E_FAIL (0x80004005) MachineWrap

[Karam]

Hello!
I just installed VBox (latest version VirtualBox-5.2.22-126460-Win) on a pretty standard Windows 7 PC that has VT-x and VT-d in CPU+Mainboard/BIOS available and enabled (i7-8700K + ASRock Fatal1ty Z370 Professional Gaming i7).
However I get this error when I try to start any VM I create (even if I just create a random little DOS test VM):

Code: Select all

The virtual machine 'test' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'C:\Users\Karam\VirtualBox VMs\test\Logs\VBoxHardening.log'.

Result Code: 
E_FAIL (0x80004005)
Component: 
MachineWrap
Interface: 
IMachine {cfc5671a-2309-4893-8744-ba4c07d65d86}

So I googled a bit and then tried various things:
- install VBox as administrator and run it as administrator
- commandline-parameter "-msiparams NETWORKTYPE=NDIS5".
- I don't have Avira installed (or any other Antivirus), so no interference from such programs.
- tried disabling networking in the VM.
- tried disabling Bridging in the network adapter's properties.
- tried disabling the VBox network adapter.
- check the machine's .vbox and .vbox-pref files and switch those around for the heck of it.
- I have no other concurrent apps running except for Chrome browser and Notepad++.

Nothing helped. Only one thing worked:
Downgrading all the way to version "VirtualBox-4.2.22-91556-Win". This finally ran any VM as it should. But that version is super old and not a solution because I need to run modern OSX guest.

So I also tried VirtualBox-6.0.0_BETA2-126642-Win but again the error appeared.
Why would this not work!? Thanks in advance for your help!

I zipped and attached "VBoxHardening.log" file from the "test" VM, thanks for pointing that out.

[mpack]

Partial logs are not useful to us I'm afraid. Nor are logs that have been edited.

Zip up the entire log and attach it to a message here.

[Martin]

(Opening post was modified to include the full log as zip)

[mpack]

The log provided is for the 6.0.0_BETA2 version of VirtualBox, no discussion of which will occur outside of the beta forum (nor inside it, unless you can show that the hardening issue is a problem specifically of the beta).

That said, your error is :-

2d0c.33f8: supR3HardenedScreenImage/Imports: rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x0 fAccess=0x0 \Device\HarddiskVolume2\Windows\System32\ws2_32.dll: Not signed.

ws2_32.dll is apparantly the Windows Sockets 2 communications library. I have no idea why that would be unsigned: you'll have to find that out yourself. Continued discussion in this topic will require you to switch back to a supported version of VirtualBox.

[Karam]

Oops, sorry. Forgot that a new logfile was created after I tried the beta.
I now attached the correct log file!

However, thanks for your observation, as it also persists in the 5.2.22 logfile! I have no idea either why ws2_32.dll would be unsigned or what that even means for VBox and my whole sytem, as a consequence. :p I understand signing is so the OS knows it's the genuine thing, but does it matter if it isn't signed? Well, I'll google around to find out how to replace it with a signed version I guess, and update my posting here accordingly!

Edit: Could not determine a way to "restore" ws2_32.dll to "factory default". Websites I read gave warnings that no flash drive must be installed to do this from Windows Startup Repair, but actually the whole system runs on a flash drive (SSD). Only way seems to reinstall the OS completely, which is currently out of scope. Is it really required to do that for VBox to work?

Edit2:
I tried to do "sfc /scannow", looked at the resulting log and spotted the very same error message that VBox gave! Here's a snippet from the 2.7MB sized log file "CBS.log" that was created in $WINDIR/Logs. It says "HRESULT = 0x80004005 - E_FAIL" same as VBox did in its logfile! It occurs in several places in that file, but every time the block of log lines surrounding it seems pretty much identical except for line numbers, so I just picked one. Does this perhaps help somehow?:

