Discussion of Problems due to Hardened Security

[MattD]

It seems to me that it would be useful if the debug logs differentiated between the cases of a cert that was missing vs. invalid vs not in the database. That could help distinguish between corrupted DLLs, security apps blocking access to DLLs, or security apps block access to the database.

[RealBox123]

I removed Windows security essentials and that solved the problem !!! prior to May 2015 update i had the same issue ( supr3hardenedwinrespawn ) and VM manager wont start any of my VMs so after some research I found out that windows security essential real time protection feature was interfering with starting a VM somehow so i disabled it and everything worked fine until the recent update ( May 2015) then it started to throw that annoying sup3hardened error. I had done some testing where i removed all the May 2015 Microsoft security updates:

KB3061518
KB3055642
KB3051768
KB3049563
KB3048070
KB3046002
KB3045171
KB3032655
KB3023215

and nothing happened and i still got the same error. so I'm guessing its a problem related to windows security essentials. so give that a try and good luck and i hope this solves everyone's annoying sup3hardened error

[SimplyViewer]

Unfortunately removing Window's Security Essentials didn't work for me (although I did forget to restart my computer after the uninstall, so I might go back and try it.). Would adding some exceptions to Essentials work? It's by far my favorite antivirus, so I'd hate to have to search out something else.

[ElQuia]

The problem is NOT MS Security Ess. It's VirtualBox hardening... something, somewhere went wrong. I have tried, ESET, Avast, MS, McAfee, WebRoot, etc.
I tried ALL VBox releases since 4.3.12.
I ALWAYS have to go back to 4.3.12, Win 7 or Win 8 as hosts. NO later build will work. End of story.

[jb223]

This problem appeared for me when I switched from Symantec Endpoint Protection to McAfee VirusScan Enterprise. Until then I was running without trouble on 4.3.22. There appear to have been no relevant changes in windows updates between when it worked and stopped working; the only change is to the virus software. Unfortunately, corporate IT will not allow me to disable McAfee to verify whether it might work without it running. I suspect that it might be that the process of McAfee virus checking the DLLs is causing VirtualBox to find them to be untrusted.

OS: Windows 7 Enterprise SP1
VirtualBox 4.3.28r100309

Exit code 0xc0000005
Result Code: E_FAIL (0x80004005)
Component: Machine
Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

[MikeSchwartz]

Hi jb223, I actually work in the IT department of your company. (I saw our company's name in your logfile.) I'm pretty sure our problem is BeyondTrust, not McAfee. I was able to reproduce the issue on a freshly-installed vanilla copy of Windows 7 with nothing installed but BeyondTrust and VirtualBox. Likewise, I was able to eliminate the problem on a standard-image machine running McAfee by uninstalling BeyondTrust. The only thing I can't explain is how yours was working with Symantec+BeyondTrust+4.3.22.

I'm really hoping this can be fixed on the VirtualBox side. I've already tried fixing it on the BeyondTrust side. (The BeyondTrust software has a policy setting where you can tell it not to load its DLL into certain processes. And we've used that setting successfully in the past to resolve compatibility conflicts. But that setting did not work for this VirtualBox issue.)

[peperami]

Hi

I am running windows 8.1 Enterprise

Virtual box 4.3.29 r100535

Starting any virtual machine even a brand new one results in the virtual machine has teminated unexpectedly during startup with exit code -1073741819 (0xc0000005)

More details

Result code E_FAIL (0x80004005)
Component Machine
Interface IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048}

I have corportate installed McAfee 8.8.0

I did patch my uxtheme, but have uninstalled and now using the style service.

Ben

[jb223]

Hi jb223, I actually work in the IT department of your company. (I saw our company's name in your logfile.) I'm pretty sure our problem is BeyondTrust, not McAfee. I was able to reproduce the issue on a freshly-installed vanilla copy of Windows 7 with nothing installed but BeyondTrust and VirtualBox. Likewise, I was able to eliminate the problem on a standard-image machine running McAfee by uninstalling BeyondTrust. The only thing I can't explain is how yours was working with Symantec+BeyondTrust+4.3.22.

Hi MikeSchwartz,

If that's the case, then I can only guess that the issue has to be with the interaction between McAfee and BeyondTrust, or with BeyondTrust somehow interfering with the anti-virus install program (it's possible I had Symantec before I had BeyondTrust, but I definitely had BeyondTrust when I first installed VirtualBox). Perhaps you could try installing VirtualBox with an administrator account vs using "run elevated", both on a machine running BeyondTrust?

With McAfee + BeyondTrust, I cannot run VMs in 4.3.28 even in BeyondTrust's elevated mode or as administrator. And as you noted, it was working for me while running Symantec+BeyondTrust+4.3.22.

