Windows Hardening Problem (sorry)

[matchstickboy]

Hi All,

I really tried to not post, as there is so much info posted about resolving this problem. But nothing has worked, so I'm at a loss. Getting the dreaded RC=5640 error message:
******************************************************************************************************************************************************************************************************************************************************
where:supR3HardenedWunRespawn what: 1
VERR_SUP_VP_THREAD_NOT_ALONE (-5640) - Process Verification Failure: The process has more than one thread.

Failed to open a session for the virtual machine kali.

The virtual machine 'kali' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'D:\VirtualBox\kali\Logs\VBoxHardening.log'.

Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {85cd948e-a71f-4289-281e-0ca7ad48cd89}
******************************************************************************************************************************************************************************************************************************************************
So here is what I've tried so far:

Created brand new guest VMs
Installed version 5.2.8 r121009 (multiple times, uninstalling via Add-Remove/restarting/powering off each time)
Installed all Windows updates
Have read the posts for what to do when encountering a Hardening issue
ran sfc /scannow as an administrator which returned no issues
ran dism.exe /online /Cleanup-Image /scanhealth as an administrator which returned no issues
adding an exception to the Virtualbox install directory
disabling Windows defender
Uninstalling Crowdstrike


My windows Host details are:
Dell Optiplex 9020
Intel Core i7
Windows 10 Pro 1709 build 16299.251 64bit
Windows Defender + Crowdstrike (currently not installed)

I've attached the Hardening log file. Hoping a solution can be found. Please let me know if any additional information is needed.

Thanks in advance,

Chris

[mpack]

I don't recognize some of that advice for what to do about hardening issues. E.g. reinstallation of VirtualBox and running dism.exe.

There's a limit for what we can tell you. "Process has more than one thread" means that some other application has injected a DLL into VirtualBox, that DLL is signed otherwise it would have been kicked out. However that DLL has kicked off an independantly executing program which VirtualBox has detected. This is the typical behaviour of malware or anti-malware (there is sometimes little difference between the two). Only you can know what you've installed on your PC. I'd look for safe browsing plugins etc, as VirtualBox doesn't like to be snooped on by those.

[matchstickboy]

Thank you for your reply.

Am I correct in saying that the last line in the vboxhardening.log shows the .DLL that virtualbox is faulting on? In this case, MMDevApi.dll?

4220.4278: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffce01e0000 'C:\WINDOWS\System32\MMDevApi.dll'
4208.420c: supR3HardNtChildWaitFor[1]: Quitting: ExitCode=0x1 (rcNtWait=0x0, rcNt1=0x0, rcNt2=0x103, rcNt3=0x103, 5866 ms, the end);

Are you saying that another program has the Windows core audio components locked?

Thanks.

Chris

[socratis]

Am I correct in saying that the last line in the vboxhardening.log shows the .DLL that virtualbox is faulting on?

Not really, we wish it was that easy...
Something is interfering. You should start uninstalling all 3rd party apps until you find the one(s) that are responsible.

[matchstickboy]

Thanks, socratis. But I'm going to give that suggestion a pass. I don't see how any of my other 3rd party apps would be involved when none of them have changed and no new apps have been added to the system. I've only updated Windows10 to the latest build, and updated Virtualbox to the latest build when this issue came up.

I've tried going back to earlier versions of VB and am having the same results. Could it be a Windows10 update instead? Have there been any other reports of Windows10 issues following patch Tuesday? I haven't seen any recent ones that apply.

Best,

Chris

[socratis]

I don't see how any of my other 3rd party apps would be involved when none of them have changed and no new apps have been added to the system.

You definitely don't know that, unless you had no network during the whole time. Even then, that doesn't mean too much.

Fact of the matter is that is not happening on a stock Win10 up-to-date installation. Or not a stock one with apps that don't try to interfere with the system in unknown ways. Look again at mpack's suggestion and see what app might that be...

[matchstickboy]

OK, socratis. Thanks for your time. I appreciate you and mpack both trying to help. On this box, I'm going to have to fall back to Hyper-V. It's a corporate build, and a lot of the installed apps are non-negotiable.

Will still use VB on my other systems

Best,

Chris

[rmurdoch23]

This is an old thread, but the only one that discusses the specific problem that I've spent the day dealing with.

Just wanted to say that the recommendation to uninstall 3rd party apps one at a time led me to the solution. I compared side-by-side with a computer where I have been working successfully with a VM to filter down the list of candidate troublemakers. Turns out a program called HP SureSense (something along those lines) was the problem. Uninstalled and I am now off to the races.

[mpack]

Turns out a program called HP SureSense (something along those lines) was the problem.

Yes, that family of HP tools are known trouble makers. It's all bloatware bundled with HP PCs. The best thing to do when you get those PCs is completely reformat them and install from your own Windows setup USB stick or DVD. Or just install a sysprep image over the top. And I say that as someone who's a fan of HP desktop PCs otherwise, in fact I'm typing on one right now. Quiet, reliable, good specs.