[Resolved] Failed to open a session for the virtual machine Hortonworks Sandbox HDP 2.6.5.

[ivancald]

Hello, I am having trouble starting an instance on my computer. I am using Windows 10 Enterprise, Version 1607. Below is the error message I am getting along with the VBoxHardening log.

Using VirtualBox Version 5.2.18

The virtual machine 'Hortonworks Sandbox HDP 2.6.5' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'C:\...\VBoxHardening.log'.

Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {85cd948e-a71f-4289-281e-0ca7ad48cd89}

I have tried normal, headless, and detachables starts and they all get the same error. Any input and/or suggestions are greatly appreciated.

[socratis]

Please read really carefully the following FAQ: Diagnosing VirtualBox Hardening Issues for some generic guidelines/ideas. Remember, these are guidelines, not the exact solution, you have to use your judgement as to which program might be responsible.

I'd start with the following:

23b4.f60: supR3HardenedWinFindAdversaries: 0x8000
23b4.f60: \SystemRoot\System32\drivers\cyprotectdrv64.sys:
...
23b4.f60:     ProductName:     CylancePROTECT
23b4.f60:     ProductVersion:  2.0.1490.25
23b4.f60:     FileVersion:     2.0.1490.25
23b4.f60:     FileDescription: Cylance Protect Driver

PS. For future reference you should ZIP your logs. It helps save a (virtual) tree or two...

[McChen]

I am having this exact same error and I also have Cylance Protect. It must have something to do with some change recently, because I've had VirtualBox working on this same machine with Cylance installed for a year now and I had just used VirtualBox on it a month ago. In that time the only changes have been the monthly Windows 10 update and some driver updates. Cylance I'm sure has upgraded itself in the background as well. I have no control over Cylance as it is managed by my corporate IT. If that's the case, what options are there to get VirtualBox working again?

[socratis]

If that's the case, what options are there to get VirtualBox working again?

In reality there are three options available:

1. Completely uninstall CylancePROTECT, even if that involves your IT folks, even if it's temporary, even if you have to unplug temporarily your computer from the network if you're afraid for infections. BTW, Win10 has a perfectly fine antivirus built-in, there's absolutely no need for 3rd party pests products...
2. Put an exception in CylancePROTECT for all the VirtualBox folder and/or its drivers. Most antivirus offer that option, see if CylancePROTECT allows that.
3. Let the CylancePROTECT developers know about the situation, point them to the FAQ so they can better understand where the problem is and what they can do to address them.

Note that you can combine more than one, or all of the above options...

[ivancald]

Hi socratis, do you know exactly what needs to be whitelisted from Cylance? I am getting the same error after whitelisting the <VirtualBox> folder that contains all of the DLL's, the <.VirtualBox> folder, and the <VirtualBox VMs> folder that contains all the virtual machines..

[mpack]

Data folders <.VirtualBox> and <VirtualBox VMs> are not relevant. Only the executable folder (c:\Program Files\Oracle\VirtualBox) and subfolders have code which runs on the host. There also DLLs and drivers in the SYSTEM32 folder tree, but if Cylance needs to be told not to mess about in there then you really do need to get rid of it.

Btw, while the earlier answers are theoretically correct: I for one don't know for sure that Cylance actually honors configured exclusions.

[ivancald]

I finally got it to work. With the help from Cylance, this is what I had to do to fix my instance:

Add exclusions to the Memory Protection setting to allow compatibility with VirtualBox.

In the Console, select Settings > Device Policy.
Select the policy assigned to the VirtualBox device.
Click Memory Actions.
Select Memory Protection and Exclude Executable Files (relative paths only).
Type the following exclusions, then click Save. The updated policy is pushed to the CylancePROTECT Agent on the device.
Windows:
\Program Files\Oracle\VirtualBox\VirtualBox.exe
\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
\Program Files\Oracle\VirtualBox\VBoxSVC.exe
\Program Files\Oracle\VirtualBox\VBoxTestOGL.exe
\Program Files\Oracle\VirtualBox\VBoxNetDHCP.exe
\Program Files\Oracle\VirtualBox\VBoxManage.exe
\Program Files\Oracle\VirtualBox\VBoxBFE.exe
\Program Files\Oracle\VirtualBox\VBoxSDL.exe
\Program Files\Oracle\VirtualBox\VBoxWebSrv.exe
\Program Files\Oracle\VirtualBox\VBoxNetNAT.exe
Mac:
/usr/local/bin/VBoxManage
/usr/local/bin/VBoxHeadless
/Applications/VirtualBox.app/Contents/MacOS/VBoxManage
/Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless
/Applications/VirtualBox.app/Contents/MacOS/VBoxSVC

If you can give this a try, save the policy, reboot the device and test again hopefully things should start working with Virtualbox again.

Thanks for all the help and support.

[socratis]

Great, thanks for letting us know. Marking as [Resolved].