[Resolved] VBox guest crashing after host Windows 10 upgrade

[poutineisking]

Folks,
I am not sure if it is just a coincidence but the virtual machine (Windows XP) I had built in my father's laptop (running Windows 10) started crashing after the most recent Windows 10 update. The error on screen is: "Error relaunching VirtualBox VM process:5. Command line: ... (rc=-104)"

I have looked at VBoxHardening.log and it exits with ExitCode=0x1. I have also tried my best to read carefully the FAQ for troubleshooting VBox hardening issues.

I have run the "sfc /scannow" and it came back with no errors. The only anti-virus enabled in the host is the Windows 10 native Defender. I have looked at the logs and I see some rejections that caught my attention: 1 related to TeamViewer (I live in another country so I can only help my parents over TeamViewer) and 1 related to Trusteer (an IBM software used by my father's banking institution for web access to his bank account). I am not sure if these 2 are causing the issue (I tried fully removing and re-installing VirtualBox from scratch over TeamViewer but still got the same error message).

I am attaching the zipped VBoxHardening.log file and I would much appreciate any suggestions on what to do next.

In case you are curious, the WinXP guest is only used by my father to play the old school version of Solitaire and Hearts. I tried convincing him to move on and use the Windows 10 versions to no luck.

[socratis]

and 1 related to Trusteer (an IBM software used by my father's banking institution for web access to his bank account)

That's your problem. Their 1/Jun/2018 update messed things up. Uninstall it and VirtualBox will work again. They have been notified by an horde of users by now...

Good detective job, you saved us going through yet another VBoxHardening.log...

[poutineisking]

Thank you very much for confirming. Appreciated!

[socratis]

Thank you very much for confirming.

Actually, you need to confirm my confirmation. Does it work if you uninstall Trusteer? I think it will, just... confirming!

[poutineisking]

I will confirm. I can only access his laptop over the weekend though so I will need a few days to reply back. Thanks again!

[poutineisking]

Hi,
So here is what I have been able to confirm from the work on the weekend.

1. Uninstalled Trusteer (uninstall completed successfully however I have found 2 dll files still remained in the original installation folder of Trusteer under Program FIles).
2. Fully uninstalled VirtualBox successfully.
3. Installed latest and greatest version of VirtualBox again
4. Virtual Machine is working again !

So this was good news and seems to confirm that Trusteer was the one affecting the starting of the VM.

I decided to check if the VM would break again if I installed Trusteer back. I went to the bank institution web site and downloaded their most recent version of Trusteer. After successful installation of Trusteer, the VM still worked fine !

So I'm not sure if IBM fixed something in Trusteer the meantime. I will keep an eye and see if the VM continues to be stable for the coming weeks as I have kept Trusteer in place after the second install.

Thanks for the help!

[socratis]

After successful installation of Trusteer, the VM still worked fine !

What's the version of Trusteer that you installed? Version/date, whatever you have available. Even a link would do...

[poutineisking]

I can try to get the version information currently installed next weekend when I can connect again. For now, if it helps, here is the URL for the bank institution download (Windows version):

https://guardiao.itau.com.br/hda/DiagnosticoItau.exe

I suspect this is just a wrapper binary that then downloads and installs the latest approved version of Trusteer for their access.

[poutineisking]

Closing the loop here. It seems that the bank institution is actually no longer using IBM Trusteer for security validation. I assumed Trusteer was successfully installed as the bank's installation wrapper completed successfully. However, when I reconnected and looked at installed programs list, there was no IBM Trusteer installed and, instead, they are using Warsaw (a different validation software).

That was a red herring and my bad for assuming it was the same software installed without checking on Installed Programs. VM continues to work fine though and the only thing different was the removal of the first instance of IBM Trusteer that was in the computer before.

Thanks for the help!