Cannot start vm's anymore. RC=5640

[pitu]

I keep getting the error message RC=5640
Please reinstall virtualbox
where: supR3HardenedWinReSpawn what: 1
VERR_SUP_VP_THREAD_NOT_ALONE (-5640) - process verification failure: The process has more than one thread.

I already tried to uninstall and reinstall virtualbox with the latest version, but without success. In attachment the hardening logfile.

[mpack]

The error means that you have software installed which is snooping on VirtualBox. The usual suspects are "web safe" filters design to prevent you from accessing dangerous/dubious sites while at work, regardless of which browser you use. The snoop software needs to be uninstalled, or executables in the VirtualBox program files folder need to be exempted from its functions.

[pitu]

Thanks for your swift reply. I tried uninstalling most of the 3rd party software, but it does not make a difference. I tried to reinstall virtualbox several times but it does not make a difference.
Any other thoughts about this?

[mpack]

Reinstalling VirtualBox will do nothing to affect this problem.

I'm afraid that I can't add to what I said above: you have software installed which tries to snoop on VirtualBox. Parts of VirtualBox run with elevated privileges behind Oracle certification, so other code cannot be allowed to piggyback on the VirtualBox process. I am not there to look at what programs you have on your PC, so you need to apply the logic yourself. Look at all non-Microsoft apps on your PC, consider which of them will want to affect other programs.

[mhanor]

Probably the Citrix software (XenApp, XenDesktop) is intruding into the VirtualBox processes.

[mpack]

Well spotted, yes, that seems quite likely.

[cortomaltese]

Hello, I have a similar problem, at least I have a similar error message;

4cc.16a0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe)
4cc.16a0: SUPR3HardenedMain: Respawn #2
4cc.16a0: Error (rc=-5640):
4cc.16a0: More than one thread in process
4cc.16a0: Error -5640 in supR3HardenedWinReSpawn! (enmWhat=1)
4cc.16a0: More than one thread in process

I am working on a corporate PC Windows 10 Enterprise x64. 6 months ago I was given this PC with VirtualBox version 5.1.30 and I created a new virtual machine which worked succesfully till one week ago. Since then I am not able to run the VM anymore, I suspect that after an update of the WIN10 operating system.
I am working on a corporate PC on the network of the customer so it is not easy for me to uninstall/install software

Though I updated VirtualBox to current version 5.2.16, but I still get this error More than one thread in process

On the PC is running Triton endpoint that I can disable but nothing changed,
Avecto Defendpoint, that I can not disable and which according to the log seem to give problems
Symantec endpoint protection that I can not disable

I enclose the VBoxHardening.log


Can you please help me

[socratis]

On the PC is running Triton endpoint that I can disable but nothing changed,
Avecto Defendpoint, that I can not disable and which according to the log seem to give problems
Symantec endpoint protection that I can not disable

One of these three is responsible. See if you can put an exception for VirtualBox.

which worked succesfully till one week ago

See which one of them was updated last week.

[cortomaltese]

Thank you for your suggestion.
Sorry for my ignorance, how can I put an exception for VirtualBox ?

[socratis]

That depends on your software. I honestly have no clue. You have to take a look at each software that's scanning and tell it to leave VirtualBox out of their scan.

[cortomaltese]

And for my culture, how does the process work ? Why are there multiple threads competing since antivirus, symantec, avecto etc. one way or another will be present ?
Thank you for your explanations

[socratis]

Read the FAQ: Diagnosing VirtualBox Hardening Issues.

[cortomaltese]

Hello, I saw a post created back in may 2016 where teams of virtualbox and avecto were working together to solve this issue;
Quoting the post of June 2016
'm pleased to announce to anyone reading this thread that there is a fix for this issue in the latest client release of Defendpoint.

Please contact whoever is responsible for maintaining and implementing Defendpoint at your company in order to obtain the latest client, version 4.1.255

Currently I am running version 5.1.149 of Avecto Defendpoint Client

Do you have news about it ?
Do I have to address this issue to Avecto (awesome task) ?
Thank you for your support

[socratis]

As I said, start uninstalling programs. If you can't, put exceptions for VirtualBox. I'm a simple user (like the rest of us in the forums), I'm not Avecto, Oracle, McAfee, or anything like that. You've got to find the solution on your side I'm afraid...

[funkgun]

Not sure this is an acceptable solution. I was unable to restart my Ubuntu or Mint VMs due to the same notice.

I changed my network settings to "Not attached" then restarted my Virtualbox instance. They ended up coming back up.
Once the box was up, I changed my network settings back.

Once again, not sure this would work for anyone else.