that version while a fix is being developed? (There is a test build  4.3.19 (rev 96923) that may potentially fix the problem, if you're feeling adventurous.)

comment:106 follow-up: ↓ 107 Changed 3 years ago by Ritter

Hmm. It's unclear to me whether the fact that we can't have modified DLL's loaded by Windows is considered a "problem" that is currently in the process of being fixed. Your post suggests that, but the impression I get from the rest of the discussion is that it's a design decision that isn't going away.

4.3.12 is working. 4.3.19 continues to reject an Explorer extension I have that adds the ability to right-click the minimize button on a window to "minimize" it to the notification area.

Last edited 3 years ago by Ritter (previous) (diff)

comment:107 in reply to: ↑ 106 Changed 3 years ago by tgp1994

Glad the older one is working for you! Sorry for any confusion I may have caused in my previous post, I totally agree that this feature is most likely not going away.

I think by "fixing" the problem, what I meant to say is that developers are most likely looking for a solution - whatever it may be - to the current problem, that is, quite a few VirtualBox users can no longer start their virtual machines (at least, the ones who are posting about it). I would imagine that, or at least hope, that the solution is not for people to uninstall their Anti-Virus software (what seems to be a big cause according to the forums), along with whatever other software or files that may be tripping up the hardened security feature.

Since I am not even close to being a developer though, I think I will stop throwing around theories at this point, and let official news be the main source of information. :)

Replying to Ritter:

Hmm. It's unclear to me whether the fact that we can't have modified DLL's loaded by Windows is considered a "problem" that is currently in the process of being fixed. Your post suggests that, but the impression I get from the rest of the discussion is that it's a design decision that isn't going away.

4.3.12 is working. 4.3.19 continues to reject an Explorer extension I have that adds the ability to right-click the minimize button on a window to "minimize" it to the notification area.

comment:108 Changed 3 years ago by Greg Searle

Same issue. Downgrading to 4.3.12 eliminated the error and my VM's can start up.

comment:109 Changed 3 years ago by raylo

I used to use 4.3.16 without any problem until today I have updated my anti-virus software Avast 2015 (2015.10.0.2208) and the VM has no longer be able to be launched. I have tried to uninstalled it and install 4.3.18 and it got :

00:00:02.807280 VM: fHMEnabled=true  (configured) fRecompileUser=false fRecompileSupervisor=false
00:00:02.807282 VM: fRawRing1Enabled=false CSAM=true  PATM=true 
00:00:02.807456 VMSetError: C:\tinderbox\win-4.3\src\VBox\VMM\VMMR3\HM.cpp(532) int __cdecl HMR3Init(struct VM *); rc=VERR_VMX_MSR_VMXON_DISABLED
00:00:02.807488 VMSetError: VT-x is disabled in the BIOS.
00:00:02.933201 ERROR [COM]: aRC=E_FAIL (0x80004005) aIID={8ab7c520-2442-4b66-8d74-4ff1e195d2b6} aComponent={Console} aText={VT-x is disabled in the BIOS. (VERR_VMX_MSR_VMXON_DISABLED)}, preserve=false
00:00:03.002192 Power up failed (vrc=VERR_VMX_MSR_VMXON_DISABLED, rc=E_FAIL (0X80004005))
00:00:03.200889 UIMachineView::storeGuestSizeHint: Storing guest size-hint for screen 0 as 640x480

While I am sure that I enabled VT-x in BIOS.

Checked with release note of Avast, it got a "NG service" for sandbox technology with a VM at the background (according to my understanding) and I have modified the installation to remove it and everything works as expected now.

My OS is Win 8.1 update 3 (nov update) x64 en. Wish this helps for investigation.

comment:110 Changed 3 years ago by frank

Sorry, these "me too" reports without any further information don't help. Anybody who still has such problems on Windows, please provide the VBoxStartup.log file and make sure to test VBox 4.3.18.

raylo, your problem is completely unrelated to this ticket! Please create a separate ticket.

comment:111 Changed 3 years ago by frank

VBox 4.3.20 contains further updates. Please give it a try.

comment:112 Changed 3 years ago by GeorgMetzger

Still the same issue as with .14, .16, .18, .19...

.12 is still working nicely, although it slowly gets annoying to have to constantly re-install it... :-(

I attached the logfile, I hope it helps...


Hm, maybe some more details could help...
Win7 64Bit. .20 installed, installer did NOT tell me to reboot. Started VBox, VMs were running correctly (VM with saved state did not load, had to reboot the VM). Network access did not work, though.
After reboot VBox did not start any VMs anymore, I reinstalled .12 and was told to reboot the host. Did so and everything was working as expected again...

Last edited 3 years ago by GeorgMetzger (previous) (diff)

Changed 3 years ago by GeorgMetzger

Logfile of .20, still having the same problems as .14-.19

comment:113 Changed 3 years ago by AnrDaemon

@frank, I'm wondering, when you finally understand, that your fiddling with fundamental operating system functionality won't do you any good? The only real solution to any security concerns of yours is to make the user aware of them, not to try to "fix" them and fail over and over again. You can't be smarter than operating system itself, unless you wrote that operating system yourself.

comment:114 Changed 3 years ago by GeorgMetzger

@AnrDaemon: I fully agree

@frank: It is a pity what is going on, really. I was trusting deeply in VirtualBox to be a very stable, very good solution. The VM-not-starting-issue introduced with .14 results in me loosing trust in the software.
Wouldn't it be possible to let the user decide whether he wants to have this additional security thing or not? Could be a setting in the VM config, maybe...

comment:115 Changed 3 years ago by PassinThru

Like .18, .20 doesn't start my VM (Ubuntu 14.10 64-bit, 2GB, 2 CPU). Clicking the Start arrow leads to a long delay (20-30 seconds) followed by a "Ubuntu 14.10: Starting VM" progress box. This stays at 0%, with the message, "Creating process for virtual machine "Ubuntu 14.10"(GUI/Qt) ... (1/2)" - it never progresses. The hardware is a Dell Latitude E6420 laptop (8GB, i5-2530M CPU@ 2.5GHz) running Windows 7 SP1 64-bit. Symantec EndPoint Protection is installed. All software is up-to-date.

Moving back to 4.3.16.

