virtualbox.org

Hi- After upgrading to 6.1.30 my previously-fine VM won't start. I attached a log that I found that contains some (but not much) info at end. When I try to launch the VM I get the following screen:
Any help would be appreciated.

That'll be a hardening error. Please see Diagnosing VirtualBox Hardening Issues

Thanks very much for the reply. I thought of that, but searched my entire drive and did not find a file called VBoxHardening.log. Anything else I should look for?

Please right-click the VM in the main Virtualbox window's VM list, choose Show Log. The hardening log should be on the second tab from the left. If it is there, save and zip it, and post the zip file, using the forum's Upload Attachment tab.

If it is not there, try the tutorial's trick of starting the VM headless.

Thanks. I tried Show Log. The hardening log was not there. Tried running headless, which yielded the identical result to running the normal way.

RTB wrote:I tried Show Log. The hardening log was not there.

If there was a VBox.log file, I'd be interested in that, too.

Attached.

Thanks for the BioNex Windows 10-2021-11-22-14-52-43.log file, which is from a previous run on 2021-11-22T22:49:41.803761500Z. I didn't notice any unusual log messages inside.

Since we only have the general log message from the VBoxSVC.log file and neither a VBoxHardening.log file nor a VBox.log file, the issue must occur very early during the VM start. I'd suggest to note the wall clock time while reproducing the issue, and check the Windows Event Log on the host for additional information. Additionally, create a new VM and try to start that.

Thanks. New VMs all fail in the same manner. And yes, the failure occurs quickly after pressing the Start button.

On your advice, I found the following in the Application log:
Faulting application name: VirtualBoxVM.exe, version: 6.1.30.48432, time stamp: 0x619bb44c
Faulting module name: VirtualBoxVM.exe, version: 6.1.30.48432, time stamp: 0x619bb44c
Exception code: 0xc0000005
Fault offset: 0x0000000000014fcb
Faulting process id: 0x57fc
Faulting application start time: 0x01d7ef0ec8d7839b
Faulting application path: C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
Faulting module path: C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
Report Id: 18bf24e7-f73b-4248-9d8d-cfb01e6e9231
Faulting package full name:
Faulting package-relative application ID:

And then:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: VirtualBoxVM.exe
P2: 6.1.30.48432
P3: 619bb44c
P4: VirtualBoxVM.exe
P5: 6.1.30.48432
P6: 619bb44c
P7: c0000005
P8: 0000000000014fcb
P9:
P10:

Attached files:

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VirtualBoxVM.exe_a411b66a4946757a1ee79acf4d19e4e7a7dbdf_48fba7ca_5db99302-a5ec-49ca-8b7f-bec74f4f515d

Analysis symbol:
Rechecking for solution: 0
Report Id: 18bf24e7-f73b-4248-9d8d-cfb01e6e9231
Report Status: 4
Hashed bucket:
Cab Guid: 0

There were no files at the directory noted above.

I remember that exit code showing "-1073741819 (0xc0000005)" and no mention of the hardening log was caused recently by renegade/overprotective AV.

A web-search "exit code -1073741819 (0xc0000005) site:forums.virtualbox.org" brought up this:
viewtopic.php?t=83021

Basically, something on the PC is interfering so deeply with Virtualbox that Virtualbox can't even report what crashed it. What AV or other security/web-safe-browsing/safe-banking/remote-control/etc software do you have?

FWIW, the crash happened very early while VirtualBox was checking the common Windows DLLs NTDLL.DLL, KERNELBASE.DLL and KERNEL32.DLL. At least one of those DLLs is modified in an unexpected way, leading to the crash. Please follow scottgus1's advices.

I killed SentinelOne, our anti-virus. And suddenly everything worked. Thanks for all the guidance, I'll let my IT guys slog through all the exceptions and whatnot.

You're welcome, and thanks for reporting back!

RTB wrote:I killed SentinelOne, our anti-virus. And suddenly everything worked. Thanks for all the guidance, I'll let my IT guys slog through all the exceptions and whatnot.

Hello
i'm sorry to bother you, i'm facing today almost same issue, ie. VM cannot start since recent VBox upgrade. And issue comes from SentinelOne AV (tested w/ and w/o)
By any chance, could you share some hints how your IT guy manage exceptions to get things back to normal?
I'm in a big service, with externalized IT, and if i don't provide any clue about the resolution then i won't get anything done on this issue...
Anyway, just in case, thanks in advance

PS: sorry to revive this topic, as newbie i cannot send PM to author

No problem resurrecting this topic, it's not that old. It seems you have a repeatable process to pin this on the AV. I hope RTB can provide the help you need.

Meanwhile, if you try getting the IT overlords set everything related to Virtualbox as an exception to the AV scanner, it might help:

• The Oracle Program Files folder
• C:\Users\{accountname}\.Virtualbox
• each folder containing a VM's files or disk files (the VM OS should have its own AV installed if the VM gets on the internet)
• Possibly the vbox drivers in C:\Windows\System32\Drivers (up to 5 .sys files starting with 'Vbox')