virtualbox.org

Hello all
Until the last few days I have been able to run virtual machines in vbox with no problems.
Suddenly, however, a few days ago, nothing would run.
I then removed the old virtual machines and tried recreating them.
If I try to create a virtual machine now, I get error messages

NtCreateFile(\Device\VBoxDrvStub) failed: 0xc0000034 STATUS_OBJECT_NAME_NOT_FOUND (0 retries) (rc=-101)
Make sure the kernel module has been loaded successfully.
where: supR3HardenedWinReSpawn what: 3 VERR_OPEN_FAILED (-101) - File/
Device open failed. Driver is probably stuck stopping/starting. Try 'sc.exe query
vboxdrv' to get more information about its state. Rebooting may actually help.
Rebooting did not help.

I then get a dialog stating
Failed to open a session for the virtual machine pclinuxos (trying to use this)

Clicking on Details then gives
Failed to open a session for the virtual machine pclinuxos.
The virtual machine 'pclinuxos' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'D:\VirtualBox VMs\pclinuxos\Logs\VBoxHardening.log'.
Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {85632c68-b5bb-4316-a900-5eb28d3413df}

using sc.exe query vboxdrv gives
SERVICE_NAME: vboxdrv
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

I tried the suggestion on https://www.virtualbox.org/wiki/Core_dump to create
a core dump but none was created.
There were no changes to the pc.
I upgraded vbox to 6.1.4 and then tried reinstalling version 6.0 but I had the same in both.
I attach a zipped copy of VBoxHardening.log

Can anyone help ?
TIA

The hardening log shows Commodo Internet Security being active.
Was there an update to this in the last few days?
Can you try temporarily unsinstalling this completely?

Thanks for the reply.
I disabled Comodo but still have the same problem. I get the error as soon as I try to start a VM.

scbs29 wrote:I disabled Comodo

!=

Martin wrote:temporarily unsinstalling {Commodo}

Sometimes merely disabling does not clear up the problem. Do a full uninstall, then try the guest. If an error happens again AFTER uninstalling Commodo, post the hardening log or other log the error message mentions, as you did before.

I have now uninstalled Comodo and get the same error. As requested I attach the hardening log

The error means that there has been no attempt to start vboxdrv since the last boot. It could mean a corrupt installation. Just try to uninstall and reinstall VirtualBox (your VMs will not be deleted by it).

Thanks again for your reply.
I uninstalled and reinstalled VirtualBox 6.14 and had the same error. I downloaded version 6.14 again and installed it. Again I received the error.
Since I have only had the error with version 6.14, I then downloaded version 6.1.0 as a check. Again the same error.

Did you reboot your host after each step? Maybe it also helps to start the VirtualBox installation with "run as administrator" ...

Background: vboxdrv.sys is a Windows kernel driver and is usually started when the host OS is booted, and stopped when the host OS is shut down. You can use sc qc vboxdrv to query its configuration, sc query vboxdrv to query its state, and search for errors in the Windows Event Manager in case it's not running.

Hello again
I uninstalled VirtualBox, then reinstalled as Administrator, followed by a reboot. I then ran VBox as Administrator and got the same error.
The sc queries gave the following.

C:\Windows\system32>sc qc vboxdrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: vboxdrv
TYPE : 1 KERNEL_DRIVER
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : \??\d:\Program Files\Oracle\VirtualBox\VBoxDrv.sys
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : VBox Support Driver
DEPENDENCIES :
SERVICE_START_NAME :

C:\Windows\system32>sc query vboxdrv

SERVICE_NAME: vboxdrv
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

fth0 wrote:Did you reboot your host after each step?

scbs29 wrote:I uninstalled VirtualBox, then reinstalled as Administrator, followed by a reboot.

For me that counts as "No".

In my standard installation, vboxdrv has been copied to C:\Windows\system32\drivers\vboxdrv.sys with START_TYPE 1 SYSTEM_START. I guess that your installation has not been successful, but I don't know why. Maybe try to install VirtualBox onto C:.

I did as you suggested and installed to C. Unfortunately I received the same error when I tried to open a virtual machine.