Changed 3 years ago by kmiracle

4.3.20r96997 still fails to load VM

comment:116 Changed 3 years ago by kmiracle

Echoing what's observed by @PassinThru. Only .12 release works with my environment (with Symantec Endpoint Protection). .14-.20 still unable to start my VM. Log file is attached above.

comment:117 Changed 3 years ago by frank

PassinThru and anybody who still cannot start VMs on Windows with VBox 4.3.20, please attach the VBox 4.3.20 VBoxStartup.log file.

Changed 3 years ago by Benja

vm failed to start 4.3.20

Changed 3 years ago by PassinThru

4.3.20 VBoxStartup.log - VM hangs on startup

comment:118 Changed 3 years ago by PassinThru

Added my VBoxStartup.log. I should mention two things: 1) after cancelling the start up dialog, shutdown of my laptop fails. It never completes. I gave it 10 minutes before forcibly powering it down. 2) The attached log mentions "(lacks WinVerifyTrust)" when loading apphelp.dll. Related?

Changed 3 years ago by edgar_

VBox 4.3.20 log

comment:119 Changed 3 years ago by Oorgo

I am also stuck on 4.3.12 as any update to Virtualbox stops my VMs from starting, it slowly displays a message that the service is being created and never gets any farther. The host is Windows 7 x64, and I have approximately 10 VMs, the only way I'm able to fix this is system restore to the point where 4.3.20 is installed.

Changed 3 years ago by Oorgo

VboxStartup Win7x64

Changed 3 years ago by andreya108

4.3.20 vm startup failure

Changed 3 years ago by andreya108

4.3.20 vm startup failure

Changed 3 years ago by andreya108

4.3.18 vm startup failure

comment:120 Changed 3 years ago by andreya108

Under win 8.1x64 VB fails to start any VM after upgrade. Rolled back to 4.3.10. Here are logs from 4.3.18 and 4.3.20 (the same issue): VBoxStartup(4.3.18r96516).log and VBoxStartup(4.3.20r96997).log No 3rd party AV software installed.

comment:121 Changed 3 years ago by DanielTest

I have Win 7x64 HomePremium 4.3.20 vm startup failure (Update at 11/26/2014)


Unable to load R3 module C:\Program Files\Oracle VM VirtualBox/VBoxDD.DLL (VBoxDD): GetLastError=1790 (VERR_UNRESOLVED_ERROR).

Fehlercode:E_FAIL (0x80004005) Komponente:Console Interface:IConsole {8ab7c520-2442-4b66-8d74-4ff1e195d2b6}


also with AV disabled and start with admin rights

Last edited 3 years ago by DanielTest (previous) (diff)

comment:122 follow-up: ↓ 186 Changed 3 years ago by doublemeat

I solved this problem by disabling MacType ( https://code.google.com/p/mactype/, which I run to "fix" Windows hideous font rendering. The clue for me was people having problems with unsigned DLLs running in the VirtualBox process space - which MacType does. (I suppose I could also self-sign the DLL.)

Makes sense that a serious product would not want unsigned code running in its process space. But there should most definitely be a global opt-out at least, for the hobbyist who isn't running a uranium centrifuge. A "per-DLL signature" whitelist might be OK for uranium centrifuge VMs, but way too burdensome for the hobbyist.

Changed 3 years ago by EvilMrB

Changed 3 years ago by EvilMrB

comment:123 Changed 3 years ago by klaus

The log attached by EvilMrB is a totally unrelated issue, it's trying to start a VM with USB2 enabled but without having the extension pack installed. This gives a very clear error message: "Implementation of the USB 2.0 controller not found!

Because the USB 2.0 controller state is part of the saved VM state, the VM cannot be started. To fix this problem, either install the 'Oracle VM VirtualBox Extension Pack' or disable USB 2.0 support in the VM settings (VERR_NOT_FOUND)".

If this would be a generic bug (broken extension pack) then lots of people would complain, but you're the first.

Changed 3 years ago by ThomasMoore

VirtualBox 4.3.20r96997 Startup Failure

Changed 3 years ago by dgc

dgc startup log 4.3.20 Hangs

comment:124 Changed 3 years ago by dgc

VirtualBox 4.3.20 r96997 Hang on Startup (Worked with 3.14+ test version, failed differently with 3.14) https://www.virtualbox.org/attachment/ticket/13187/VBoxStartup.11.log

Changed 3 years ago by CorruptNova

Image of error in Vbox.

Changed 3 years ago by CorruptNova

Log of VM startup

comment:125 Changed 3 years ago by CorruptNova

Seems that I can't start any VM on 4.3.20r96997. I don't have any security software installed nor sandbox applications.

Changed 3 years ago by glvlad

comment:126 Changed 3 years ago by glvlad

VBox V4.3.20r96997 on WIndows7

Не удалось открыть сессию для виртуальной машины WindowsXP. (Failed to open session to VM WindowsXP)

The virtual machine 'WindowsXP' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'D:\vms\WindowsXP\Logs\VBoxStartup.log'.

Код ошибки: E_FAIL (0x80004005) Компонент: Machine Интерфейс: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

Last edited 3 years ago by glvlad (previous) (diff)

comment:127 Changed 3 years ago by malanpa

hi, recently download the latest version of virtualbox, the installation of the software is perfect but when you try to install any operating system, giving me an error, initiating and from there does not allow me to advance ... https://pbs.twimg.com/media/B4ShVv6CcAAVrMl.jpg:large

Changed 3 years ago by luke93

anybody who still cannot start VMs on Windows with VBox 4.3.20, please attach the VBox 4.3.20 VBoxStartup.log file

Changed 3 years ago by nudidudi

Changed 3 years ago by J.H.

Changed 3 years ago by luke93

VBox 4.3.20 seems to have been working until these Windows Updates yesterday

comment:128 Changed 3 years ago by frank

Please don't use this defect for reporting the recent breakage due to Microsofts update. This is already described in #13677 and Microsoft just blocked that update for Windows 7.

