Discussion of Problems due to Hardened Security

[mpack]

There has never been a version 4.0. If you went all the way back to 4.0.0 and it still didn't work then it can't be a hardening problem, since hardening protection wasn't introduced until 4.3.14. Unless you had an entirely different problem that is, because I'm not sure 8.1 was a supported host for 4.0.0 (in fact I'm quite certain it wasn't), so naturally I wouldn't expect it to work.

What AV software are you using? Have you installed a hacked theme?

[stives1974]

Ok, the earliest version I installed version 4.0.36.

I have completely removed AV, I was using McAfee. There is no hacked theme.

[greyulv]

@greyulv: Are you running VirtualBox in some kind of compatibility mode? Don't.

No, I checked the properties and it is not set to run in compatibility mode.

Have installed the following versions of VBox
5.0.2
5.0.4
5.0.6
5.0.8
5.0.10
5.0.12
5.0.14

Cannot start already existing VMs or even start a freshly created on.

Suggestions on what else to test are welcome.

Update: Removed Avetco Defendpoint Client installed on machine and now VB is working!

[stives1974]

I have reluctantly installed Hyper-V. Poor as Microsoft generally are, if you post an issue on their forums someone does generally try to help within a few days.

[mpack]

Seriously? Well, how much did you pay Microsoft, and how much did you pay Oracle? How much support do you think this buys you?

[stefan.becker]

The Problem with Avira as AV seems to be solved. With the latest Update its working again.

[dba_chicken]

Sorry, cannot verify - my VB-Client still doesn't start.
Furthermore: Avira AV has not patched to 15.0.16 respectively 16.0.16,
my installation (after latest patch) version of Avira is 15.0.15.141

Cheers,
Martin

The Problem with Avira as AV seems to be solved. With the latest Update its working again.

[Kieruns]

Version 5.0.14 r105127

Same Issue can not start Virtual Box

The virtual machine 'SOA_VM' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'C:\Users\Sreera0K\VirtualBox VMs\SOA_VM\Logs\VBoxHardening.log'.



Failed to open a session for the virtual machine SOA_VM.

The virtual machine 'SOA_VM' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'C:\Users\Sreera0K\VirtualBox VMs\SOA_VM\Logs\VBoxHardening.log'.

Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {f30138d4-e5ea-4b3a-8858-a059de4c93fd}

==============================================


Tried Options


- Uninstalled / Reinstalled
- Disabled Antivirus
- Restarted machine


Complete log file is attached here . Really appreciate if someone helps me in fixing the issue . Its really frustrating now .


Thanks,

[wreckwriter]

Suddenly can't open any of my VMs, get the following error:

Failed to open a session for the virtual machine Mint.

The virtual machine 'Mint' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'U:\Mint\Logs\VBoxHardening.log'.

Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {f30138d4-e5ea-4b3a-8858-a059de4c93fd}


Host- Windows 10 Version 10.0.10586 Build 10586
Installed security applications- Eset Nod32 (latest), MalwareBytes Anti-malware (latest), Hitman Pro (latest), Zemana AntiLogger (latest)
Vbox version- 5.0.14r 105127 (just reinstalled)

Vboxhardening.log attached.

Don't know of anything that has changed since I last used Vbox, possibly a Windows update but no major ones to my knowledge. Just tried reinstalling Vbox, no change. Any help greatly appreciated!

[mpack]

Did you look at your own log before posting it? You can hardly miss the problem: loads and loads of lines like these :-

29fc.700: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -5667 (0xffffe9dd)) on \Device\HarddiskVolume4\misc\64bit\RBHook.dll [lacks WinVerifyTrust]
29fc.700: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -5667 (0xffffe9dd)) on \Device\HarddiskVolume4\misc\64bit\RBHook.dll [lacks WinVerifyTrust]
29fc.700: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -5667 (0xffffe9dd)) on \Device\HarddiskVolume4\misc\64bit\RBHook.dll [lacks WinVerifyTrust]
29fc.700: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -5667 (0xffffe9dd)) on \Device\HarddiskVolume4\misc\64bit\RBHook.dll [lacks WinVerifyTrust]
29fc.700: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -5667 (0xffffe9dd)) on \Device\HarddiskVolume4\misc\64bit\RBHook.dll [lacks WinVerifyTrust]
29fc.700: supR3HardenedScreenImage/LdrLoadDll: cache hit (Unknown Status -5667 (0xffffe9dd)) on \Device\HarddiskVolume4\misc\64bit\RBHook.dll

I have no idea what RBHook.dll is. I'll leave that to your own research. You need to get rid of it.

[wreckwriter]

Yea, I did look at it. That program, RBTray, has been on the PC for longer than Vbox, there's never been a problem until today. Was hoping for a little more than "get rid of it".

[mpack]

I'm sorry, but it's an unsigned DLL injecting itself into the VirtualBox address space. It needs to be upgraded to a signed version, or got rid of. Or, if it can be told not to mess with VirtualBox then you can do that too.

[wreckwriter]

I'm sorry, but it's an unsigned DLL injecting itself into the VirtualBox address space. It needs to be upgraded to a signed version, or got rid of. Or, if it can be told not to mess with VirtualBox then you can do that too.

Disabled the program from startup, rebooted, issue continues. Apparently its not the problem, or not the only problem? Confusing thing is that all this stuff has been living happily together for quite some time.

New log attached if you don't mind. I see several files mentioned but not sure how to determine which is the issue.

[mpack]

Now you seem to be having widespread certfication issues of the kind that Windows Update usually reserves for Windows 7. I'll leave you to the devs, since this is all murky stuff.

[wreckwriter]

Now you seem to be having widespread certfication issues of the kind that Windows Update usually reserves for Windows 7. I'll leave you to the devs, since this is all murky stuff.

All righty. Thanks for looking at it anyway. I'll hope a dev will get time to take a look.

I noticed a lot of entries that seem to relate to Malwarebytes. I tried disabling its self protection feature, rebooted, same. Tried disabling it from starting at all, rebooted, same. To my knowledge this program has not updated since last time I was able to run my VMs.