The virtual machine 'XXXXXXXX' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'XXXXXXXX\Logs\VBoxHardening.log'.
Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {85cd948e-a71f-4289-281e-0ca7ad48cd89}
I ran through the hardening post with no success.
Tried to :
disable and remove the AV (Symantec), with no effect.
totally remove and resintall virtualbox
check that hyper-V is not installed/enabled
VM is a new one, so was never powered-up. Same happen with old VM that were powered down.
Yeap, something is interfering with your VirtualBox process. Could be that "Forcepoint DLP Endpoint", could be a web filtering application, could be a lot of things.
But the troubling part is that you say that you can start this VM "normal"? Are you 100% sure? You can start this VM "normal", but not "headless" or "detachable"? It doesn's compute, so do you mind verifying that please?
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
From the GUI, I tested with 3 VM (2 linux and one windows), I can start them with right click/start/normal start, if I choose detachable or headless start it fail with the same error.
I also replaced MS defender by Symantec for the AV, saw the same result.
Any idea on how to get more info on thread or the missing drivers ?
lmarecha wrote:I can start them with right click/start/normal start, if I choose detachable or headless start it fail with the same error.
Do you have 3D/2D acceleration enabled? If yes, can you disable them and try again? I seem to see a pattern lately...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Some had it, some did not. I disabled acceleration (both 2D and 3D) with no changes.
I also made sure there was no trace of Hyper-V left (removed the windows component, leftover NIC and cleanup with bcedit/site)
I ran procmon and nothing jumped to my eyes in it.
In that case, a core dump is sort of required. Read the wiki "Creating core dumps to help analyze VirtualBox crashes", and in particular the "Minidumps on Windows" section. Then put the dump file in a public visible server and post the link to the dump. Someone will be there to take a look...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Also, please take a look at ticket #17679: Error on trying to run VM in headless mode, it got opened 11 days ago, maybe there's a pattern here. Add a "me too" comment, but please include your details in ... detail, not just a "+1" comment. Logs, details, the whole thing. A developer will need to see if there's a pattern there or not.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
I'll add myself to the other thread too. Thanks.
I also tested by delayed the service start to be on-demand (as found in an other thread). It did not change anything, actually it did not even start the service, it was failing before.
I'm not sure for the dump, as it's not a an application crash, I don't see how to force a dump at the time of the issue (unless running it in a debugger).
Any update on this? I am seeing the same problem where I can start any VM normal with no problems, but get this error when starting headless or detachable.
I got the same problem. By some reasons, we have to stick with Windows7 and I had to download DockerTookbox and VirtualBox in order to work with docker, docker-compose.
I can start the VM with GUI but, could not start headless or detachable.
I checked the log file and wonder is this the security issues?
Any help is appreciated.
Jdang
2b24.1df8: ProductName: Microsoft Malware Protection
2b24.1df8: ProductVersion: 4.7.0200.0
2b24.1df8: FileVersion: 4.7.0200.0
2b24.1df8: FileDescription: Microsoft antimalware file system filter driver [2b24.1df8: \SystemRoot\System32\drivers\NisDrvWFP.sys:
2a68.261c: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
2a68.261c: supR3HardenedDllNotificationCallback: load 0000000077060000 LB 0x0011f000 C:\WINDOWS\system32\kernel32.dll [fFlags=0x0]
2a68.261c: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status 22900 (0x5974)) on \Device\HarddiskVolume2\Windows\System32\kernel32.dll [lacks WinVerifyTrust]
@Socratis,
I ran the sfc /scannow and no problem there ., Ran Dism /Online /Cleanup-Image /ScanHealth and No errors detected
I could not run DISM /Online /Cleanup-Image /RestoreHealth : return error 87 no matter what I type.
According to: [WHAT CAN CAUSE A HARDENING RELATED FAILURE?: The root cause of most hardening failures (see note) is an invalid certificate in a DLL which has been loaded into the VirtualBox execution space. An invalid certificate can be due to one of four things (1) the DLL never had a certificate - e.g. malware, free software, or the vendor forgot, (2) the DLL has been hacked, invalidating the signature, (3) the Windows host certificates database has been damaged by host corruption or a buggy Windows update, (4) something, most likely your antivirus, is blocking VirtualBox's attempts to access the executable to check its certificate.]
I would say #4 is the best candidate to cause the problem, I will try to talk to IT dept to see if they can help me. Other than that, I ran out of idea and option.
You have a hardening problem, but not where you're thinking from. Please read really carefully the following FAQ: Diagnosing VirtualBox Hardening Issues for some generic guidelines/ideas.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.