[Solved] VboxHardening: VM terminates unexpectedly during startup - E_FAIL (0x80004005)

[bryces]

Hi,

I hope someone has some insight into this issue, I've seen lots of posts related to similar but nothing I've found fixes the issue.

Running VirtualBox 5.1.10r112026 (Qt5.6.2) on Windows 10.

When I try to start any VM or even a newly created VM I get the error popup:

The virtual machine 'test' has terminated unexpectedly during startup with exit code 1 (0x1).
More details may be available in 'H:\VirtualBoxVMs\db-stand-alone\Logs\VBoxHardening.log'.
Result Code:
E_FAIL (0x80004005)
Component:
MachineWrap
Interface:
IMachine {b2547866-a0a1-4391-8b86-6952d82efaa0}

This is happening after my Windows 10 upgrades to version 1709.
If I roll the update back to 1703 everything works fine, but then windows after a few days will upgrade my installation again and break virtualbox.
If anti-virus (symantec end point protection 14.0 mp2) is turned off it does not help.
If I upgrade to the latest VirtualBox it does not help (and for now I have to keep current version as that is the one compatible with our backup software that lets us boot a backup image directly in VirtualBox).
I've run 'sfc /scannow' - windows did not find any integrity violations.
I've watched VirtualBox process with ProcessMonitor - it appears to have no trouble accessing any files or registry keys.

The VBoxHardening.log has a number of 'lacks WinVerifyTrust' for a number of system dll's including kernel32, msvcrt, rpcrt4, sechost, advapi32 and more. I've attached this log file.
As I understand it so far this happens when the signature of the dll's can't be verified, but how is that possible and how do I fix it?

Regards,
Bryce.

[socratis]

Running VirtualBox 5.1.10r112026 (Qt5.6.2) on Windows 10.

This is happening after my Windows 10 upgrades to version 1709.

If you want to use the latest version for your host/guests, you should also consider doing the same for VirtualBox. As of this writing, that would be version 5.2.6. If that doesn't work you should try the latest test builds, especially with all the Spectre/Meltdown patches coming in from all sides.

[bryces]

Hi socratis,

I tried the current test build (VirtualBox-5.2.7-120349-Win.exe) but that doesn't want to run at all:

Failed to acquire the VirtualBox COM object.

The application will now terminate.

Completely failed to instantiate CLSID_VirtualBox: CO_E_SERVER_EXEC_FAILURE.

Result Code: CO_E_SERVER_EXEC_FAILURE (0x80080005)
Component: VirtualBoxClientWrap
Interface: IVirtualBoxClient {d2937a8e-cb8d-4382-90ba-b7da78a74573}

Don't suppose that gives any clues for the earlier failure? Open to any further ideas...
For now I'll revert back to earlier windows 10 version, if I'm not too late, and earlier virtualbox so I can get some work done.

Regards, Bryce.

[mrawlins]

Can window 10 OS support older an version of Virtual Box.. specifically v5.0.40-115130-win?

All my boxes work with v5.2.2 r119230 but with v5.0.40 I get the terminated unexpectedly during startup

I need v5.0.40 to work with other software that does not work with the newer version of Virtual Box
I have attached my Hardening log
Thanks in advance

[socratis]

Can window 10 OS support older an version of Virtual Box.. specifically v5.0.40-115130-win?

No. If you want to use the latest version for your host/guests, you should be doing the same for VirtualBox.

I need v5.0.40 to work with other software that does not work with the newer version of Virtual Box

What software would that be?

I have attached my Hardening log

There no point in doing that.

[mrawlins]

I need v5.0.40 to work with other software that does not work with the newer version of Virtual Box

What software would that be?
vagrant 1.8.1

[socratis]

You need to talk to Vagrant, they have their own Vagrant support channels.

[bryces]

Windows 10 v1607, VirtualBox 5.2.6 r120293 (Qt5.6.2)

Hi,

back to my error 'Completely failed to instantiate CLSID_VirtualBox: CO_E_SERVER_EXEC_FAILURE.' near beginning of this topic when I tried the upgraded version of VBox.
I rolled back windows 10 to 1607 from 1703 and VirtualBox to 5.1.1. VirtualBox was fine again so I then upgraded to it 5.2.6 - now it won't start again with the same error as before.

I think a big clue is I can get past this error if I manually start the VBoxSVC.exe, although troubleshooter says it should never be started manually. If I start it then it is running under the context of explorer.exe, I guess it is meant to run under VirtualBox.exe. Anyway, doing this allows the virtualbox manager to start.

However, my virtual machines still don't start up, I get error of 'The instruction at 0x00000000FF000010 referenced memory at 0x00000000FF000010. The memory could not be written.' Even creating a new machine gets the same error.

So, is there something I can do to encourage VBoxSVC.exe to start by itself when it is meant to?
Or a way around the subsequent memory errors?

Regards,
Bryce.

[bryces]

SOLVED - posting what I had to do.

I had tried all the answers I had found online regarding this, including reinstalling windows 10 (keeping apps & data), uninstalls and reinstalls, deleting .VirtualBox folder of user, and so on.

What worked for me in the end:
- uninstalled virtualbox
- manually deleted virtualbox folder under program files (uninstaller hadn't removed them all)
- searched registry for virtualbox references and removed some I thought should have disappeared with the uninstall.
- copy contents of .VirtualBox folder under user account to a save location, then deleted .VirtualBox folder.
- on a business network so moved computer to a testing OU in Active Directoy that imposed no group policy, reset the machine group policy with secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose in an elevated command prompt.
- rebooted
- installed virtualbox again.
- virtualbox started up after installation (hurrah!) so closed it again, replaced the new VirtualBox.xml with the one from my saved location.
- started up virtualbox again and all was good.
- moved machine back to usual OU, updated policy, rebooted and virtualbox is still good (this group policy stuff may have had no bearing on it, just did it to be sure no policy was interferring with the install).

Regards, Bryce.

[socratis]

Thanks for the feedback, that's an interesting one. For the record, I believe it was one of the following steps that might have actually fixed it:

- searched registry for virtualbox references and removed some I thought should have disappeared with the uninstall.
- on a business network so moved computer to a testing OU in Active Directoy that imposed no group policy, reset the machine group policy with secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose in an elevated command prompt.

If you have the output of resetting the machine group policy, that could help.

Marking as [Solved].