virtualbox.org

Hi,

Recently (about 2+ days) ago my VirtualBox (6.1.32) GUI application start to have difficulty starting up, it will exit after 2~3 seconds upon started.

Currently, I have to restart the application 2~3 times then only the application will run. When shutting down the laptop, there's always a warning message saying "VirtualBox Interface" (VBoxSVC?) is still running despite that the VM already shutdown and the GUI has closed.

From the Windows Event Viewer =>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Faulting application name: VirtualBox.exe, version: 6.1.32.49290, time stamp: 0x61e55360
Faulting module name: Qt5GuiVBox.dll, version: 5.6.2.0, time stamp: 0x58e261e1
Exception code: 0xc0000005
Fault offset: 0x00000000001f0c38
Faulting process ID: 0x36c4
Faulting application start time: 0x01d82ab9e27db57d
Faulting application path: C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
Faulting module path: C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll
Report ID: 8a22444d-da7e-43c2-9693-0d39285b714d
Faulting package full name:
Faulting package-relative application ID:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

I have tried to start my Linux VM in headless mode which now fail all the time.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Failed to open a session for the virtual machine <redacted>.
The virtual machine '<redacted>' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005).
Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {85632c68-b5bb-4316-a900-5eb28d3413df}
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From Windows Event Viewer =>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Faulting application name: VBoxHeadless.exe, version: 6.1.32.49290, time stamp: 0x61e55350
Faulting module name: VBoxHeadless.exe, version: 6.1.32.49290, time stamp: 0x61e55350
Exception code: 0xc0000005
Fault offset: 0x0000000000014e0b
Faulting process ID: 0xad8
Faulting application start time: 0x01d82aba1407d62e
Faulting application path: C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
Faulting module path: C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
Report ID: 81bb8aa4-b4b9-433a-aec1-e3d78fd0c866
Faulting package full name:
Faulting package-relative application ID:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

I have repaired the installation but the problem persist. I enclosed the log files here and appreciate if anyone has encountered the same issue can shade some lights here?

Update: I have just tried revert to v6.1.30 and v6.1.28, the problem remains the same

I think the error code -1073741819 (0xc0000005) might have something to do with oppressive host antivirus. (That code can also be a hardening error code, but the main Virtualbox window would still be able to open stably.)

I see this:

C:\Program Files\SentinelOne\Sentinel Agent 21.7.4.1043\InProcessClient64.dll

Try uninstalling SentinelOne completely, not just disabling.

What other security and AV software do you have installed?

The Sentinel1 is centrally managed, it will re-install/re-configure itself when you are on the network with Sentinel1 server. Happy to try out any other option... thanks!

Then you'll have to go to your boss to get IT to help you get Virtualbox running. IT overlords are not something the forum can handle.

Base on your second assessment, it is inconclusive that Sentinel1 is causing the issue, right? The following log line indicated the main Virtualbox window cannot open in stable manner. Of course, it could well be something wrong when enumerating medium (some sort of hardware hardening?). However, after re-attempt 2~3 times the application start to work.

`Faulting module path: C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll`

How about the issue with headless mode? Mind to shade some lights on that end?

The usual suspects are so-called security software and/or other software invading the address space of VirtualBox processes. Please repeat the headless VM start and provide the VBoxHardening.log and VBox.log files of this run.

c0000007 wrote:Base on your second assessment, it is inconclusive that Sentinel1 is causing the issue, right?

True, but AV software has done this before. Cylance Protect pulled this sort of thing a few months ago. Some of fixing stuff is guessing based on previous experience.

Please follow fth0's suggestions above.

So far, by adding VirtualBox program and directory to HP Sure Sense exclusion list, VirtualBox can seem to start as usual. But this change did not resolve the headless mode issue; still terminate with the same error.

Not sure why I couldn't locate the VBoxHardening.log and VBox.log, maybe this is because VBoxHeadless.exe terminated at the very early stage.

c0000007 wrote:adding VirtualBox program and directory to HP Sure Sense exclusion list

Excellent! The more security software, the more chance to bung up Virtualbox. Set exclusions in every security app, you might get things broken loose.

c0000007 wrote:I couldn't locate the VBoxHardening.log and VBox.log, maybe this is because VBoxHeadless.exe terminated at the very early stage.

Could be. Right-click the VM in the main Virtualbox window's VM list, choose Show Log. If they're not being made there, then something security-wise is still blocking.

In my case, VBoxHardening.log is only created when I launch the VM in foreground. If I launch in headless mode, this log will not be created.

Can you provide a Windows Minidump file for a headless VM start?

Any tools you can recommend with steps to do this? I can use procdump, but because the VBoxHeadless.exe terminated fast, I don't have opportunity to snap it.

I have no personal experience in how to create a Windows Minidump for VBoxHeadless (yet), which tries to defeat debugging.

But in general, Windows Minidumps are created automatically. This is either already enabled in your Windows host, or you can configure it inside the Windows Startup and Recovery settings, or you need to use what's documented in Collecting User-Mode Dumps.