For posterity, to be comprehensive:
I am running BeyondTrust PowerBroker Desktops Client v5.0.0.311.
Between when I'm certain it worked and when it didn't, the following configuration changes were made:
McAfee VirusScan Enterprise 8.8.04001 installed
McAfee Host Intrusion Prevention v8.00.0402 installed
(These installed Microsoft Visual C++ 2010 x86 and x64 redistributables v10.0.40219 and Visual C++ 2005 redistributable v8.0.61001)
Mozilla Firefox was updated to 38.0.1
Microsoft Silverlight updated to 5.1.40416.0
Various new Windows, Office, and .NET framework updates were installed on 5/13/2015. The Windows Updates are: KB3061518, KB3022345, KB3045171,KB3051768, KB3046002, KB3020370, KB3013531, KB3020369, and KB3045645.

[Roebie]

I'm having problems opening my virtual machines too!

OS: WIN7 SP1
AV: Bitdefender 2015 (this seems to be the problem as I did't have the problem before upgrading to this version)

Attachment Oracle VM VirtualBox Manager.png is how the machines settings looks like in Oracle VM VirtualBox Manager.
When I try to start the machine I get this "VirtualBox - Error In supR3HardenedWinReSpawn" message.
After clicking the Abort button I get a "VirtualBox - Fout" message (fout is just Dutch for error).
These two messages are in the second attachment.
The logfile this message refers to is added too.

[MikeSchwartz]

And as you noted, it was working for me while running Symantec+BeyondTrust+4.3.22.

I've experimented a little bit more and I'm surprised to see that Symantec Endpoint Protection seems to prevent the problem. McAfee doesn't seem to have anything to do with it. But if I have BeyondTrust installed without SEP, I get the error (E_FAIL 0x80004005). But as soon as I install SEP, the error goes away and I can start my VM with no issue. I'm not sure what kind of interaction there might be between SEP and BT. But for my company, it really doesn't matter, as we've switched from Symantec to McAfee.

But, in the hopes that it might help resolve the issue with BeyondTrust, I've captured three more log files and attached them. These were all done on a freshly-installed copy of Windows 7 Enterprise x64 SP1, with no patches, and no software (other than what's noted below).

1. Installed VirtualBox 4.3.28, created VM and started it: "VBoxStartup - Success - No BT or SEP.log"
2. Added BeyondTrust PowerBroker Desktops Client 5.0.0.311: "VBoxStartup - Fail - with BT but no SEP.log"
3. Added Symantec Endpoint Protection v11.0.7200.1147: "VBoxStartup - Success - with BT and SEP.log"

[parth]

Host: Windows 8.1, all updates installed.
Virtual box does not work with: SpyShelter Anti-Keylogger Premium and SpyShelter Firewall

What happens: Virtualbox does not start up.
Log attached.

Additional notes:
Works well on Windows Xp, Vista, 7.

No other security software present, basically the system is clean.

[rnewman]

Hello,
No go with the latest build...

OS - Win7 Professional 64bit - SP1
Trendmicro Office Scan - 11.0.1454
Virtualbox - 4.3.29-100535

Screen shot and startup log attached.

I am happy to assist with debugging. Are there any switches or process that would provide additional diagnostic information?

Thanks,
Richard

[ilker]

I am not sure how but 4.3.28 started working for now. here is my experience.
I was unable to access previously working guests. After many install/uninstall trials below worked for me:

I removed 4.3.28 and restarted windows 8 host. I observed that when installing a process with a name something like "Microsoft Software Protection" initiated. I killed that process and make sure it is not there while installing 4.3.28.
I also disabled and quit Mactype (a font rendering software) while installing.

now 4.3.28 seems working. hope that helps someone to understand the issue and solve it....

[RelakS]

Hopefully related. At least, no BSoD

Windows 7 Professional SP1 64 bit
McAfee solutions, such as:
McAfee Host Intrusion Prevention build 8.0.0.2151 (content 8.0.0.6377)
McAfee Agent version 4.6.0.3122
McAfee Endpoint Encryption Agent version 1.2.1.315
Endpoint Encryptino for PC version 6.2.1.315
McAfee GTI Proxy Agent version 1.1.0.550
McAfee VirusScan Enterprise + AntySpyware Enterprise version 8.8.0 (8.8.0.849) (scan engine version 5700.7163, DAT version 7822.0000)

[rnewman]

Hello,
No go with the latest build...

OS - Win7 Professional 64bit - SP1
Trendmicro Office Scan - 11.0.1454
Virtualbox - 4.3.29-100833

Screen shot and startup log attached.

I am happy to assist with debugging. Are there any switches or process that would provide additional diagnostic information?

Thanks,
Richard