Following my last post, I did a bit more digging and followed the suggestion in
https://appuals.com/supr3hardenedwinrespawn/ re vboxdrv driver. I cannot remember, however, what
led me to this site.
A suggestion here was to manually install the driver. I did this and after a reboot, sc gave the following:
C:\Windows\system32>sc qc vboxdrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: vboxdrv
TYPE : 1 KERNEL_DRIVER
START_TYPE : 1 SYSTEM_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : system32\DRIVERS\VBoxDrv.sys
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : VirtualBox Service
DEPENDENCIES :
SERVICE_START_NAME :

C:\Windows\system32>sc query vboxdrv

SERVICE_NAME: vboxdrv
TYPE : 1 KERNEL_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0



Unfortunately, VBox still would not open with the error

Failed to open a session for the virtual machine pclinuxos.

The virtual machine 'pclinuxos' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'C:\Users\stuart\VirtualBox VMs\pclinuxos\pclinuxos\Logs\VBoxHardening.log'.

Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {85632c68-b5bb-4316-a900-5eb28d3413df}

I attach a zip file of the hardening log, but the relevant parts appear to be:
\System32\glu32.dll
a90.13f8: supR3HardenedScreenImage/NtCreateSection: cache hit (Unknown Status -22900 (0xffffa68c)) on \Device\HarddiskVolume6\Windows\System32\ddraw.dll
a90.13f8: Error (rc=0):
a90.13f8: supR3HardenedScreenImage/NtCreateSection: cached rc=Unknown Status -22900 (0xffffa68c) fImage=1 fProtect=0x10 fAccess=0xf cHits=1 \Device\HarddiskVolume6\Windows\System32\ddraw.dll
a90.13f8: supR3HardenedDllNotificationCallback: Unload 000007feecaa0000 LB 0x001c9000 C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll [flags=0x0]
a90.13f8: supR3HardenedDllNotificationCallback: Unload 000007fef1e90000 LB 0x0011d000 C:\Windows\system32\OPENGL32.dll [flags=0x0]
a90.13f8: supR3HardenedDllNotificationCallback: Unload 000007fef4f20000 LB 0x0002d000 C:\Windows\system32\GLU32.dll [flags=0x0]
a90.13f8: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0xc0000190 'C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll'
a90.13f8: Fatal error:
a90.13f8: supR3HardenedMainGetTrustedMain: LoadLibrary "C:\Program Files\Oracle\VirtualBox/VirtualBoxVM.dll" failed, rc=1790
16b8.328: supR3HardNtChildWaitFor[2]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 1058 ms, the end);
b5c.b60: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 2228 ms, the end);

I then tried registering the dll with regsvr32. This gave the message
The module "VirtualBoxVM.dll was loaded but the
entry-point DllRegisterServer was not found.
Make sure that "VirtualBoxVM.dll" is a valid DLL or
OCX file and then try again.

I dont know if this has any gearing on my problem.

scbs29 wrote:I attach a zip file of the hardening log

I cannot see it.

So, now you have vboxdrv running. But the cause that prevented vboxdrv to be installed correctly in the first place, may be the cause for a lot of further problems. Whereas the VirtualBox Manager should always be run with normal user privileges, several VirtualBox components have to run with administrator or system privileges in the background. I hope that the new VBoxHardening.log will give us more clues.

BTW, do you (still) use any so-called Anti-Virus or Security software (AKA snake oil)?

Oops! Sorry, forgot to attach.
Here it is.
Yes I still use anti-malware, the same ones I have been using for at least 5 years, and never had problems
with VirtualBox before.

scbs29 wrote:Yes I still use anti-malware, the same ones I have been using for at least 5 years, and never had problems
with VirtualBox before.

This never had problems argument doesn't hold, if you sometimes update (= modify) your software, which is natural for security software. In consequence, your VBoxHardening.log is full of problems, be it COMODO Internet Security, or the heavily patched ntdll.dll and kerrnelbase.dll.

You should uninstall VirtualBox and COMODO Internet Security, then reboot, install only VirtualBox and test if the problem persists. If you're cautious or timid, you can disable the Internet connectivity during this test. If the problem persists, post another VBoxHardening.log.