Hardening Error: rc=-5640

[Kertis Henderson]

Hello. I've been through the forums researching this error, and I've tried everything I've read. Here's the situation,

VirtualBox 5.2.6 r120293
Windows 10 host
Linux x86 guest, Mint 18.3 (though this happens with a number of other guest combinations I've tried)
This VM ran fine for weeks, and then one day last week, it failed to run.
When I start the VM, I get:

(rc=-5640)
Please try reinstalling VirtualBox.
where: supR3HardenedWinReSpawn what: 1
VERR_SUP_VP_THREAD_NOT_ALONE (-5640) - Process Verification Failure: The process has more than one thread.


I've tried:
Restarting Windows, also a hard stop and reboot.
Uninstalling VirtualBox / Reinstall with "Run As Admin"
Installing different versions of VirtualBox from 5.2.2 on (one at a time, of course).
Disabling antivirus

I've attached a hardening log, as has been suggested on other threads.

Does anybody have any ideas on what to try next? I appreciate any help.

- Kert

[Chris Beach]

I am having a similar problem.

VBOX used to run fine in December 2017. Looks like my company pushed out an update to Windows and now I can not launch my VM.
I have reached out to my IT support, but they state it is a 3rd party software problem. Need confirmation that this is something they broke.

[socratis]

Please read really carefully the following FAQ: Diagnosing VirtualBox Hardening Issues for some guidelines/ideas.

@Kertis Henderson
I'd start with BeyondTrust and Symantec.

@Chris Beach
I'd start with McAfee...

[Mike1953]

Hello!

I find myself in a similar situation. VirtualBox was running fine on my Lenovo ThinkPad with Windows 10. I was "upgraded" to a Dell and am now getting the "rc=-5640" error. I have read the suggestion in the FAQ referenced earlier, and I have re-install VBox multiple times.

TIA,
Mike

[Mike1953]

Update: I forgot to add I am running VBox 6.0.2. I did try installing the last good version of v5 but got the same error.

Thanks,
Mike

[socratis]

@Mike1953
Did you even read the FAQ? Because it clearly talks about antivirus, specifically uninstalling all 3rd party antivirus and other system-wide modifying software. Do I have to spell it that you need to uninstall Symantec and ZoneAlarm? You didn't know that you had them running?

[Mike1953]

Hello:

I tried disabling the Symantec, but no joy. It's a company machine and removing the anti-virus is not allowed.

However, I am curious why you mentioned ZoneAlarm. To my knowledge, we're not using that software.

And yes, I did read the FAQ. But as is clearly stated it is a guideline as opposed to a cookbook, so I was hoping for something to have changed.

Regards,
Mike

[socratis]

I tried disabling the Symantec, but no joy. It's a company machine and removing the anti-virus is not allowed.

Then maybe you can upgrade it, or add an exception for all VirtualBox related files and processes. If they need to get access to VirtualBox's memory space, they need to be signed and that needs to be reflected in the Windows Certificate Database. No way around it.

However, I am curious why you mentioned ZoneAlarm. To my knowledge, we're not using that software.

Because it was in your log?

2b8.dd8: \SystemRoot\System32\drivers\vsdatant.sys:
...
2b8.dd8:     FileDescription: ZoneAlarm Firewalling Driver

But as is clearly stated it is a guideline as opposed to a cookbook, so I was hoping for something to have changed.

You need to take a look at your logs. I gave you an example above what to look for, and the FAQ also talks about these kinds of findings. And since we can't know what you are running on your computer, you got to help with the homework...

[Mike1953]

Well, Holy Mackerel. I missed the Zone Alarm reference completely. Ok, back to the 2nd Grade for remedial reading...