Cannot start any VM as "headless" or "detachable" :

[lmarecha]

allo,

I cannot start any VM as "headless" or "detachable". They all start fine as "normal"

Setup:

• Windows 10 64bits v1709 (build 16299.371)
• VirtualBox 5.2.8

It report:

Code: Select all

The virtual machine 'XXXXXXXX' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'XXXXXXXX\Logs\VBoxHardening.log'.
Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {85cd948e-a71f-4289-281e-0ca7ad48cd89}

I ran through the hardening post with no success.

Tried to :

• disable and remove the AV (Symantec), with no effect.
• totally remove and resintall virtualbox
• check that hyper-V is not installed/enabled
• VM is a new one, so was never powered-up. Same happen with old VM that were powered down.
• Reboot (of course it's Windows)
• sfc /scannow report no problems
• checked the vboxdrv is running

>sc.exe query vboxdrv

SERVICE_NAME: vboxdrv
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

All was working fine before for several month, there was no changes in the VM or virtualbox version. The only known changes are:

• all the Windows 10 updates pushed remotely
• a DLP package installed "Forcepoint DLP Endpoint" (but shown as disabled) that cannot be stop/uninstalled (corporate)

It seems to fail on loading dll, but does not mention which one. Is there any way to know which one ?

[socratis]

1a80.1dc: More than one thread in process

Yeap, something is interfering with your VirtualBox process. Could be that "Forcepoint DLP Endpoint", could be a web filtering application, could be a lot of things.

But the troubling part is that you say that you can start this VM "normal"? Are you 100% sure? You can start this VM "normal", but not "headless" or "detachable"? It doesn's compute, so do you mind verifying that please?

[lmarecha]

I confirm.

From the GUI, I tested with 3 VM (2 linux and one windows), I can start them with right click/start/normal start, if I choose detachable or headless start it fail with the same error.
I also replaced MS defender by Symantec for the AV, saw the same result.
Any idea on how to get more info on thread or the missing drivers ?

Thanks

[socratis]

I can start them with right click/start/normal start, if I choose detachable or headless start it fail with the same error.

Do you have 3D/2D acceleration enabled? If yes, can you disable them and try again? I seem to see a pattern lately...

[lmarecha]

Some had it, some did not. I disabled acceleration (both 2D and 3D) with no changes.
I also made sure there was no trace of Hyper-V left (removed the windows component, leftover NIC and cleanup with bcedit/site)
I ran procmon and nothing jumped to my eyes in it.

[socratis]

In that case, a core dump is sort of required. Read the wiki "Creating core dumps to help analyze VirtualBox crashes", and in particular the "Minidumps on Windows" section. Then put the dump file in a public visible server and post the link to the dump. Someone will be there to take a look...

[socratis]

Also, please take a look at ticket #17679: Error on trying to run VM in headless mode, it got opened 11 days ago, maybe there's a pattern here. Add a "me too" comment, but please include your details in ... detail, not just a "+1" comment. Logs, details, the whole thing. A developer will need to see if there's a pattern there or not.

[lmarecha]

I'll add myself to the other thread too. Thanks.
I also tested by delayed the service start to be on-demand (as found in an other thread). It did not change anything, actually it did not even start the service, it was failing before.
I'm not sure for the dump, as it's not a an application crash, I don't see how to force a dump at the time of the issue (unless running it in a debugger).

[jimmycarbone]

Any update on this? I am seeing the same problem where I can start any VM normal with no problems, but get this error when starting headless or detachable.

[jdang]

Hi,

I got the same problem. By some reasons, we have to stick with Windows7 and I had to download DockerTookbox and VirtualBox in order to work with docker, docker-compose.
I can start the VM with GUI but, could not start headless or detachable.
I checked the log file and wonder is this the security issues?
Any help is appreciated.

Jdang


2b24.1df8: ProductName: Microsoft Malware Protection
2b24.1df8: ProductVersion: 4.7.0200.0
2b24.1df8: FileVersion: 4.7.0200.0
2b24.1df8: FileDescription: Microsoft antimalware file system filter driver
[2b24.1df8: \SystemRoot\System32\drivers\NisDrvWFP.sys:

2b24.1df8: ProductName: Microsoft Malware Protection
2b24.1df8: ProductVersion: 4.7.0200.0
2b24.1df8: FileVersion: 4.7.0200.0
2b24.1df8: FileDescription: Microsoft Network Realtime Inspection Driver
2b24.1df8: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume2\Program Files\Oracle\VirtualBox'

2a68.261c: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
2a68.261c: supR3HardenedDllNotificationCallback: load 0000000077060000 LB 0x0011f000 C:\WINDOWS\system32\kernel32.dll [fFlags=0x0]
2a68.261c: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]


@Socratis,

I ran the sfc /scannow and no problem there ., Ran Dism /Online /Cleanup-Image /ScanHealth and No errors detected
I could not run DISM /Online /Cleanup-Image /RestoreHealth : return error 87 no matter what I type.

According to:
[WHAT CAN CAUSE A HARDENING RELATED FAILURE?: The root cause of most hardening failures (see note) is an invalid certificate in a DLL which has been loaded into the VirtualBox execution space. An invalid certificate can be due to one of four things (1) the DLL never had a certificate - e.g. malware, free software, or the vendor forgot, (2) the DLL has been hacked, invalidating the signature, (3) the Windows host certificates database has been damaged by host corruption or a buggy Windows update, (4) something, most likely your antivirus, is blocking VirtualBox's attempts to access the executable to check its certificate.]

I would say #4 is the best candidate to cause the problem, I will try to talk to IT dept to see if they can help me. Other than that, I ran out of idea and option.

regards,'

jdang

[socratis]

@jdang

2b24.1df8: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0xc0000005 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 662 ms, CloseEvents);

You have a hardening problem, but not where you're thinking from. Please read really carefully the following FAQ: Diagnosing VirtualBox Hardening Issues for some generic guidelines/ideas.

I would concentrate on the "sfc /scannow" and the System file check (SFC) Scan and Repair System Files & DISM to fix things SFC cannot from Microsoft.