VirtualBox Guests fails with rc=-5640, under SecureDesktop

[ErikHaukjær]

I have been running VirtualBox prior to getting SecureDesktop without problems, but after having SecureDesktop installed, launching VirtualBox Hosts fails.
Starting VirtualBox Manager does not show any error.

I used version 5.1.28 and got the same error as now, but as it said to upgrade I installed the newest version 5.2.0, but it still has the problem.
My host os is windows 7 Enterprise SP1 64 bit
I have tried starting virtual box instances with various guest os’es (CentOS 7.4, Fedora 24 and MS Windows 7) all with the same error reported.
I have run virtual box both as normal user and as elevated, with the same result.

The message shown is headed with ‘VirtualBox - Error In supR3HardenedWinReSpawn’
and contains the following text:

(rc=-5640)

Please try to reinstall VirtualBox

where: supR3HardenedWinReSpawn what: 1
VERR_SUP_VP_THREAD_NOT_ALONE (-5640) – Process Verification Failure: The process has more than one thread.

I have attached the VBoxHardening.log file, which should contain some details about the problem.
I have tried google’ing for the error, and on virtual box they do have a case which is 3 years old, with a lot of updates. Many seems to be related to virus-scans which replaces some dll’s and hence runs threads from these dll’s
I can see from the attached log, that Powerbroker seems to be loaded as 2 files (privman.sys and privman64.dll)...

Is there any way to turn off, or disable the checking of number of threads running ?
- or is there any way (except uninstalling SecureDesktop, which really isn't an option) to avoid loading the privman.sys and privman64.dll ?

[mpack]

Is there any way to turn off, or disable the checking of number of threads running ?

There is not, as that would allow malware to hijack the VirtualBox process with it's elevated rights, and use those rights to attack your host.

I suggest that you look into adding VirtualBox as an exception in your AV software. VirtualBox is signed software, your AV should not be interfering with it anyway.

[ErikHaukjær]

Thanks for your prompt reply, mpack

There is not, as that would allow malware to hijack the VirtualBox process with it's elevated rights, and use those rights to attack your host.

I'm not sure I have to run VirtualBox in elevated mode (I might have to though to access network cards etc.)
Not being a windows developer i'm puzzled about the loading of the two PowerBroker files (the .sys and .dll), but I guess it comes from the way SecureDesktop acts on the environment.

I will see if my IT department has any suggestions to avoid this (I have also filed a case there).

[pdxcommuter]

I'm seeing the same problem, but I don't have SecureDesktop. I am running 5.2 VirtualBox on Windows 7 Enterprise SP 1. VirtualBox worked yesterday. It started failing today. I also have a case filed with my IT department.

[mpack]

If you don't have SecureDesktop then your comments don't belong in this topic. Note the topic title.