Cannot start vm's anymore. RC=5640

Discussions related to using VirtualBox on Windows hosts.

Cannot start vm's anymore. RC=5640

Postby pitu » 17. Jul 2018, 15:48

I keep getting the error message RC=5640
Please reinstall virtualbox
where: supR3HardenedWinReSpawn what: 1
VERR_SUP_VP_THREAD_NOT_ALONE (-5640) - process verification failure: The process has more than one thread.

I already tried to uninstall and reinstall virtualbox with the latest version, but without success. In attachment the hardening logfile.
Attachments
VBoxHardening.zip
(12.5 KiB) Downloaded 36 times
pitu
 
Posts: 2
Joined: 17. Jul 2018, 15:44

Re: Cannot start vm's anymore. RC=5640

Postby mpack » 17. Jul 2018, 19:24

The error means that you have software installed which is snooping on VirtualBox. The usual suspects are "web safe" filters design to prevent you from accessing dangerous/dubious sites while at work, regardless of which browser you use. The snoop software needs to be uninstalled, or executables in the VirtualBox program files folder need to be exempted from its functions.
mpack
Site Moderator
 
Posts: 29976
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Postby pitu » 18. Jul 2018, 14:06

Thanks for your swift reply. I tried uninstalling most of the 3rd party software, but it does not make a difference. I tried to reinstall virtualbox several times but it does not make a difference.
Any other thoughts about this?
pitu
 
Posts: 2
Joined: 17. Jul 2018, 15:44

Re: Cannot start vm's anymore. RC=5640

Postby mpack » 18. Jul 2018, 15:40

Reinstalling VirtualBox will do nothing to affect this problem.

I'm afraid that I can't add to what I said above: you have software installed which tries to snoop on VirtualBox. Parts of VirtualBox run with elevated privileges behind Oracle certification, so other code cannot be allowed to piggyback on the VirtualBox process. I am not there to look at what programs you have on your PC, so you need to apply the logic yourself. Look at all non-Microsoft apps on your PC, consider which of them will want to affect other programs.
mpack
Site Moderator
 
Posts: 29976
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Postby mhanor » 18. Jul 2018, 16:39

Probably the Citrix software (XenApp, XenDesktop) is intruding into the VirtualBox processes.
mhanor
Volunteer
 
Posts: 317
Joined: 7. Oct 2009, 12:40
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: various

Re: Cannot start vm's anymore. RC=5640

Postby mpack » 18. Jul 2018, 17:44

Well spotted, yes, that seems quite likely.
mpack
Site Moderator
 
Posts: 29976
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Postby cortomaltese » 29. Jul 2018, 21:37

Hello, I have a similar problem, at least I have a similar error message;
4cc.16a0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe)
4cc.16a0: SUPR3HardenedMain: Respawn #2
4cc.16a0: Error (rc=-5640):
4cc.16a0: More than one thread in process

4cc.16a0: Error -5640 in supR3HardenedWinReSpawn! (enmWhat=1)
4cc.16a0: More than one thread in process

I am working on a corporate PC Windows 10 Enterprise x64. 6 months ago I was given this PC with VirtualBox version 5.1.30 and I created a new virtual machine which worked succesfully till one week ago. Since then I am not able to run the VM anymore, I suspect that after an update of the WIN10 operating system.
I am working on a corporate PC on the network of the customer so it is not easy for me to uninstall/install software

Though I updated VirtualBox to current version 5.2.16, but I still get this error More than one thread in process

On the PC is running Triton endpoint that I can disable but nothing changed,
Avecto Defendpoint, that I can not disable and which according to the log seem to give problems
Symantec endpoint protection that I can not disable

I enclose the VBoxHardening.log


Can you please help me
Attachments
VBoxHardening.7z
Virtual box log
(6.39 KiB) Downloaded 15 times
cortomaltese
 
Posts: 4
Joined: 29. Jul 2018, 21:17

Re: Cannot start vm's anymore. RC=5640

Postby socratis » 29. Jul 2018, 22:57

cortomaltese wrote:On the PC is running Triton endpoint that I can disable but nothing changed,
Avecto Defendpoint, that I can not disable and which according to the log seem to give problems
Symantec endpoint protection that I can not disable

One of these three is responsible. See if you can put an exception for VirtualBox.

cortomaltese wrote:which worked succesfully till one week ago

See which one of them was updated last week.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
socratis
Site Moderator
 
Posts: 26924
Joined: 22. Oct 2010, 11:03
Location: Greece
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5

Re: Cannot start vm's anymore. RC=5640

Postby cortomaltese » 30. Jul 2018, 13:30

Thank you for your suggestion.
Sorry for my ignorance, how can I put an exception for VirtualBox ?
cortomaltese
 
Posts: 4
Joined: 29. Jul 2018, 21:17

Re: Cannot start vm's anymore. RC=5640

Postby socratis » 30. Jul 2018, 13:33

That depends on your software. I honestly have no clue. You have to take a look at each software that's scanning and tell it to leave VirtualBox out of their scan.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
socratis
Site Moderator
 
Posts: 26924
Joined: 22. Oct 2010, 11:03
Location: Greece
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5

Re: Cannot start vm's anymore. RC=5640

Postby cortomaltese » 30. Jul 2018, 13:34

And for my culture, how does the process work ? Why are there multiple threads competing since antivirus, symantec, avecto etc. one way or another will be present ?
Thank you for your explanations
cortomaltese
 
Posts: 4
Joined: 29. Jul 2018, 21:17

Re: Cannot start vm's anymore. RC=5640

Postby socratis » 30. Jul 2018, 13:36

Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
socratis
Site Moderator
 
Posts: 26924
Joined: 22. Oct 2010, 11:03
Location: Greece
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5

Re: Cannot start vm's anymore. RC=5640

Postby cortomaltese » 31. Jul 2018, 11:34

Hello, I saw a post created back in may 2016 where teams of virtualbox and avecto were working together to solve this issue;
Quoting the post of June 2016
'm pleased to announce to anyone reading this thread that there is a fix for this issue in the latest client release of Defendpoint.

Please contact whoever is responsible for maintaining and implementing Defendpoint at your company in order to obtain the latest client, version 4.1.255

Currently I am running version 5.1.149 of Avecto Defendpoint Client

Do you have news about it ?
Do I have to address this issue to Avecto (awesome task) ?
Thank you for your support
cortomaltese
 
Posts: 4
Joined: 29. Jul 2018, 21:17

Re: Cannot start vm's anymore. RC=5640

Postby socratis » 31. Jul 2018, 12:04

As I said, start uninstalling programs. If you can't, put exceptions for VirtualBox. I'm a simple user (like the rest of us in the forums), I'm not Avecto, Oracle, McAfee, or anything like that. You've got to find the solution on your side I'm afraid...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
socratis
Site Moderator
 
Posts: 26924
Joined: 22. Oct 2010, 11:03
Location: Greece
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5

Re: Cannot start vm's anymore. RC=5640

Postby funkgun » 14. Nov 2018, 18:24

Not sure this is an acceptable solution. I was unable to restart my Ubuntu or Mint VMs due to the same notice.

I changed my network settings to "Not attached" then restarted my Virtualbox instance. They ended up coming back up.
Once the box was up, I changed my network settings back.

Once again, not sure this would work for anyone else.
funkgun
 
Posts: 2
Joined: 14. Nov 2018, 18:19

Next

Return to VirtualBox on Windows Hosts

Who is online

Users browsing this forum: No registered users and 54 guests