Page 2 of 3

Re: Cannot start vm's anymore. RC=5640

Posted: 14. Nov 2018, 18:34
by mpack
@funkgun:

Makes sense. Of course it would only be acceptable to people who don't need a network connection.

I imagine that what happens is that your spyware is filtering calls to host OS networking functions. If a new application calls a filtered function then the spyware injects a copy of itself into the application.

Thanks for that observation: if nothing else it certainly provides an interesting verification test that can be performed.

Re: Cannot start vm's anymore. RC=5640

Posted: 14. Nov 2018, 18:41
by funkgun
Yeah, totally don't want to Jeopardize my job, so I am not going to try to remove any programs, but I still need a little Linux in my life.
I believe you are 100% correct.

Good thing was being able to just change the network connections back after the box was back up. So I can still get out, but if I were to do an update to my box, my assumptions is I will have to do the same thing over again.

Re: Cannot start vm's anymore. RC=5640

Posted: 14. Nov 2018, 19:12
by mpack
funkgun wrote:Good thing was being able to just change the network connections back after the box was back up.
Another telling observation! I think I'll mention this to the devs. Maybe they can delay initializing the network connection until after they've done the initial hardening check.

Re: Cannot start vm's anymore. RC=5640

Posted: 29. Aug 2019, 23:00
by dkarr
I'm running into this after my Win10 upgrade (although it's RC=-5640). I haven't tried to reinstall VirtualBox. I didn't want to try that just yet. I tried setting the network on the VM to "Not Attached" and saving it, then killing the VirtualBox process and restarting the VM. No effect.

Re: Cannot start vm's anymore. RC=5640

Posted: 30. Aug 2019, 22:40
by dkarr
If it matters, I downloaded version 6 of VirtualBox (had 5 originally), and tried to run the VM from that interface. Gets the same error.

Another developer who has also finished the Win10 upgrade had also installed VirtualBox before the upgrade, and had created a VM. She had installed version 6 originally. After the upgrade, the VM is working fine.

Re: Cannot start vm's anymore. RC=5640

Posted: 31. Aug 2019, 14:16
by scottgus1
dkarr, you ought to start your own thread. Error -5640 isn't error 5640, there's a lot of difference in the numbers if you look at them in computer binary. See Minimum Info Needed for Assistance when you do start your new thread.

Re: Cannot start vm's anymore. RC=5640

Posted: 31. Aug 2019, 18:35
by dkarr
Uh, yeah, I know 5640 != -5640, even in decimal. However, everything else about this error reported here is identical to what I see. In fact, if you'll notice in the original error reported here, it shows "VERR_SUP_VP_THREAD_NOT_ALONE (-5640)". Note the number in parens. I have no idea why the original reporter cited "5640" instead of "-5640". I think it's likely the original reporter missed the minus sign.

Re: Cannot start vm's anymore. RC=5640

Posted: 31. Aug 2019, 19:17
by scottgus1
Ah, yes, I see that now. Sorry about that, dkarr. "Read the whole thread", eh? :oops:

Are you still having trouble running your Virtualbox guests? If so, please post the hardening log, zipped, using the forum's Upload Attachment tab, and we'll see what we can do.

Re: Cannot start vm's anymore. RC=5640

Posted: 31. Aug 2019, 19:34
by dkarr
When I select "Show Log ..." in the context menu of my VM, I see one tab labeled "VBoxHardening.log". I selected that, and then clicked "Save" and selected a location to save it. I'm attaching that file, zipped as you request.

Can you tell me exactly what a "hardening log" is? I couldn't find any information from a casual search.

Re: Cannot start vm's anymore. RC=5640

Posted: 31. Aug 2019, 19:50
by scottgus1
That's the right log. See Diagnosing VirtualBox Hardening Issues for the skinny on what hardening is & why Virtualbox has to bother with it.

At the end of your hardening log is the exit code 0x1. From the Diagnosing tutorial, this means either a required program to run Virtualbox failed to load or there is "more than one thread in the process". Sure enough, you have:
1798.6084: Error -5640 in supR3HardenedWinReSpawn! (enmWhat=1)
1798.6084: More than one thread in process
The tutorial says for this error:
The usual culprits behind this error are certain kinds of "web safe" internet browser filters or remote desktop applications. Those applications must be uninstalled, or VirtualBox must be added as an exception to their activities.
Looking in the section "supR3HardenedWinFindAdversaries" in the log you have several programs from McAffee, as well as ZoneAlarm End Point Security running. These programs are causing trouble for Virtualbox, See if you can set exceptions in these programs to not scan Virtualbox programs, or as an experiment, try uninstalling them to see if Virtualbox can run then. (Note that often a mere disable will not be enough, an uninstall & reboot may be required.)

Re: Cannot start vm's anymore. RC=5640

Posted: 31. Aug 2019, 20:49
by dkarr
Thanks for that analysis, although it just confirms what I already assumed, that our security scanners are causing it. I'll have to wait for my escalated ticket to be handled by the people who have permission to request changes to that.

What's confusing to me is that I'm aware of one other user on my team who has a similar configuration, but she does not see this error. The only differences I'm aware of is that her first install of VirtualBox was version 6.x, and her VM is Ubuntu 18. My VM is Ubuntu 16, which I originally created with VIrtualBox 5.x. If I'm unable to get exceptions for the security scanners (which unfortunately is likely), do you think I could possibly have better luck creating a new VM, and perhaps Ubuntu 18? I'm not going to do that as an experiment unless I have a reasonable certainty of success. I would have to delete my existing VM and vdi file in order to have enough space on my laptop disk.

Re: Cannot start vm's anymore. RC=5640

Posted: 31. Aug 2019, 21:49
by scottgus1
dkarr wrote:do you think I could possibly have better luck creating a new VM, and perhaps Ubuntu 18?
I doubt it. I believe the hardening checks have to pass before the VM can start executing guest OS code. (Mostly, some hardening checks continue after the guest starts, but I think you'd need a clean exit code 0x0 in the hardening log.) I may be wrong....

There may be some minor differences in the two host PCs and/or versions of the 3rd-part software, so your co-worker's works and yours doesn't. If it interferes with work, maybe your boss can escalate the ticket?

Re: Cannot start vm's anymore. RC=5640

Posted: 1. Sep 2019, 16:20
by dkarr
One thing I can do is work with that other team member who is not seeing this symptom, and get her hardening log, and compare it to mine. I'll try to do that on Tuesday.

Re: Cannot start vm's anymore. RC=5640

Posted: 3. Sep 2019, 19:24
by dkarr
This is the hardening log from the other user who is not having this symptom. I briefly compared this one to mine, and I see that I can't find "ZoneAlarm" in her log.

Re: Cannot start vm's anymore. RC=5640

Posted: 3. Sep 2019, 20:06
by scottgus1
Yep, no ZoneAlarm & an exit code of 0x0. Maybe there's a way to set an exception in ZoneAlarm for Virtualbox?