Changed 3 years ago by tomd

Failing to start even after the latest windows updates.

comment:129 Changed 3 years ago by tomd

Here is the output of the command it told me to run:

C:\Users\tom>sc.exe query vboxdrv

SERVICE_NAME: vboxdrv
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
Last edited 3 years ago by tomd (previous) (diff)

comment:130 Changed 3 years ago by CharlieQ

Any fix for the above R3 module error yet? >.>

comment:131 Changed 3 years ago by Rb

Virtual Machine is stuck at - Creating process for virtual machine.......... 0%

VBox version: 4.3.20 Host OS: Windows 7 Enterprise Service Pack 1 AV: Symantec Endpoint Protection Latest Windows Security Update: KB3011780(12/5/2014)

1e0c.1e10: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume1\Windows\System32\apphelp.dll 1e0c.1e10: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\apphelp.dll (rcNtResolve=0xc0150008) *pfFlags=0xffffffff pwszSearchPath=0000000000000000:<flags> [calling] 1e0c.1e10: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\apphelp.dll [lacks WinVerifyTrust] 1e0c.1e10: supR3HardenedDllNotificationCallback: load 000007fefd1d0000 LB 0x00057000 C:\Windows\system32\apphelp.dll [fFlags=0x0] 1e0c.1e10: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume1\Windows\System32\apphelp.dll [lacks WinVerifyTrust] 1e0c.1e10: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd1d0000 'C:\Windows\system32\apphelp.dll'

Anybody familiar with similar issues ?

Changed 3 years ago by Rb

VBox 4.3.20 seems to have been working until these Windows Updates yesterday. Windows update removed but still not working. Stuck at - Creating Process for Virtual Machine...

Changed 3 years ago by Thad

Thad Startup Error

comment:132 in reply to: ↑ 1 Changed 3 years ago by Thad

Just started seeing this error on r96997 today. Can't boot any existing machines/ boot any new machines, totally broken & I can't access my files on VM.

comment:133 Changed 3 years ago by frank

Thad, according to the VBoxStartup.log, the file WS2_32.dll is not signed. Please check the digital signature of this file. It might be modified by a malicious application.

comment:134 Changed 3 years ago by klaus

FYI: it is often possible to have Windows restore the officially distributed variant of the system DLLs by running the command "sfc /scannow" in an admin cmd.exe. Often needs a reboot afterwards to fully restore the default state. The command is definitely worth a try.

comment:135 Changed 3 years ago by Squall Leonhart

DO NOT, run sfc until you have ensured you do not have KB3004394 installed.

This update invalidates or damages a certificate chain utilised by many Windows 7 dll's and executables.

If you have or have had KB3004394, uninstalling is it is known to NOT FIX the error in some cases, only a system restore prior to this patches installation will return your system to functioning order.

KB3004394 is known to prevent VirtualBox from working on Windows 7.

comment:136 Changed 3 years ago by AnrDaemon

968.c04: Log file opened: 4.3.20r96997 g_hStartupLog=00000fe8 g_uNtVerCombined=0x510a2830
968.c04: \SystemRoot\System32\ntdll.dll:
968.c04:     CreationTime:    2008-04-14T17:40:20.000000000Z
968.c04:     LastWriteTime:   2010-12-09T15:15:19.000000000Z
968.c04:     ChangeTime:      2011-03-03T13:25:18.734375000Z
968.c04:     FileAttributes:  0x20
968.c04:     Size:            0xb0600
968.c04:     NT Headers:      0xd0
968.c04:     Timestamp:       0x4d00f287
968.c04:     Machine:         0x14c - i386
968.c04:     Timestamp:       0x4d00f287
968.c04:     Image Version:   5.1
968.c04:     SizeOfImage:     0xb3000 (733184)
968.c04:     Resource Dir:    0x83000 LB 0x2cf58
968.c04: \SystemRoot\System32\kernel32.dll:
968.c04:     CreationTime:    2008-04-14T17:40:40.000000000Z
968.c04:     LastWriteTime:   2014-03-12T10:47:47.000000000Z
968.c04:     ChangeTime:      2014-07-02T19:16:43.507548900Z
968.c04:     FileAttributes:  0x20
968.c04:     Size:            0xf4000
968.c04:     NT Headers:      0xf0
968.c04:     Timestamp:       0x53203b53
968.c04:     Machine:         0x14c - i386
968.c04:     Timestamp:       0x53203b53
968.c04:     Image Version:   5.1
968.c04:     SizeOfImage:     0xf8000 (1015808)
968.c04:     Resource Dir:    0x8a000 LB 0x6773c
968.c04: NtOpenDirectoryObject failed on \Driver: 0xc0000022
968.c04: supR3HardenedWinFindAdversaries: 0x0
968.c04: Calling main()
968.c04: SUPR3HardenedMain: pszProgName=VirtualBox fFlags=0x2
968.c04: SUPR3HardenedMain: Respawn #1
968.c04: System32:  \Device\HarddiskVolume1\WINDOWS\system32
968.c04: WinSxS:    \Device\HarddiskVolume1\WINDOWS\WinSxS
968.c04: KnownDllPath: C:\WINDOWS\system32
968.c04: '\Device\HarddiskVolume1\Program Files\VirtualBox\VirtualBox.exe' has no imports
968.c04: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume1\Program Files\VirtualBox\VirtualBox.exe)
968.c04: supR3HardNtEnableThreadCreation:
968.c04: supR3HardNtDisableThreadCreation: pvLdrInitThunk=7c901166 pvNtTerminateThread=7c90de7e
968.c04: supR3HardenedWinDoReSpawn(1): New child 8ec.bd4 [kernel32].
968.c04: supR3HardNtChildGatherData: PebBaseAddress=7ffd8000 cbPeb=0x20c
968.c04: supR3HardNtPuChFindNtdll: uNtDllParentAddr=7c900000 uNtDllChildAddr=7c900000
968.c04: supR3HardenedWinSetupChildInit: uLdrInitThunk=7c901166
968.c04: supR3HardenedWinSetupChildInit: Start child.
968.c04: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 15 ms.

Then the host abruptly reboot. The log is actually longer than that, containing a lot of \000's.

Last edited 3 years ago by AnrDaemon (previous) (diff)

Changed 3 years ago by AnrDaemon

VirtualBox r20 startup log and BSOD summary

comment:137 Changed 3 years ago by JDan

Please review/link this ticket #13659 (the same problem module - hardened, but other issue -- garbage memory read to get a module name to check its digital signature)

Changed 2 years ago by carfesh

SEP - failing startup

comment:138 Changed 2 years ago by carfesh

on my system (SEP is installed, I imagine that may be the reason) it will still fail to start VMs; I have attached the log.

