Page 1 of 2

Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 20. Dec 2018, 15:46
by BaboM
After upgrading to Version 6.0, i cannot start VMs anymore.
In the Hardening Log i can see TrendMicro Dlls. Its not an option to uninstall the Virusscan.

In Version 5.2 everything works fine.

Error Code: E_FAIL (0x80004005)
Komponente: MachineWrap
Interface: IMachine {5047460a-265d-4538-b23e-ddba5fb84976}

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 20. Dec 2018, 15:49
by mpack
FAQ: Diagnosing VirtualBox Hardening Issues.

If it is truly not an option to provide an execution environment which is compatible with VirtualBox, then uninstall VirtualBox.

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 20. Dec 2018, 18:35
by vdir
Same issue. Got it working by opening the TM Agent, clicking Settings (gear icon on bottom) -> Protection -> Trusted Programs List and adding VirtualBoxVM.exe to the list.

Hardening error with 6.0.0; 5.2.22 works OK

Posted: 20. Dec 2018, 19:25
by Greg Bailey
Just upgraded from VirtualBox 5.2.22 to the new 6.0.0 version, and am unable to launch any VMs with a graphical display.

Starting a headless VM (via "vagrant") appeared to work OK.

I've performed full uninstall / reboot / reinstall after the initial failure, and the same error persists.

I don't have an easy way to disable Trend since my Windows 10 workstation is "managed" by my organization, although I've reached out for help there as well.

I'm attaching a ZIP file containing VBoxHardening.log files from both the 5.2.22 and 6.0.0 versions.

Re: Hardening error with 6.0.0; 5.2.22 works OK

Posted: 21. Dec 2018, 10:13
by BuddOvit
You are not alone :)

I've got exactly the same issue. Hardening log is pretty much identical to yours. Also running Trend Micro managed by the organisation.

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 23. Dec 2018, 02:09
by socratis
@Greg Bailey, @BuddOvit
I merged your topic with an existing one talking about the same thing. Read the thread (and the solution) from the beginning please...

It helps if you search before creating a new topic, make my life easier and yours less complicated... ;)

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 26. Dec 2018, 19:44
by poshcodebear
I'm running into the same problem, also have Trend Micro, and also have no option to uninstall due to company policy (and a different department manages the AV, so I can't add exceptions for it). Thanks to Greg Bailey's comment about headless launch, I tried to launch one of my servers in headless mode (using the downward drop-down arrow next to the "Start" button), which worked, AND I was able to attach to it by hitting the "Start" (now changed to "Show") button.

Considering this was working fine in 5.22 and previous, and the only change was upgrading to 6.0, either VirtualBox turned up the hardening past a point Trend Micro isn't yet compatible with (have additional hardening features been activated in the new release?), or we all had an exclusion list that included VirtualBox in Trend Micro and it doesn't recognize the new executables.

Or it's a bug and the new version just doesn't like Trend (I'd get rid of it and stick with Windows Defender if my company would let me; I'm sure most of us would).

Anyway, that means we have a functioning workaround (at least, it works for me) until this gets fixed (either by Trend Micro, Oracle, or our individual IT departments, depending on what the root cause is).

Workaround steps:
(repeated as bullet list to make it easier for people to find when scanning through the replies)
  1. Click the downward arrow next to the Start arrow
  2. Select Headless start
  3. Click on the Show button to bring up the console window
I hope this helps!

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 26. Dec 2018, 22:41
by socratis
@poshcodebear
Do you mind posting a VBox.log and a VBoxhardening.log from a Normal start when it fails? ZIPPED...

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 25. Jan 2019, 16:16
by buker
I experience the same problem. I use VirtualBox 6.0.2 r128162 (Qt5.6.2) and Trend Micro OfficeScan 12.0.5261.
I'm attaching VboxHardening.log

Issues with VBox 6.0.4

Posted: 11. Feb 2019, 14:49
by GregB169
Hello

I have upgraded several times from the 5.2 branch to the 6.x branch and cannot get VMs to either build or start if they were built under 5.2. I have my local IT team add exemptions to see if my AV, Trend Micro, was the issue.

Attached is my vBox Hardening log to see if there is something else that I am missing.

Thanks

Greg

Re: Issues with VBox 6.0.4

Posted: 12. Feb 2019, 02:45
by socratis
4f80.4758: supR3HardenedWinFindAdversaries: 0x8
4f80.4758: \SystemRoot\System32\drivers\tmcomm.sys:
...
4f80.4758:     FileDescription: TrendMicro Common Module
Please read really carefully the following FAQ: Diagnosing VirtualBox Hardening Issues for some generic guidelines/ideas.

I'm merging your topic with the other posts that deal with TrendMicro and I'm going to make it a sticky until this is resolved.

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 19. Feb 2019, 11:31
by TomSmi
Hi, I had simiar issues with VirtualBox and TrendMicro OfficeScan.
Adding those exceptions to TM OS allowed me to run VMs in VirtualBox Again:

C:\Windows\System32\ntdll.dll
C:\Windows\System32\kernel32.dll
C:\Windows\System32\KernelBase.dll
C:\Windows\System32\apisetschema.dll
C:\Windows\System32\apisetschema.dlC:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe

--
Best regards,
Tom

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 19. Feb 2019, 11:53
by socratis
@Tom,
I don't think that the system DLLs are necessary. Just the "C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" is required.

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 19. Feb 2019, 15:12
by TomSmi
@socratis, you're right!
Thanks for help.

Re: Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

Posted: 27. Feb 2019, 16:47
by GregB169
The path update was the issue for me. Not sure why Trend is not allowing this but adding this to the exclusion list worked. "C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe"