The VirtualBox Guest Additions Service service terminated unexpectedly. It has done this 2 time(s).

[timeless]

Guest: w7x64, 1 cpu, 1gb ram Host: OS X 10.5.8, MacBook Pro dual core, 4gb ram

I noticed recently that when i restore my w7 vm the time is out of sync, so i've been periodically using Windows's internet time sync feature to force a manual sync. In the past, i never needed to do this. I'm not sure when this started and I don't have many snapshots.

Unfortunately, because time sync is bad, the timestamps I have from the windows event log are going to be bogus or at least incredibly unreliable.

So, my system has event logs from at least Feb 2009 (including bonjour crashing their abouts). I don't know offhand how to see when the various versions of virtualbox guest additions were added. But I think it's relatively safe to say this is a recent regression, probably 3.1/3.1.1/3.1.2.

I'm going to attach an ntsd to the service to see if i can catch it.

[timeless]

excerpts from Windows event log (dates are obviously somewhat unreliable)

[timeless]

This is what happens when I attach w/ ntsd...

(102c.139c): Break instruction exception - code 80000003 (first chance)
ntdll!DbgBreakPoint:
00000000`7708d7b0 cc              int     3

this is the initial breakpoint

0:007> g
ntdll!ZwWaitForWorkViaWorkerFactory+0xa:
00000000`7708fdda c3              ret

This is some sort of death

0:002> !analyze -v -f
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Event is not an exception


Failure could not be analyzed

Last event: 102c.1264: Exit process 0:102c, code ff
  debugger time: Tue Jan 12 21:16:38.609 2010 (GMT+2)

So the process quit...

0:002> ~* k

.  2  Id: 102c.1264 Suspend: 0 Teb: 000007ff`fffda000 Unfrozen
Child-SP          RetAddr           Call Site
00000000`0087fc58 00000000`7705aaab ntdll!ZwWaitForWorkViaWorkerFactory+0xa
00000000`0087fc60 00000000`76f3542d ntdll!TppWorkerThread+0x2c9
00000000`0087ff60 00000000`7707be51 kernel32!BaseThreadInitThunk+0xd
00000000`0087ff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
0:002> ~
.  2  Id: 102c.1264 Suspend: 0 Teb: 000007ff`fffda000 Unfrozen

0:002> g
       ^ No runnable debuggees error in 'g'

[Frank Mehnert]

Sounds like a duplicate of #5963.