[Invalid] VBox Hardening and Norton Antivirus

Discussions related to using VirtualBox on Windows hosts.
Post Reply
Chrizzy
Posts: 6
Joined: 10. Dec 2014, 19:19

[Invalid] VBox Hardening and Norton Antivirus

Post by Chrizzy »

Hi,

I have VirtualBox and used it for several years without major issue. But now I have a problem with hardening. I see a lot of users have had similar problems but none of the solutions seems to completely work for me!

I have a Windows 10 laptop with Virtualbox 5.2.12 and Norton Security installed. All at the latest version.

1) When I try to run a VirtualBox I get "Error In supR3HardenedWinReSpawn" dialog box. Please see attachment 0. Error Message.png.
2) I then uninstalled Norton and restarted my laptop. The same issue occurs. Please see attachment 1. VBoxHardening - Removed Norton and restarted.log.
3) I then uninstalled and re-installed VirtualBox (as administrtor) and restarted. VirtualBox now starts once more! For completeness, please see attachment 2. VBoxHardening - Uninstalled, re-installed VirtualBox and restarted - worked.log.
4) I then re-installed Norton. VirtualBox still works! Fantastic.
5) I then restarted by laptop and I am back where I started as VirtualBox fails again. Please see attachment 3. VBoxHardening - Restarted after installing Norton.log

I have been around this loop twice.

Any advice you can give would be appreciated.

Thanks & Regards,
Chris
Attachments
All Logs files.zip
(44.56 KiB) Downloaded 18 times
0. Error Message.png
0. Error Message.png (15.62 KiB) Viewed 4532 times
Last edited by socratis on 20. Jun 2018, 17:07, edited 1 time in total.
Reason: Marked as [Invalid].
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: VBox Hardening and Norton Antivirus

Post by socratis »

You don't have to document each and every step with a picture. We ... get it ;)

What you have to do is to read really carefully the following FAQ: Diagnosing VirtualBox Hardening Issues for some generic guidelines/ideas. Remember, these are guidelines, not the exact solution, you have to use your judgement...

For example you said that you installed the antivirus, but not rebooted your computer. And that worked, but as soon as you rebooted, it failed. Well, it kind of makes sense. The antivirus was not loaded the first time, or it hadn't interfered yet with VirtualBox.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Chrizzy
Posts: 6
Joined: 10. Dec 2014, 19:19

Re: VBox Hardening and Norton Antivirus

Post by Chrizzy »

Hi,

Thanks for the quick response. I tried to be thorough - to give all the information necessary without inudating the reader with minutia. :)

I have read the guide you suggest several times. This was where I got the idea of uninstalling Norton and re-installing VirtualBox. I was delighted when I could once again start my VMs. You can imagine my disappointent when I started the laptop the next day only to find I was back at step 1.

As VirtualBox works without Norton present and fails when it is installed (and the latop rebooted) I conclude the issue is with Norton and not graphics cards or Microsoft certifcate databases.

I have added the folder C:\Program Files\Oracle\VirtualBox to the Anitvirus section of Norton Security configuration - but this has not resolved the issue.

I agree with you as to why VirtualBox works even with Norton installed (but before the laptop is restarted). What I cannot understand is why does VirtualBox fail after I have uninstalled Norton and restarted the laptop. It is almost as if Norton security has "done something" to the installation of VirtualBox.

I will continue to investigate.

Thanks & Regards,
Chris
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: VBox Hardening and Norton Antivirus

Post by mpack »

Your bad log deviates from the good one on line 263 :-
10ac.1044: Error -104 in supR3HardenedWinReSpawn! (enmWhat=5)
10ac.1044: Error relaunching VirtualBox VM process: 5
Command line: '60eaff78-4bdd-042d-2e72-669728efd737-suplib-3rdchild --comment "Content Server AO 1.1" --startvm eb136f95-ea58-4579-8360-f9ed74d9abbf --no-startvm-errormsgbox "--sup-hardening-log=C:\Virtual Machines\Content Server AO 1.1\Logs\VBoxHardening.log"'
I can only assume that Norton is not completely gone. If it was me I would find the Norton program files folder and make sure it is deleted. I would scan the registry for references to any Norton DLL because something is still there and getting loaded on a reboot. Hopefully Norton AV DLLs have a predictable naming scheme that'll make them easier to find.
Chrizzy
Posts: 6
Joined: 10. Dec 2014, 19:19

Re: VBox Hardening and Norton Antivirus

Post by Chrizzy »

Hi,

Good call. I will try that.

Thanks & Regards,
Chris
Chrizzy
Posts: 6
Joined: 10. Dec 2014, 19:19

Re: VBox Hardening and Norton Antivirus

Post by Chrizzy »

Hi,

Well, the problem is fixed - for now. I saw a few posts in this forum about Trusteer Endpoint Protection (aka Rapport). I also had this software installed. I removed it, restarted my laptop and I can now run VirtualBox - even with Norton installed.

Hopefully a new version of Rapport will come out soon-ish (before I need to use internet banking again) which will not cause this problem.

Thanks to all that have helped.

Regards,
Chris
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: VBox Hardening and Norton Antivirus

Post by socratis »

As far as I know the makers of Trusteer have been notified. Of course it never hurts to have an additional vote... ;)

Marking as [Invalid], not because it wasn't resolved, but because it wasn't Norton Antivirus after all...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Chrizzy
Posts: 6
Joined: 10. Dec 2014, 19:19

Re: [Invalid] VBox Hardening and Norton Antivirus

Post by Chrizzy »

Hi Socratis,

I have logged this IBM and they have given the same advice as they have given to others.

Marking the Issue as Invalid is a little harsh, I think. If I uninstall Norton and VirtualBox followed by a reboot, the problem is resolved - even with Rapport on the laptop. If I re-install Norton and reboot the problem comes back.

My issue seems to be an interaction between the two products.

Regards,
Chris
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: [Invalid] VBox Hardening and Norton Antivirus

Post by socratis »

Chrizzy wrote: If I re-install Norton and reboot the problem comes back.
Chrizzy wrote:I can now run VirtualBox - even with Norton installed.
Can you tell me with some degree of certainty what's going on? It can't fail if it's installed and work if it's installed. Do a test matrix and figure out what works and what doesn't, I can't do that for you.
Chrizzy wrote:Marking the Issue as Invalid is a little harsh, I think.
Not given the information that you shared. You said that it was not Norton, it was Trusteer. So someone looking for Norton and bumped on your thread, would have come to the wrong conclusion if it was marked as {Solved], don't you think?
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Chrizzy
Posts: 6
Joined: 10. Dec 2014, 19:19

Re: [Invalid] VBox Hardening and Norton Antivirus

Post by Chrizzy »

Hi Socratis,

Apologies, I thought is was reasonably clear..... my fault entirely.

When I have Rapport Trusteer installed and Norton Antivirus then I get the Hardening Issue. If I remove either one of them, VirtualBox works.

I suspect these two products are treading on each others toes!

It is easier to uninstall/re-install Rapport - for the occasional times that I use it - and leave Norton on my laptop permanently. I just have to accept I cannot use VirtualBox when they are both installed. Perhaps I would be Ok if I used a product other than Norton.

Is it Solved? Well, the problem I am having can be resolved by removing either Norton or Rapport.

Is it Invalid? I think the information in this post is valid and could be of use to others - but this is not my forum so I leave it up to you.

Regards,
Chris
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: [Invalid] VBox Hardening and Norton Antivirus

Post by mpack »

Chrizzy wrote: I suspect these two products are treading on each others toes!
Multiple AV is nearly always a bad idea IME.
Post Reply