Virtualbox problem with Trusteer Rapport

Discussions related to using VirtualBox on Windows hosts.
Monstercarp
Posts: 11
Joined: 23. Jun 2018, 13:50

Virtualbox problem with Trusteer Rapport

Post by Monstercarp »


ModEdit; Please see the workaround provided by the IBM Security Trusteer Technical Support.
I often use various technical forums but rarely contribute. However as I think I've found a new Virtualbox failure situation and a solution I thought I'd add it here.

I've just spent a couple of days becoming increasingly frustrated with Virtual box not loading a Win XP virtual machine. I've been using Virtual box for running a couple of quite expensive to replace programs that do not run on Win 7. Until recently I've had no problems at all and was still using Virtualbox 4. I clearly changed something. This could have been a Windows update, but I suspect it was something else. I had all the references others have reported to log files and hardening.

After much unloading and loading of Virtual box I suddenly had a feeling that the problem might have started when I installed the Rapport extension to work with Firefox.

To cut a long story to the essentials if you unload (not simply deactivate) Rapport Virtualbox 5.2.12 works fine. The unloading and reloading of Rapport is fortunately quite quick.

For anybody not familiar with Trusteer Rapport, it is a program widely supported by banking companies that checks the integrity of the connection between your PC and primarily banking websites, although you can use it for any website. I've never had a defective connection flagged but it is supposed to ensure you have not been rerouted via somebody who is interested in your login details. It does quite a lot more as well.
Last edited by socratis on 22. Aug 2018, 10:01, edited 3 times in total.
Reason: Changed title to something more appropriate.
andyp73
Volunteer
Posts: 1631
Joined: 25. May 2010, 23:48
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Assorted Linux, Windows Server 2012, DOS, Windows 10, BIOS/UEFI emulation

Re: Virtualbox and Windows 7-64 problem with Trusteer Rapport

Post by andyp73 »

There are plenty of postings about the forums about Trusteer Rapport. Their 1st June 2018 update broke something. They are aware of it and hopefully will fix it soon.

-Andy.
My crystal ball is currently broken. If you want assistance you are going to have to give me all of the necessary information.
Please don't ask me to do your homework for you, I have more than enough of my own things to do.
Monstercarp
Posts: 11
Joined: 23. Jun 2018, 13:50

Re: Virtualbox and Windows 7-64 problem with Trusteer Rapport

Post by Monstercarp »

Thanks Andy

All I can say is over the last couple of days I spent a long time searching the internet and came across absolutely nothing that mentioned Rapport. Hopefully a less onerous solution will arise in the near future. I actually first noticed the problem on May 22nd but didn't do anything about until recently when a Revenue filing deadline was rapidly approaching.
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Virtualbox problem with Trusteer Rapport

Post by socratis »

Monstercarp wrote:I spent a long time searching the internet and came across absolutely nothing that mentioned Rapport.
Which is why I changed the title of your post to be a little bit more generic to cover all VMs, moved it to "Windows Hosts", and I made it a Sticky (shows up in front of the other posts) until this is resolved.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
BitUser
Posts: 2
Joined: 26. Jun 2018, 17:18

Re: Virtualbox problem with Trusteer Rapport

Post by BitUser »

Socratis, thank you so much. The problem was indeed IBM Rapport. I've just uninstalled Rapport and now everything is working fine with Virtual Box.
Boxster1971
Posts: 1
Joined: 4. Jul 2018, 06:05
Primary OS: MS Windows 7
VBox Version: OSE other
Guest OSses: Windows XP

Re: Virtualbox problem with Trusteer Rapport

Post by Boxster1971 »

Socratis, thank you for making this thread a sticky. Ive been chasing this problem for several weeks and found this thread tonight.
Agree problem was indeed caused by IBM Trusteer prpogram. I've just uninstalled my Trusteer program and now everything is working fine with Virtual Box.

I had Trusteer Endpoint Protection installed on my Windows 7-64 Host running a legacy Windows XP Machine I've been using for years. It was updated in early June. I only use my VirtualBox occasionally as it is not mission critical. In mid June when I tried to use the VirtualBox it crashed for a Hardening error. Unloading Trusteer Endpoint Protection was a little involved and ultimately directed me to an IBM web page to enter a reason why I removed it. I sent IBM the problem - hopefully they will get this fixed.