Changed 2 years ago by workingman

Unable to load r3 model in new test build and others

comment:139 Changed 2 years ago by klaus

People running into VM start timeouts with Symantec Endpoint protection should try the following workarounds (we'll try to fix this rather recent hiccup of course, but this can take a while):

Follow the below Tech Note if you are using SEP Enterprise Edition:  http://www.symantec.com/business/support/index?page=content&id=TECH225620

If you are using standalone or unmanaged SEP then remove "Application and Device control":

  1. You can remove by going to Programs and Features, selecting "Change" on SEP -> Select Modify option
  2. Set Proactive Threat Protection -> Application and Device control to "Entire Feature will be unavailable".
  3. Finish the setup + reboot the system

comment:140 Changed 2 years ago by deaforange

All versions of Virtualbox since 4.3.14 crashed my Win8.0 host to BSOD trying to start a VM. Now I'm on Win8.1 and 4.3.20 still can't start any VM.

Changed 2 years ago by deaforange

comment:141 Changed 2 years ago by GeorgMetzger

Hm, I am starting to get a bit depressed... The .22 still has exactly the same issues as .20! And .18, .16, .14 by the way... I believe it is about time to disable this "advanced" security features, maybe with a setting. I will have to switch to VMWare otherwise...

Regarding the changelog, there was not even something TRIED to circumvent or solve the problem. If I would develop my software this way, I would have been fired some months ago...

comment:142 Changed 2 years ago by klaus

Please. We're working hard on ironing out issues with hardening, which we can't all list in the changelog. Also, we said so many times that all this effort isn't "just for fun" (or to have '"advanced" security features), it's done to address a genuine security issue which was reported by a 3rd party. To be honest, I wouldn't be surprised if VMware Workstation is affected (NOTE: I have no proof, and I don't have time to do any checks of 3rd party software) as well by the underlying very generic vulnerability.

If we add a way to disable the hardening (forget about pointing out that Administrator is trustworthy - on Windows it isn't, everyone is an admin and UAC is a fig leaf), then the security fix is effectively removed.

I won't comment on the criticism about our software development style. Users of the free, open source product are encouraged to work with us constructively, and paying customers have additional channels to make themselves heard. Sorry, but there's an economic part of software development as well. Especially for free and open source software.

comment:143 Changed 2 years ago by wunjo

I also met this bug. When I do an install of one of the affected versions and I go right on starting vBox after install, the bug isn't there. It appears only if I start the vBox the next time.

Win 7 pro -64, AMD A8-3870

8,00 GB DDR3 @ 666MHz (9-9-9-24)

Motherboard

ASUSTeK COMPUTER INC. F1A75-M LE (FM1 )

comment:144 Changed 2 years ago by PassinThru

The 4.3.22 release fixed my problem with SEP. My VMs work flawlessly now. Thanks for the fix!

comment:145 Changed 2 years ago by GeorgMetzger

@klaus: You are right, I picked the wrong tone. Sorry for that!

I was just upset that the problem still exists. I really like VirtualBox, and I hate not being able to use all the new features...

The modification is about a security issue, ok.

I understand that this should be fixed.

But I honestly must say that I would prefer to work with the latest version of your software *with* security issues instead of working with the OLD version *with* security issues, too...

The .12 had the security problem, I am still running it since the new versions do not work. So I effectively have the problem.

I repeat my request to make the modification somehow switchable, if I switch it off, it is not any more problematic than using the older version...

Last edited 2 years ago by GeorgMetzger (previous) (diff)

comment:146 Changed 2 years ago by oppiman

I had a similar problem with VirtualBox >4.3.12 and a patched uxtheme.dll

1) My input to a possible solution provided by Oracle: It would make sense to have the dll verification switched off when needed. To avoid security problems, when switched off a clearly visible message should be displayed in e.g. VirtualBox status bars.

2) My input to a possible solution for some affected users: If the problem is "only" about a patched uxtheme.dll, then restore the original uxtheme.dll first. Then download and install a tool from uxstyle.com. It will allow the use of themes without the need of tampering with dlls. Worked for me and I can happily use the latest version of VirtualBox and have a modified theme.

Regards Michael

comment:147 follow-up: ↓ 148 Changed 2 years ago by GeorgMetzger

Michael: How did you find out the reason for the problem? All I get is the info that the program will not run, but not a reason for it...

comment:148 in reply to: ↑ 147 ; follow-ups: ↓ 149 ↓ 151 Changed 2 years ago by oppiman

Replying to GeorgMetzger:

Michael: How did you find out the reason for the problem? All I get is the info that the program will not run, but not a reason for it...

the log files point to uxtheme.dll

00:00:02.167189 supR3HardenedErrorV: supR3HardenedScreenImage/LdrLoadDll: cached rc=VERR_LDRVI_NOT_SIGNED fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=512 \Device\HarddiskVolume2\Windows\System32\uxtheme.dll 00:00:02.167268 supR3HardenedErrorV: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\system32\uxtheme.dll': rcNt=0xc0000190

VirtualBox is actually checking the signature on several dlls. The uxtheme.dll sig was broken dur to patching, therefore it got rejected.

comment:149 in reply to: ↑ 148 Changed 2 years ago by GeorgMetzger

Replying to oppiman:

the log files point to uxtheme.dll

00:00:02.167189 supR3HardenedErrorV: supR3HardenedScreenImage/LdrLoadDll: cached rc=VERR_LDRVI_NOT_SIGNED fImage=1 fProtect=0x0 fAccess=0x0 cErrorHits=512 \Device\HarddiskVolume2\Windows\System32\uxtheme.dll 00:00:02.167268 supR3HardenedErrorV: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\system32\uxtheme.dll': rcNt=0xc0000190

Ok, I should check the log then! Many thanks!!

comment:150 Changed 2 years ago by JDan

Please review this one details about:

  • AppInit_Dlls
  • probably, incorrect filenames Querying from OS
  • request for more details in logs

Problem is still actual for 4.3.22:

https://www.virtualbox.org/ticket/13659#comment:5

comment:151 in reply to: ↑ 148 ; follow-up: ↓ 152 Changed 2 years ago by GeorgMetzger

Replying to oppiman:

Replying to GeorgMetzger:

Michael: How did you find out the reason for the problem? All I get is the info that the program will not run, but not a reason for it...

the log files point to uxtheme.dll

Sorry, but could you maybe check my attached log (VBoxStartup.6.log) for a problem? I can not find the reason for the issue. There are several DLLs listed, but these are all standard and not modified, as far as I can tell...

