VirtualBox doesn't start (crashes) on Windows 10

[EddyR]

I've seen some similar postings about VMs crashing with rtR3WinUnhandledXcptFilter but I'm getting the same error when VirtualBox starts. I see the GUI and then it crashes. I uninstalled VB, rebooted and reinstalled VirtualBox-6.0.14-133895-Win.exe - same problem.
VB is installed on Windows 10 Enterprise 64 bit. The pertinent lines in selectorwindow.log are:

Code: Select all

00:00:00.207283 Package type: WINDOWS_64BITS_GENERIC
00:00:00.207453 Qt version: 5.6.2
00:00:00.270473 GUI: UIMediumEnumerator: Medium-enumeration started...
00:00:00.830981 
00:00:00.830983 !!! rtR3WinUnhandledXcptFilter caught an exception on thread 0000000000013bdc!!!
00:00:00.831039 
00:00:00.831040 ExceptionCode=0xc0000005 ExceptionFlags=0x00000000 ExceptionAddress=00000000632d84aa
00:00:00.831049 ExceptionInformation[0]=0000000000000000
00:00:00.831058 ExceptionInformation[1]=0000000100000007

Sincerely.
Eddy

[socratis]

00:00:00.831040 ExceptionCode=0xc0000005 ExceptionFlags=0x00000000 ExceptionAddress=00000000632d84aa

This code looks awfully familiar with what you'd get if you had a hardening problem. Please read really carefully the following FAQ: Diagnosing VirtualBox Hardening Issues for some generic guidelines/ideas. Remember, these are guidelines, not the exact solution, you have to use your judgement as to which program might be responsible. We could potentially give you a suggestion or two if you posted a ZIPPED VBoxHardening.log and we see signs of known applications.

[EddyR]

There isn't a VBoxHardening.log in the directory with the other log files (see picture attached).

[EddyR]

Just restate = this is not a specific VM but the VirtualBox itself crashing.
VB worked fine until a few days ago and I don;t recall doing any upgrades (but I can't be sure that the IT department didn't push out something new).

[EddyR]

Ok, I found a VBoxHardening.log which seems to be from the VirtualBox itself and not a particular VM. It was located under C:\Users\edward\AppData\Roaming\Microsoft\Windows\Recent. The last few lines of the file (attached) are

d780.1b9e0: supR3HardenedScreenImage/NtCreateSection: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\logoncli.dll
d780.1b9e0: supR3HardenedDllNotificationCallback: load   00007fff7a830000 LB 0x0003e000 C:\WINDOWS\System32\logoncli.dll [fFlags=0x0]
d780.1b9e0: supR3HardenedScreenImage/LdrLoadDll: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume4\Windows\System32\logoncli.dll
d780.1b9e0: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007fff7a830000 'C:\WINDOWS\System32\logoncli.dll'
1711c.12640: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x40010004 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1038022362 ms, the end);
1cb70.1abc0: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x40010004 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1038023831 ms, the end);

Can you give some direction now as to why VirtualBox is crashing on startup?

[socratis]

1711c.12640: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x40010004 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1038022362 ms, the end);
1cb70.1abc0: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x40010004 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1038023831 ms, the end);

First of all the ExitCode confirms that you do have a hardening problem. Please read really carefully the following FAQ: Diagnosing VirtualBox Hardening Issues for some generic guidelines/ideas. Remember, these are guidelines, not the exact solution, you have to use your judgement as to which program might be responsible.

Looking at your VBoxHardening.log, I see:

1cb70.1abc0: NtOpenDirectoryObject failed on \Driver: 0xc0000022
1cb70.1abc0: supR3HardenedWinFindAdversaries: 0x1003
1cb70.1abc0: \SystemRoot\System32\drivers\SysPlant.sys:
1cb70.1abc0:     FileDescription: Symantec CMC Firewall SysPlant
1cb70.1abc0: \SystemRoot\System32\sysfer.dll:
1cb70.1abc0:     FileDescription: Symantec CMC Firewall sysfer
1cb70.1abc0: \SystemRoot\System32\drivers\symevent64x86.sys:
1cb70.1abc0:     FileDescription: Symantec Event Library
1cb70.1abc0: \SystemRoot\System32\drivers\vsdatant.sys:
1cb70.1abc0:     FileDescription: ZoneAlarm Firewalling Driver

I would start by completely uninstalling these two, and running a couple of checks on your host with "smc" and "dism", details on the linked thread above.

[EddyR]

Unfortunately, Symantec is the corporate security solution and I don't have the permissions to uninstall the services.
Any other suggestions?

[socratis]

Any other suggestions?

You didn't really read what I pointed you to, did you? Be honest...

Because in there it specifically says that if you can't uninstall any leech antivirus, you should be putting an exception:

Those applications must be uninstalled, or VirtualBox must be added as an exception to their activities.

[EddyR]

Thanks.
I'll see if my IT will agree.

[artemka]

This is for someone have the same issue. VirtualBox shows window on start and after that it crashes without error.

The only error I can see is

Code: Select all

!!! rtR3WinUnhandledXcptFilter caught an exception on thread 00000000000036a8!!!

in selectorwindow.log and this is not hardening issue.

The interesting part here is what it works fine if started using "Run as administrator" command.

After some digging I found the problem. I have two monitors. 1st - FullHD (primary) and second (4K-UHD). If I move VirtualBox window to secondary monitor and quit (it saves position) after that it cannot start.
But if I remove the saved position from %HOMEPATH%\.VirtualBox\VirtualBox.xml (in my case this is):

Code: Select all

<ExtraDataItem name="GUI/LastWindowPosition" value="2284,-103,1180,770"/>

then all works fine (!!! don't forget to kill "VirtualBox Interface" process using TaskManager). It starts on primary monitor without any issues.

Attached selectorwindow.log (may be it can help).