can't start virtual machine

[Sacredlore]

I can't start virtual machine by unknow reason.
Runing VirtualBox 5.1.8 on Windows 7 x64

Startup logs are in atachement.
Last strings from VBoxHardening.log

f64.1210: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume2\Windows\System32\cryptbase.dll
f64.1210: supR3HardenedMonitor_LdrLoadDll: pName=C:\Windows\system32\CRYPTBASE.dll (Input=CRYPTBASE.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=000000000024e851:<flags> [calling]
f64.1210: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=000007fefd460000 'C:\Windows\system32\CRYPTBASE.dll'
1304.ab4: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1708 ms, the end);
e48.4ac: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 2060 ms, the end);

Why is this happening?

[scottgus1]

The security check is stopping on the Windows file user32.dll. Either there's a theme hack on your PC or something has changed that essential file. Right click the Command Prompt icon, select Run As Administrator, then type "sfc /scannow". This will replace the user32.dll with a valid version.

[mpack]

This seems to be happening a lot. I wonder if lots of people are downloading the same malware/rootkit.

[socratis]

Or any recent Microsoft updates? The thing is that they seem to have switched to a monthly-catch-all update, which makes specific KB articles responsible for this difficult to identify.

[scottgus1]

I look on 11-4-2016 and I see that my user32.dll was last modified Tuesday, ‎September ‎27, ‎2016, ‏‎8:46:32 PM, which was last time Windows Updates was run on this PC (win 10 pro VB 5.1.6). I'm not having issues for now, but bunged Updates seem a reasonable target for finger-pointing.

[mpack]

Well, I do have a problem with the Windows Update theory. If it's an official DLL update, then "sfc /scannow" shouldn't help: the bad user32.dll should be replaced by an identical bad copy.

Unless of course the issue has nothing to do with user32, but still gets fixed by "sfc /scannow".

[socratis]

If it's an official DLL update, then "sfc /scannow" shouldn't help: the bad user32.dll should be replaced by an identical bad copy.

True, very true...

[Sacredlore]

apparently cryptbase.dll in VBoxHardening.log referred
why user32.dll you speak?

an ecryption, the new opportuniy in the settings of VM is appeared in 5.1 virtualbox version, maybe that has something to do with it ?

[mpack]

Did you try the fix command mentioned?

[Sacredlore]

yes, i run sfc /scannow and it helped,
all virtual machines run normally, thank you

I want to know what I could do, that the need to run sfc /scannow created
what happened to the system files of Windows ?

[BillG]

That s one of the mysteries of life. You will find lots of discussion about it on Windows sites (but no answers I suspect).

[mpack]

None of us can know your usage patterns, or the state of your hard disk. It could be a random accident, or it could be caused by installing malware. There's really no way to tell without an expert and close up analysis of the PC.

[scottgus1]

apparently cryptbase.dll in VBoxHardening.log referred
why user32.dll you speak?

Admittedly, the hardening log is hard to interpret. So this is a good question. I open the log and search for the words "error" or "reject". One Oracle forum admin also recommends looking for "fail", and one forum moderator looks in the "adversaries" section. The same line or the next line will show what file may be causing a problem. Search for "error" in your hardening log and you will see that user32.dll is the file errors occur on.

an ecryption, the new opportuniy in the settings of VM is appeared in 5.1 virtualbox version, maybe that has something to do with it ?

cryptbase.dll is the last file mentioned in the hardening log, so it is a good question whether that last file is the error. But there are no errors in the log associated with this file, so it appears clean. cryptbase.dll is a Windows OS file, not from Virtualbox. Virtualbox encryption occurs completely outside the guest OS; the guest OS doesn't know Virtualbox is encrypting the guest's data and no special files are inserted into the guest OS to enable Virtualbox encryption.

[marakneo]

cryptbase.dll corrupted so...

sfc /scannow worked for me !