By the way, somebody tried the .24? Is the problem fixed?

comment:152 in reply to: ↑ 151 Changed 2 years ago by oppiman

Replying to GeorgMetzger: ...

the log files point to uxtheme.dll

Sorry, but could you maybe check my attached log (VBoxStartup.6.log) for a problem? I can not find the reason for the issue. There are several DLLs listed, but these are all standard and not modified, as far as I can tell...

I don't see anything being rejected, so maybe you have a different problem.

By the way, somebody tried the .24? Is the problem fixed?

Nope, and won't do that. I'm verry happy to have a working system right now and I don't see anything in the changelog that would encourage me to test again.

BTW, I just noticed today, that .22 had a problem with some Nvidia files as well. I think it is odd that vbox thinks they can achieve something MS hasn't for years...

comment:153 Changed 2 years ago by littleperry

4.3.24 still not fix this issue.

Last edited 2 years ago by littleperry (previous) (diff)

comment:154 follow-up: ↓ 155 Changed 2 years ago by frank

VirtualBox 4.3.24 contains fixes for Windows hardening as all releases since 4.3.14 before. The fixes in 4.3.24 were done for a very specific problem so we didn't add a changelog entry but a fix can always have side effects.

comment:155 in reply to: ↑ 154 ; follow-up: ↓ 156 Changed 2 years ago by GeorgMetzger

Replying to frank:

VirtualBox 4.3.24 contains fixes for Windows hardening as all releases since 4.3.14 before. The fixes in 4.3.24 were done for a very specific problem so we didn't add a changelog entry but a fix can always have side effects.

_

I think that after some many months with the same issues, it is time to give us an option to disable hardening. Maybe with the suggested option of displaying a warning if hardening is off...

_

@oppiman: thanks for your help!

comment:156 in reply to: ↑ 155 ; follow-up: ↓ 157 Changed 2 years ago by frank

Replying to GeorgMetzger:

I think that after some many months with the same issues, it is time to give us an option to disable hardening. Maybe with the suggested option of displaying a warning if hardening is off...

What you denote as the 'same issue for months' is actually a problem with many different flavors. And the root of the problem is the Windows design and the policy of various virus scanners on Windows.

Again, there will be no option to disable VirtualBox hardening on Windows. There is an Oracle policy that prevents us shipping from software which has know security problems.

comment:157 in reply to: ↑ 156 ; follow-up: ↓ 158 Changed 2 years ago by oppiman

Replying to frank:

but a fix can always have side effects.

Very true. So you will go on "fixing specific problems" possibly causing side effects for anybody else (without detailed documentation?

Replying to frank:

... And the root of the problem is the Windows design and the policy of various virus scanners on Windows.

Again very true. But you try to ship around that design flaw in order to achieve something MS never achieved themselves. And you will compete with the constantly changing environment virtualbox has to run in. (lot of work ahead)

Again, there will be no option to disable VirtualBox hardening on Windows. There is an Oracle policy that prevents us shipping from software which has know security problems.

Ok, so you try to circumvent DLL hijacking and/or injection. While that is very much appreciated, VirtualBox is a product often used for testing and/or in lab environments. VirtualBox isn't really a tool meant to run productive financial systems... So I still think the user should have the option to decide - but oh well... (could be implemented in a way, that changes to hardening only are possible while no VM is running and a clear message in status bar or menues which mode you are in to prevent unrecognized tampering - or maybe call it dev or debug mode to make clear it is not for productive use)

comment:158 in reply to: ↑ 157 ; follow-ups: ↓ 159 ↓ 160 Changed 2 years ago by frank

Replying to oppiman:

Replying to frank:

but a fix can always have side effects.

Very true. So you will go on "fixing specific problems" possibly causing side effects for anybody else (without detailed documentation)?

That's not what I said. Sometimes there is a small fix which isn't mentioned in the changelog because the impact is treated as very limited. It's definitely possible that such a fix which fixes the problems of other users. I think that's not something to complain about.

Replying to frank:

... And the root of the problem is the Windows design and the policy of various virus scanners on Windows.

Again very true. But you try to ship around that design flaw in order to achieve something MS never achieved themselves. And you will compete with the constantly changing environment virtualbox has to run in. (lot of work ahead)

Sorry, we have no choice.

Again, there will be no option to disable VirtualBox hardening on Windows. There is an Oracle policy that prevents us shipping from software which has know security problems.

Ok, so you try to circumvent DLL hijacking and/or injection. While that is very much appreciated, VirtualBox is a product often used for testing and/or in lab environments. VirtualBox isn't really a tool meant to run productive financial systems... So I still think the user should have the option to decide - but oh well... (could be implemented in a way, that changes to hardening only are possible while no VM is running and a clear message in status bar or menues which mode you are in to prevent unrecognized tampering - or maybe call it dev or debug mode to make clear it is not for productive use)

Why I completely understand that some users don't care about these security aspects at all because, for instance, their Windows computer runs in a private network without any connection to the outside and they never install any malicious software on it and therefore completely trust their Windows box (but is that really realistic?) we are still not allowed to ship such a software. The consequence of having a switch to disable hardening in VirtualBox would be that every VirtualBox FAQ would list this switch as the most prominent item and most users would just use this switch to circumvent any possible compatibility problem.

comment:159 in reply to: ↑ 158 Changed 2 years ago by GeorgMetzger

Replying to frank:

Why I completely understand that some users don't care about these security aspects at all because, for instance, their Windows computer runs in a private network without any connection to the outside and they never install any malicious software on it and therefore completely trust their Windows box (but is that really realistic?) we are still not allowed to ship such a software. The consequence of having a switch to disable hardening in VirtualBox would be that every VirtualBox FAQ would list this switch as the most prominent item and most users would just use this switch to circumvent any possible compatibility problem.

Well, yes, I trust my PC. And it is not Oracles cause to doubt this or to declare something being good or not. Oracle is not god. With your reply you imply that there really is some need for this switch...

Maybe you could start by informing those who have posted logs about their specific problem? Currently I am sitting here completely blind, having no idea what I could do except for begging you (or your bosses) to get reasonable.

Could you provide contact information for somebody responsible for the development? I know that sometimes the workers in a company are not heard, but the customers are...

I am well aware that VirtualBox is for free and I am not a paying customer. But it was Oracles decision to go this way of distribution. I am sure it would not help sending you money, so the price is not an argument. You should provide a working piece of software or no software at all. There are alternatives. Currently for me it's just convenient to stick to a piece of software I know and basically like very much and HOPE that the problem will be fixed. But if the problem will not be fixed, I will switch and others will, also.

I repeat the request to get information for each users specific problem. Many thanks in advance for this!

comment:160 in reply to: ↑ 158 Changed 2 years ago by oppiman

Replying to frank:

Why I completely understand that some users don't care about these security aspects at all

I guess you got me wrong here. I do care very much about security - where I need it. And I want to control the level of security that I apply. I don't want some software to do something that ends up in unexpected results.

In another reply I said I would be a happy user as I got .22 working. Well I was wrong. It was working, but without audio. I don't care too much about audio on VMs so I did not notice right away. Now I testest .22, .24 and for sure .12. Guess what, audio works in all of my guests (Windows and Linux) using .12. Audio does not work with .22 and .24. When I say audio does not work I mean there simply is no sound hearable. No error message.

I tested that back and forth including the installation/uninstall of guest additions.

The only thing that has changed on my host over the last few weeks was the installation of Lync. I don't know if that might be related and I can't go back before the point in time Lync has been installed.

Anyway, .12 works and so I reverted back to .12.

:(

comment:161 Changed 2 years ago by efa

I can confirm the problem is related to Windows host only. I just upgraded VB to 4.3.24 on a Linux box, and can run without trouble VM with both Windows and Linux.
About the apparently related bug https://www.virtualbox.org/ticket/13317, VB 4.3.16 solved the issue with Sophos.

comment:162 Changed 2 years ago by fpabernard

Same error after upgrading from 4.3.12

Échec de l'ouverture de session pour la machine virtuelle Openmediavault Kralizec 1.0.

The configuration constructor in main failed due to a COM error. Check the release log of the VM for further details. (VERR_MAIN_CONFIG_CONSTRUCTOR_COM_ERROR).

Code d'erreur : E_FAIL (0x80004005) Composant : Console Interface : IConsole {8ab7c520-2442-4b66-8d74-4ff1e195d2b6}

Changed 2 years ago by fpabernard

Vbox.log

comment:163 Changed 2 years ago by frickenate

I'm another user stuck on 4.3.12. The fact of the matter is that many of us download custom themes for Windows which patch system DLL files. You are telling all of us that your product can no longer be used by people such as ourselves. I really cannot handle Windows without my theme alterations, so the simplest maneuver is to not upgrade from 4.3.12. The day this version is no longer viable and you continue to refuse to provide a workaround, I and many others will simply abandon your product.

You say "it's done to address a genuine security issue which was reported by a 3rd party. To be honest, I wouldn't be surprised if VMware Workstation is affected". You make this sound like it would be a terrible thing for them, that VMWare would be inferior. And yet: if their product works with my operating system (security concerns be damned), then they have a product I am interested in and it is your product that appears to be "affected".

Please reconsider. A patched DLL file is not a security vulnerability in and of itself, if the user has explicitly taken the risk to install said patch. If a genuine virus patches a file without the user's consent, it is not up to each application to harden against this. If Windows itself is infected, what's the point in hardening the guest? Who cares if an infected Windows machine results in an infected/exploitable guest? No worse off... except perhaps to the ego of the security team at VirtualBox.

Please reconsider.

comment:164 Changed 2 years ago by frank

Sorry but an infected DLL is a security threat when used together with VirtualBox. In contrast to a regular user process (if a malicious theme DLL does evil things with calc.exe this is annoying but wouldn't affect the whole system), the VirtualBox process needs to run at system privileges. If malicious code is able to attack the VM process then this is a threat to your system, not only to the current user and not only to the files the current user has access to.

comment:165 Changed 2 years ago by Squall Leonhart

You don't have to patch files to load unsigned themes....

the UXStyle service and driver work without any alterations to system files and i can confirm that it works just fine with Virtualbox.

comment:166 Changed 2 years ago by oppiman

So .26 came out and I gave it a try. I don't have any theme customizations anymore, even so the UX Style service worked nicely with .14+ My next problem was no audio on windows or linux clients on a w7 64bit host with any version beyond .12 And it still is here, even with new guest additions. So trashed .26 again, went back to .12 and all is ok again. This is no fun.

comment:167 follow-up: ↓ 168 Changed 2 years ago by Squall Leonhart

what audio device are you emulating in the virtualbox settings?

comment:168 in reply to: ↑ 167 Changed 2 years ago by oppiman

Replying to Squall Leonhart:

what audio device are you emulating in the virtualbox settings?

ICH AC97 - never used anything else for years. Actually I am using the VMs pretty much with template default settings.

My VMs did not change recently.

To double check I installed a fresh Mint 17.1 64bit. With .12 Audio, with anything later no. I tried the Mint default guest additions and purging all and installing from virtual cd drive. Both same.

I looked through the logs, compared those from .12 to .26, could not find anything that would point to audio problems.

One thing I noticed, it is not just that audio doesn't work, when using Sound/Hardware/Test Speakers it seems the vm is hanging a bit.

The only thing I am not sure about: I recently installed Office 2013 and Lync on my host. Lync has some weird ways to grab audio, so not sure if that might play into the game. Anyway, .12 not affected.

P.S. I'll try later today on another W7 64bit host without Lync and a fresh Mint 17.1 install.

P.P.S In case you think Mint is the problem... No, an old 32bit XP VM behaves the same.

Last edited 2 years ago by oppiman (previous) (diff)

comment:169 Changed 2 years ago by oppiman

Ok, apparantly I have found the root cause of the problem. Even so I reverted to a Windows Standard Theme and made sure I unpatched the related files, one thing still was there. A modification of the start button. Once removed, audio was back.

But gents, how crazy is that. I understand the idea behind hardening, but no guest audio because of a formerly modified host start button and no log entries that would point to the problem? Come on...

I admit one should not tamper with system files, but honestly Oracle should not claim to know things better than Microsoft. All you can do is try and error arround the system and AV programs and other tools that hook up deep inside the OS.

So my problem is solved. Not counting the hours wasted. Thanks anyway.

comment:170 Changed 2 years ago by frickenate

@frank And just how did that DLL manage to get infected in the first place? Oh that's right, via escalated privileges, which means the system is already compromised. The fact that a specific attack vector might require a process with the loaded DLL to run with escalated privileges is fairly besides the point. A user on the machine has already granted the permission to install an infected DLL, and it is not Virtualbox's job to police the entire operating system. You are telling a portion of your customer base that your product has reached end of life. That just doesn't make sense.

comment:171 Changed 2 years ago by GeorgMetzger

@frickenate: I absolutely agree! I do not understand how Oracle can be so blindfolded. Some are complaining, but many more users will just not try VirtualBox again after they failed to make any post .12 version run.

They will simply got to VMWare Player and stay there.

Oracle is destroying its own userbase step by step and we who are warning them, are "the bad guys trying to use an unsecure Windows".

All Oracle would have to do is to add a messagebox when the "security problem" is detected, informing the user. SIMILAR To WHAT WINDOWS DOES: "This program requests Admin rights. Do you grant these...".

I have posted my logfile months ago, nobody felt obliged to check it and inform me about the reason for my problem. I have no modified start buttons, no virus scanner, no nonsense software installed.

I have the feeling Oracle is not taking our pleas seriously.

@frank: If I am wrong, then please get us a person of higher rank to this forum, have him read the posts and have him tell us why he thinks he knows better... I bet this will not happen. Because you do not care about your userbase!

Last edited 2 years ago by GeorgMetzger (previous) (diff)

comment:172 Changed 2 years ago by Suo

The discussion about these issues has been continuing in the forums:  https://forums.virtualbox.org/viewtopic.php?f=6&t=66639

comment:173 follow-up: ↓ 177 Changed 2 years ago by frank

New test build available which fixes a bug in the VBox code which was triggered in conjunction with some Microsoft security fixes (KB3045999).

comment:174 Changed 2 years ago by prymshbmg

No VMs are loading on Vbox 4.3.26 resulting error with RC=-1912

Changed 2 years ago by mip1983

Error starting virtual machine with 4.3.28

comment:175 follow-up: ↓ 176 Changed 2 years ago by mip1983

I've attached my logs in the post above. Just to add to that, virtual box works fine on my machine at home, on my work machine I have to use 4.3.12 which comes with it's own issues. The work machine is Windows 7 Enterprise with some McAfee Enterprise software, a fairly locked down machine.

comment:176 in reply to: ↑ 175 Changed 2 years ago by NumericOverflow

Replying to mip1983:

I've attached my logs in the post above. Just to add to that, virtual box works fine on my machine at home, on my work machine I have to use 4.3.12 which comes with it's own issues. The work machine is Windows 7 Enterprise with some McAfee Enterprise software, a fairly locked down machine.

Same issues here and similar setup (Win7x64 with McAfee Enterprise suite in a corporate environment).

Changed 2 years ago by NumericOverflow

VBox-4.3.28r100309_failed_to_start Log

comment:177 in reply to: ↑ 173 Changed 2 years ago by NumericOverflow

Replying to frank:

New test build available which fixes a bug in the VBox code which was triggered in conjunction with some Microsoft security fixes (KB3045999).

FYI - just tried latest beta (VirtualBox-4.3.29-100331-Win.exe) and it doesn't work either.

Side Note: Your download link on the test builds page is wrong (URL has 4.3.27 not 4.3.29 for the windows build which is 404 not found). Should be fixed to this: https://www.virtualbox.org/download/testcase/VirtualBox-4.3.29-100331-Win.exe

Changed 2 years ago by ErikTheRed

Startup log for 4.3.28

comment:178 Changed 2 years ago by Beezle

I can no longer start any of my VMs under win 8.1 64. I have read through this thread and looked at the log file. It seems to be complaining kernel32.dll lacks WinVerifyTrust.

Dear Oracle - it is not your job to verify the integerity or security of my installation (which by all other indications is perfectly fine). If you feel you must look at these things, you are doing a great disservice to your customers/users by preventing them from running Virtualbox. The administrator and/or end-user should have the final say - not Oracle. If you want to put up a one time "warning" that the system may be compromised, fine ok, do that. And then let the user decide whether to go forward. When did Oracle become the arbiter of whether a Windows installation is not compromised?

So now I am faced with the difficult choice of running an OUTDATED and INSECURE version of Virtualbox or look for another virtualization solution and waste more of my time switching over. Oracle is not a loved company and this type of heavy handedness only furthers that dislike (and that is not a jab at the coders).

comment:179 Changed 2 years ago by BGarber

4.3.29 is just as useless.

comment:180 Changed 2 years ago by efa

I can confirm the problem is related to Windows host only. I just upgraded VB to 4.3.28 on a Linux box, and can run without trouble VM with both Windows and Linux.

comment:181 follow-up: ↓ 185 Changed 2 years ago by EduardoDiaz

I confirm the problem in Virtual Box 5.0.

My windows have the files patched I have the original files on my webpage but you must replace the files yourself.

 http://www.pk25.com/monivideos/ThemeFiles.zip

Now is running.

comment:182 Changed 2 years ago by ErikTheRed

I am still seeing this issue in both 4.3.30 and 5.0, kernel32.dll is getting a lacksWinVerify trust error.

Windows 7 x64 Enterprise Fully Patched

Changed 23 months ago by Mark Lobo

comment:183 Changed 23 months ago by Mark Lobo

Problem started recently. Tried VB versions 4.3.22, 4.3.30, 5.0 and 5.0.1r102010. All fail to start with the same error. Log file attached. Any ideas how to fix this issue?

Failed to open a session for the virtual machine CentOS67.

The virtual machine 'CentOS67' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'C:\Users\xyz\VirtualBox VMs\CentOS67\Logs\VBoxStartup.log'.

Result Code: E_FAIL (0x80004005) Component: MachineWrap Interface: IMachine {f30138d4-e5ea-4b3a-8858-a059de4c93fd}

Changed 23 months ago by FeyanGur

8ab7c520-2442-4b66-8d74-4ff1e195d2b6

comment:184 Changed 23 months ago by FeyanGur

Problem started recently. Tried VB versions 4.3.12, 4.3.30, 5.0.2 with installed Oracle VM VirtualBox Extension Pack. All fail to start with the same error. Log file attached. Any ideas how to fix this issue?

comment:185 in reply to: ↑ 181 Changed 22 months ago by jan.elznic

Replying to EduardoDiaz:

My windows have the files patched I have the original files on my webpage but you must replace the files yourself.

 http://www.pk25.com/monivideos/ThemeFiles.zip

Now is running.

Where can I replace this files? Can you describe the location path, please?

comment:186 in reply to: ↑ 122 Changed 21 months ago by mjbrown

Replying to doublemeat:

I solved this problem by disabling MacType [...]

All you need to do in MacType is add VirtualBox.exe to the [UnloadDll] section of the active MacType profile (.ini file).

Changed 20 months ago by Bill.Coats

VBoxHardening.log

comment:187 Changed 20 months ago by Bill.Coats

I can not get Any virtual machines to boot. I have tried uninstalling and reinstalling VirtualBox with no luck. I keep receiving an error that it failed to open a session for the virtual machine. I have a fully patched Windows 8.1 machine with System Center Endpoint Protection 4.8.204.0. I am running VirtualBox 5.0.10. I have attached the log file that is created when I try to start VirtualBox.

comment:188 Changed 16 months ago by Ty66

I am also having the DLL lacks WinVerifyTrust issue with VB 5.0.16 (and 4.3.36) on a Windows 7 machine with McAfee 5.0.2.132. Does anyone know if there is any resolution coming for this?

Changed 11 months ago by pa_

log

comment:189 Changed 11 months ago by pa_

vb 5.1, win7, no antivir

The virtual machine 'lotus' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'C:\VM\lotus\Logs\VBoxHardening.log'.

Код ошибки: E_FAIL (0x80004005) Компонент: MachineWrap Интерфейс: IMachine {b2547866-a0a1-4391-8b86-6952d82efaa0}

https://www.virtualbox.org/attachment/ticket/13187/VBoxHardening.2.log

comment:190 Changed 11 months ago by Harps

Earlier than today. Virtual machines worked well. Until now, when I fixed the Windows Update error 80070003 by this video  https://www.youtube.com/watch?v=4PKJUxalYss, They won't work. I restarted the PC, It won't work. I used System Restore, It won't work, I uninstalled Norton, It won't work. Please help me fix the error 0x80004005 please

Operating System: Windows 7 Home Premium Service Pack 1 64-bit Anti-Virus Software: Norton Internet Security.

Last edited 11 months ago by Harps (previous) (diff)

comment:191 Changed 10 months ago by efa

As now I'm keeping old 4.3.16 on Win7 64bit, that is the last one 4.x correctly start VM on my installation

It is not clear if current 5.x solve this trouble.

comment:192 Changed 10 months ago by efa

just upgraded to VirtualBox 5.1.4 on my Win7 - 64 bit All my prev virtual machines works well. Are:

Linux Ubuntu 12.04LTS - 32 bit
Linux MintDEmate201404 - 32 bit
Linux Debian7 - 32 bit
Linux Debian8 - 32 bit
Linux Debian8 - 64 bit
Linux DebianTesting - 32 bit

Bidirectional shared clipboard still doesn't work as in prev version

Last edited 10 months ago by efa (previous) (diff)

comment:193 Changed 8 months ago by keremer

Today I've upgraded from 4.3.30 to 5.1. over Windows 7 Ultimate up-to-date. The result is still the same. It is not possible to start any virtual machines. I am using ESET Smat Secuirty. But uninstalling would not help. Logs are attached.

The problem in the logs are as follows:

f74.1dd4: supR3HardenedScreenImage/Imports: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume3\Windows\System32\user32.dll f74.1dd4: Error (rc=0):

Last edited 8 months ago by keremer (previous) (diff)

Changed 8 months ago by keremer

VBoxHardening.log Win7 Ultimate causing shell32.dll Hardening error

comment:194 Changed 7 months ago by Andersen2025857

I have one VM. When I start it, it will show error. Only this VM get error. The others is fine. Anyone can help me ? My attachment is "Andersen2025857-Logs.zip".

Changed 7 months ago by Andersen2025857

Changed 7 months ago by rambo_ivanov

VMs fail to start. Any help will be appreciated. Thanks!

comment:195 Changed 7 months ago by lubosdz

Cannot start VB 5.1.8 and 5.1.10 (tested both). Logged error is rejecting 'C:\Windows\system32\user32.dll'. Using Windows 7 x64, using Vagrant 1.8.6 and 1.9.0 (tested both with same issue).

Why would be user32.dll rejected? This error did not occur in older versions VB 4.x (I must have reinstalled whole notebook).

Last 10 lines from VBoxHardening.log:

1640.d40: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\uxtheme.dll
1640.d40: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\uxtheme.dll (rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=000000000084fc50:C:\Windows\system32;;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\Driver;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\nodejs\;d:\wamp\bin\php\php7.0\;C:\Program Files\Git\cmd;C:\Program Files\Git\usr\bin;C:\Program Files\TortoiseGit\bin;C:\Program Files (x86)\vagrant\bin;C:\Users\XL\AppData\Roaming\npm [calling]
1640.d40: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefbfb0000 'C:\Windows\system32\uxtheme.dll'
1640.d40: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume2\Windows\System32\user32.dll
1640.d40: Error (rc=0):
1640.d40: supR3HardenedScreenImage/LdrLoadDll: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 cHits=32 \Device\HarddiskVolume2\Windows\System32\user32.dll
1640.d40: Error (rc=0):
1640.d40: supR3HardenedMonitor_LdrLoadDll: rejecting 'C:\Windows\system32\user32.dll' (C:\Windows\system32\user32.dll): rcNt=0xc0000190
1640.d40: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'C:\Windows\system32\user32.dll'
1598.11d4: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 892 ms, the end);
c7c.c84: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1505 ms, the end);

comment:196 Changed 6 months ago by Logik

Facing same error on VB 5.1.10 on windows 7 Ultimate. Just updated today from 5.0.28 to latest stable. Can't even launch VM

Last edited 6 months ago by Logik (previous) (diff)

comment:197 Changed 4 months ago by Elise Benine

had similar issue few months ago. my development VM for  http://schipholparkerenvergelijken.nl/ couldn't start, turned out to be a network card related bug. nothing helped, had to downgrade virtualbox

Note: See TracTickets for help on using tickets.

www.oracle.com
ContactPrivacy policyTerms of Use