Not sure what the difference is between Trusteer Endpoint Protection and Trustee Rapport. From what I could find they are the same thing.
marki
Posts: 4
Joined: 21. Jun 2018, 13:03

Re: Virtualbox problem with Trusteer Rapport

Post by marki »

Thanks to your posts I have also found that Trusteer Endpoint was the cause of my 'hardening' error on Windows 7 host. All had been well up to a month or so ago.
I have now uninstalled it as well as reporting to IBM as a problem.
forumsergio29
Posts: 1
Joined: 17. Aug 2018, 10:58

Re: Virtualbox problem with Trusteer Rapport

Post by forumsergio29 »

Hi,
Thanks for your workaround (disable Trusted rapport). It works, but after a reboot of the PC I had the same problem : I can't start my VMs.
I tried the last version of VirtualBox Version 5.2.18 r124319 (Qt5.6.2) : same problem
Any ideas?
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Virtualbox problem with Trusteer Rapport

Post by socratis »

@forumsergio29
Since you don't think that this it Trusteer Rapport related, please open a new thread. Post in there a ZIPPED version of the VBoxHardening.log for the VM that failed, after a "VirtualBox start" / "VM failed attempt" / "VirtualBox quit".
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
njholmes
Posts: 1
Joined: 22. Aug 2018, 02:54

Re: Virtualbox problem with Trusteer Rapport

Post by njholmes »

All,

I had the same issue with virtualbox (latest version) and I unable to start any of my VM's as it reports a hardening issue.

After many hours googling the issue, the finger of suspicion was pointing to Trusteer Rapport which is software strongly recommended by my bank for safer online banking. I uninstalled the software and the VM's now all start. I reinstalled the rapport software and initially the VM's continued to start but within a day they started to fail again.

Looking at the Trusteer website very little support information was available. However, I logged a support ticket and surprisingly received a response within the hour and the suggested "workaround". This is a know problem by Trusteer Support:
Dear Nick,

Thank you for contacting IBM Security Trusteer Technical Support.

The issue you have reported may be related to Rapport Cerberus, one of Rapport's Anti-malware protection mechanisms.
To verify this, please try to disable Rapport Cerberus in Safe Mode and let us know if the issue is resolved.

To do so, please follow the below instructions (we recommend writing them down before restarting your computer):
  1. Open the Run command box by pressing the 'Windows' key + 'R' on your keyboard simultaneously.
  2. Type: "msconfig" and click on OK.
  3. Under System Configuration, select the Boot tab.
  4. Check the box next to Safe Boot and choose the Network option under Boot Options.
  5. Click on OK.
  6. Restart your PC to enter Safe Mode automatically.
  7. Log on to your computer with a user account that has administrator rights.
  8. Open the Run command box by pressing the 'Windows' and 'R' keys on your keyboard simultaneously (alternatively, click Start > Programs > Accessories > Run).
  9. Enter the following directory:
    C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus
  10. Locate and open the folder named 'Baseline'.
  11. Re-name all system files named 'RapportCerberus.sys' so that their names will contain an underscore first (e.g. '_RapportCerberus00_00000.sys'). Do not re-name files which do not end with '.sys'.
  12. Follow steps 1-3 to get to your 'System Configuration' again, then un-check 'Safe Boot'
  13. Restart your PC to exit safe mode.
Please note, these steps are temporary as part of our investigation. Please notify us regarding the results so we can provide you with a permanent solution.

Thank you for your cooperation.

Should you need additional assistance, feel free to contact us by submitting the following form:
We also have helpful information available in our FAQ:
Sincerely,
I suggest you try this as it fixed my issue or log a support ticket with Trusteer. This is not a virtualbox software issue.

I hope this helps

Regards

Nick Holmes
Last edited by socratis on 22. Aug 2018, 09:58, edited 1 time in total.
Reason: Enclosed the information in [quote] tag for better readability
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Virtualbox problem with Trusteer Rapport

Post by socratis »

Great, thanks for the feedback Nick! I'll amend the first post to point to the reply that you received from IBM.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
firlas
Posts: 1
Joined: 24. Aug 2018, 11:08

Solution to opening virtual machines problems

Post by firlas »

If you have IBM Security Trusteer Rapport installed, then you will have problems to
start any virtual machine, in most cases a hardening problem will occur.
For any Oracle VirtualBox hardening problem, uninstall IBM Security Trusteer Rapport.
After 3 months searching for a solution, I found the solution on the Kaspersky support site.
Last edited by firlas on 24. Aug 2018, 11:29, edited 1 time in total.
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Solution to opening virtual machines problems

Post by socratis »

firlas wrote:After 3 monts searching for a solution, I found the solution on the Kaspersky support site.
Impressive! Well, funny thing... there is a sticky post here as well (with a workaround), in the "Windows Hosts" section (Virtualbox problem with Trusteer Rapport), which is where I'm going to merge your post into.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Monstercarp
Posts: 11
Joined: 23. Jun 2018, 13:50

Re: Virtualbox problem with Trusteer Rapport

Post by Monstercarp »

As I pointed out in the first post it is essential to unload Virtual Box not simply disable it as a contributor here suggested.

I assume from the absence of any response from IBM being mentioned on this forum that the failure to load VMs under virtualbox has not changed. Tiresome.
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Virtualbox problem with Trusteer Rapport

Post by socratis »

Monstercarp wrote:I assume from the absence of any response from IBM being mentioned on this forum
Are you kidding, or you didn't read the edited part of your original post?
The part that talks about the workaround provided by IBM Security Trusteer Technical Support?
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Locked