Windows 10 Ver 1709 Vbox error

[yotama]

Hi
i am getting error on Virtual Box after update to 1709

VirtualBox Error In supR3HardenedWinReSpawn
(rc=-5640)
Please try to reinstalling VirtualBox

Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {85cd948e-a71f-4289-281e-0ca7ad48cd89}

i try to reinstall and i got the same error. i update to the last ver and still get the same error i use the guide for check the Hardening and it's the same result

i attach the log. Please help

ty

[andyp73]

15ec.25ac: More than one thread in process

Something is trying to inject itself into the VirtualBox process which isn't properly signed. The most likely suspect is the Trend Micro software you have installed. Ideally, you should uninstall it but if that isn't possible you need to setup exceptions for VirtualBox.

More guidance can be found in Diagnosing VirtualBox Hardening Issues

If that doesn't fix it, then posting the VBox.log file might give some more clues.

-Andy.

[yotama]

Hi
try for the replay
we have Trend Micro install and have setup exceptions for VirtualBox and still we get errors on when users try to run the VM

i attach the Vbox log

[lmarecha]

Is that when you start the VM in normal, detached or headless mode ? or all of them ?

[yotama]

Is that when you start the VM in normal, detached or headless mode ? or all of them ?

all of them

[andyp73]

There isn't anything obvious in the VBox.log file so it looks like the original issue in the hardening log is your culprit.

My preference would be to temporarily uninstall the Trend Micro software to prove that is the culprit but if you can't uninstall it then you should check that the exceptions you have added are correct and complete. Other potential candidates could be web filters, debuggers, etc.

-Andy.

[yotama]

i will try to uninstall Trend Micro to test the issue
i add exceptions to Virtual Box
i will update
ty

[yotama]

Hi
i attach new log after remove of Trend Micro
same error

[andyp73]

I can't see anything else obvious in the log files so you are probably going to need to wait until one of the experts in this field wander past.

-Andy.

[mpack]

Still the same problem. So, it wasn't Trend Micro.

1ff0.1ff8: More than one thread in process

I'm going to say that you are in a business environment, and a web filter has been installed to stop you using work computers to visit sports and social media sites. Such programs are incompatible with VirtualBox. They must either be uninstalled, or an exception added for VirtualBox. Looking again at the log, I see QIPCAP.DLL loading, which is part of WebSense, a web filter app.

Web filters are not the only apps which do this, e.g. remote desktop apps might do it too. It's up to you to consider what software you have on the PC which might do this.

[yotama]

hi
i remove WebSense but it's the same

i attach new log

[mpack]

QIPCAP64.DLL is still there and also seems to be signed by WebSense, so I don't think you got rid of the latter entirely.

I'll also draw your attention to the last paragraph of my previous post: you ought to know what "snooper apps" are installed on your PC, so it ought to be much easier for you to identify the culprit than it is for me, so I encourage you to think about it.

[yotama]

Hi
it happen to more Desktop and Laptops in my office
i can't just go and delete the programs . It used to work before nothing change on the systems i need help to resolve this issue
ty

[socratis]

i need help to resolve this issue

Re-install Windows in-place, and don't install any 3rd party applications. Install VirtualBox, make sure it works. Start installing your apps one at a time, testing VirtualBox in between. At a point, the culprit will appear. Then you'll know which application was causing the grief.

[yotama]

Hi
we are on Domain network the 3rd application is a must have