Code: Select all

2018-11-22 12:20:00, Info                  CBS    Scavenge: Begin CSI Store
2018-11-22 12:20:01, Info                  CSI    0000000a Performing 1 operations; 1 are not lock/unlock and follow:
  Scavenge (8): flags: 00000017
2018-11-22 12:20:01, Info                  CSI    0000000b Store coherency cookie matches last scavenge cookie, skipping scavenge.
2018-11-22 12:20:01, Info                  CSI    0000000c ICSITransaction::Commit calling IStorePendingTransaction::Apply - coldpatching=FALSE applyflags=7
2018-11-22 12:20:01, Info                  CSI    0000000d Creating NT transaction (seq 2), objectname [6]"(null)"
2018-11-22 12:20:01, Info                  CSI    0000000e Created NT transaction (seq 2) result 0x00000000, handle @0x248
2018-11-22 12:20:01, Info                  CSI    0000000f@2018/11/22:11:20:01.404 CSI perf trace:
CSIPERF:TXCOMMIT;88817
2018-11-22 12:20:01, Info                  CBS    Scavenge: Completed, disposition: 0X1
2018-11-22 12:20:01, Info                  CSI    00000010@2018/11/22:11:20:01.405 CSI Transaction @0x15ee1b0 destroyed
2018-11-22 12:20:01, Info                  CBS    Reboot mark refs: 0
2018-11-22 12:20:01, Info                  CBS    Idle processing thread terminated normally
2018-11-22 12:20:01, Info                  CBS    Ending the TrustedInstaller main loop.
2018-11-22 12:20:01, Info                  CBS    Starting TrustedInstaller finalization.
2018-11-22 12:20:01, Info                  CBS    Ending TrustedInstaller finalization.
2018-11-22 12:39:04, Info                  CBS    Starting TrustedInstaller initialization.
2018-11-22 12:39:04, Info                  CBS    Loaded Servicing Stack v6.1.7601.23505 with Core: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.23505_none_681aa442f6fed7f0\cbscore.dll
2018-11-22 12:39:05, Info                  CSI    00000001@2018/11/22:11:39:05.110 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7feda57eb5d @0x7fedab79b6d @0x7fedab4358f @0xfffce97c @0xfffcd799 @0xfffcdb2f)
2018-11-22 12:39:05, Info                  CSI    00000002@2018/11/22:11:39:05.142 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7feda57eb5d @0x7fedabc6ade @0x7fedab92984 @0x7fedab43665 @0xfffce97c @0xfffcd799)
2018-11-22 12:39:05, Info                  CSI    00000003@2018/11/22:11:39:05.146 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7feda57eb5d @0x7feeace8728 @0x7feeace8856 @0xfffce474 @0xfffcd7de @0xfffcdb2f)
2018-11-22 12:39:05, Info                  CBS    Ending TrustedInstaller initialization.
2018-11-22 12:39:05, Info                  CBS    Starting the TrustedInstaller main loop.
2018-11-22 12:39:05, Info                  CBS    TrustedInstaller service starts successfully.
2018-11-22 12:39:05, Info                  CBS    SQM: Initializing online with Windows opt-in: False
2018-11-22 12:39:05, Info                  CBS    SQM: Cleaning up report files older than 10 days.
2018-11-22 12:39:05, Info                  CBS    SQM: Requesting upload of all unsent reports.
2018-11-22 12:39:05, Info                  CBS    SQM: Failed to start upload with file pattern: C:\Windows\servicing\sqm\*_std.sqm, flags: 0x2 [HRESULT = 0x80004005 - E_FAIL]
2018-11-22 12:39:05, Info                  CBS    SQM: Failed to start standard sample upload. [HRESULT = 0x80004005 - E_FAIL]
2018-11-22 12:39:05, Info                  CBS    SQM: Queued 0 file(s) for upload with pattern: C:\Windows\servicing\sqm\*_all.sqm, flags: 0x6
2018-11-22 12:39:05, Info                  CBS    SQM: Warning: Failed to upload all unsent reports. [HRESULT = 0x80004005 - E_FAIL]
2018-11-22 12:39:05, Info                  CBS    No startup processing required, TrustedInstaller service was not set as autostart, or else a reboot is still pending.
2018-11-22 12:39:05, Info                  CBS    NonStart: Checking to ensure startup processing was not required.
2018-11-22 12:39:05, Info                  CSI    00000004 IAdvancedInstallerAwareStore_ResolvePendingTransactions (call 1) (flags = 00000004, progress = NULL, phase = 0, pdwDisposition = @0xe2f9f0
2018-11-22 12:39:05, Info                  CSI    00000005 Creating NT transaction (seq 1), objectname [6]"(null)"
2018-11-22 12:39:05, Info                  CSI    00000006 Created NT transaction (seq 1) result 0x00000000, handle @0x20c
2018-11-22 12:39:05, Info                  CSI    00000007@2018/11/22:11:39:05.178 CSI perf trace:
CSIPERF:TXCOMMIT;5786

[mpack]

E_FAIL is a standardised error code. The fact that two Windows software packages observe Windows standards doesn't necessarily mean anything. If both had mentioned ws2_32.dll then that would mean something.

Embedded certificates have become part of the infrastructure of 64bit Windows. The purpose is essentially so you can know if you've been hacked. VirtualBox is saying that you may have been hacked, so it refuses to load the offending DLL. Unfortunately it can't seem to run without this DLL (actually not proven: we don't know this is the only problem).

If a DLL or EXE fails to carry a valid signature then it means one of the following:

1. The developer couldn't afford to pay for a certification process. But that couldn't apply to a Microsoft DLL, which presumably this is. Did you look at the properties of this DLL? Does it say Microsoft?
2. The developer format to sign this DLL. No way. It would fail Microsoft's own hardening checks.
3. The DLL is corrupted. Maybe. Corruption must be light if it's still work. "sfc /scannow" should have fixed this.
4. You have installed a freeware winsock. Possible.
5. You have been hacked. Possible. "sfc /scannow" may fix this, unless the hacker also replaced the previous version.

Below are some screenshots of the properties of "C:\Windows\System32\ws2_32.dll" on my own Windows 10 (1803) PC. The first shows the "Digital Signatures" tab, showing that my one is signed, the second shows the "Details" tab, showing that Microsoft wrote my one.

Capture.PNG (9.25 KiB) Viewed 1757 times