Page 1 of 3

Cannot start vm's anymore. RC=5640

Posted: 17. Jul 2018, 15:48
by pitu
I keep getting the error message RC=5640
Please reinstall virtualbox
where: supR3HardenedWinReSpawn what: 1
VERR_SUP_VP_THREAD_NOT_ALONE (-5640) - process verification failure: The process has more than one thread.

I already tried to uninstall and reinstall virtualbox with the latest version, but without success. In attachment the hardening logfile.

Re: Cannot start vm's anymore. RC=5640

Posted: 17. Jul 2018, 19:24
by mpack
The error means that you have software installed which is snooping on VirtualBox. The usual suspects are "web safe" filters design to prevent you from accessing dangerous/dubious sites while at work, regardless of which browser you use. The snoop software needs to be uninstalled, or executables in the VirtualBox program files folder need to be exempted from its functions.

Re: Cannot start vm's anymore. RC=5640

Posted: 18. Jul 2018, 14:06
by pitu
Thanks for your swift reply. I tried uninstalling most of the 3rd party software, but it does not make a difference. I tried to reinstall virtualbox several times but it does not make a difference.
Any other thoughts about this?

Re: Cannot start vm's anymore. RC=5640

Posted: 18. Jul 2018, 15:40
by mpack
Reinstalling VirtualBox will do nothing to affect this problem.

I'm afraid that I can't add to what I said above: you have software installed which tries to snoop on VirtualBox. Parts of VirtualBox run with elevated privileges behind Oracle certification, so other code cannot be allowed to piggyback on the VirtualBox process. I am not there to look at what programs you have on your PC, so you need to apply the logic yourself. Look at all non-Microsoft apps on your PC, consider which of them will want to affect other programs.

Re: Cannot start vm's anymore. RC=5640

Posted: 18. Jul 2018, 16:39
by mhanor
Probably the Citrix software (XenApp, XenDesktop) is intruding into the VirtualBox processes.

Re: Cannot start vm's anymore. RC=5640

Posted: 18. Jul 2018, 17:44
by mpack
Well spotted, yes, that seems quite likely.

Re: Cannot start vm's anymore. RC=5640

Posted: 29. Jul 2018, 21:37
by cortomaltese
Hello, I have a similar problem, at least I have a similar error message;
4cc.16a0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe)
4cc.16a0: SUPR3HardenedMain: Respawn #2
4cc.16a0: Error (rc=-5640):
4cc.16a0: More than one thread in process
4cc.16a0: Error -5640 in supR3HardenedWinReSpawn! (enmWhat=1)
4cc.16a0: More than one thread in process
I am working on a corporate PC Windows 10 Enterprise x64. 6 months ago I was given this PC with VirtualBox version 5.1.30 and I created a new virtual machine which worked succesfully till one week ago. Since then I am not able to run the VM anymore, I suspect that after an update of the WIN10 operating system.
I am working on a corporate PC on the network of the customer so it is not easy for me to uninstall/install software

Though I updated VirtualBox to current version 5.2.16, but I still get this error More than one thread in process

On the PC is running Triton endpoint that I can disable but nothing changed,
Avecto Defendpoint, that I can not disable and which according to the log seem to give problems
Symantec endpoint protection that I can not disable

I enclose the VBoxHardening.log


Can you please help me

Re: Cannot start vm's anymore. RC=5640

Posted: 29. Jul 2018, 22:57
by socratis
cortomaltese wrote:On the PC is running Triton endpoint that I can disable but nothing changed,
Avecto Defendpoint, that I can not disable and which according to the log seem to give problems
Symantec endpoint protection that I can not disable
One of these three is responsible. See if you can put an exception for VirtualBox.
cortomaltese wrote:which worked succesfully till one week ago
See which one of them was updated last week.

Re: Cannot start vm's anymore. RC=5640

Posted: 30. Jul 2018, 13:30
by cortomaltese
Thank you for your suggestion.
Sorry for my ignorance, how can I put an exception for VirtualBox ?

Re: Cannot start vm's anymore. RC=5640

Posted: 30. Jul 2018, 13:33
by socratis
That depends on your software. I honestly have no clue. You have to take a look at each software that's scanning and tell it to leave VirtualBox out of their scan.

Re: Cannot start vm's anymore. RC=5640

Posted: 30. Jul 2018, 13:34
by cortomaltese
And for my culture, how does the process work ? Why are there multiple threads competing since antivirus, symantec, avecto etc. one way or another will be present ?
Thank you for your explanations

Re: Cannot start vm's anymore. RC=5640

Posted: 30. Jul 2018, 13:36
by socratis

Re: Cannot start vm's anymore. RC=5640

Posted: 31. Jul 2018, 11:34
by cortomaltese
Hello, I saw a post created back in may 2016 where teams of virtualbox and avecto were working together to solve this issue;
Quoting the post of June 2016
'm pleased to announce to anyone reading this thread that there is a fix for this issue in the latest client release of Defendpoint.

Please contact whoever is responsible for maintaining and implementing Defendpoint at your company in order to obtain the latest client, version 4.1.255

Currently I am running version 5.1.149 of Avecto Defendpoint Client

Do you have news about it ?
Do I have to address this issue to Avecto (awesome task) ?
Thank you for your support

Re: Cannot start vm's anymore. RC=5640

Posted: 31. Jul 2018, 12:04
by socratis
As I said, start uninstalling programs. If you can't, put exceptions for VirtualBox. I'm a simple user (like the rest of us in the forums), I'm not Avecto, Oracle, McAfee, or anything like that. You've got to find the solution on your side I'm afraid...

Re: Cannot start vm's anymore. RC=5640

Posted: 14. Nov 2018, 18:24
by funkgun
Not sure this is an acceptable solution. I was unable to restart my Ubuntu or Mint VMs due to the same notice.

I changed my network settings to "Not attached" then restarted my Virtualbox instance. They ended up coming back up.
Once the box was up, I changed my network settings back.

Once again, not sure this would work for anyone else.