Cannot start vm's anymore. RC=5640

Discussions related to using VirtualBox on Windows hosts.
pitu
Posts: 2
Joined: 17. Jul 2018, 15:44

Cannot start vm's anymore. RC=5640

Post by pitu »

I keep getting the error message RC=5640
Please reinstall virtualbox
where: supR3HardenedWinReSpawn what: 1
VERR_SUP_VP_THREAD_NOT_ALONE (-5640) - process verification failure: The process has more than one thread.

I already tried to uninstall and reinstall virtualbox with the latest version, but without success. In attachment the hardening logfile.
Attachments
VBoxHardening.zip
(12.5 KiB) Downloaded 91 times
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Post by mpack »

The error means that you have software installed which is snooping on VirtualBox. The usual suspects are "web safe" filters design to prevent you from accessing dangerous/dubious sites while at work, regardless of which browser you use. The snoop software needs to be uninstalled, or executables in the VirtualBox program files folder need to be exempted from its functions.
pitu
Posts: 2
Joined: 17. Jul 2018, 15:44

Re: Cannot start vm's anymore. RC=5640

Post by pitu »

Thanks for your swift reply. I tried uninstalling most of the 3rd party software, but it does not make a difference. I tried to reinstall virtualbox several times but it does not make a difference.
Any other thoughts about this?
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Post by mpack »

Reinstalling VirtualBox will do nothing to affect this problem.

I'm afraid that I can't add to what I said above: you have software installed which tries to snoop on VirtualBox. Parts of VirtualBox run with elevated privileges behind Oracle certification, so other code cannot be allowed to piggyback on the VirtualBox process. I am not there to look at what programs you have on your PC, so you need to apply the logic yourself. Look at all non-Microsoft apps on your PC, consider which of them will want to affect other programs.
mhanor
Volunteer
Posts: 321
Joined: 7. Oct 2009, 12:40
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: various

Re: Cannot start vm's anymore. RC=5640

Post by mhanor »

Probably the Citrix software (XenApp, XenDesktop) is intruding into the VirtualBox processes.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Post by mpack »

Well spotted, yes, that seems quite likely.
cortomaltese
Posts: 4
Joined: 29. Jul 2018, 21:17

Re: Cannot start vm's anymore. RC=5640

Post by cortomaltese »

Hello, I have a similar problem, at least I have a similar error message;
4cc.16a0: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume4\Program Files\Oracle\VirtualBox\VirtualBox.exe)
4cc.16a0: SUPR3HardenedMain: Respawn #2
4cc.16a0: Error (rc=-5640):
4cc.16a0: More than one thread in process
4cc.16a0: Error -5640 in supR3HardenedWinReSpawn! (enmWhat=1)
4cc.16a0: More than one thread in process
I am working on a corporate PC Windows 10 Enterprise x64. 6 months ago I was given this PC with VirtualBox version 5.1.30 and I created a new virtual machine which worked succesfully till one week ago. Since then I am not able to run the VM anymore, I suspect that after an update of the WIN10 operating system.
I am working on a corporate PC on the network of the customer so it is not easy for me to uninstall/install software

Though I updated VirtualBox to current version 5.2.16, but I still get this error More than one thread in process

On the PC is running Triton endpoint that I can disable but nothing changed,
Avecto Defendpoint, that I can not disable and which according to the log seem to give problems
Symantec endpoint protection that I can not disable

I enclose the VBoxHardening.log


Can you please help me
Attachments
VBoxHardening.7z
Virtual box log
(6.39 KiB) Downloaded 26 times
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Cannot start vm's anymore. RC=5640

Post by socratis »

cortomaltese wrote:On the PC is running Triton endpoint that I can disable but nothing changed,
Avecto Defendpoint, that I can not disable and which according to the log seem to give problems
Symantec endpoint protection that I can not disable
One of these three is responsible. See if you can put an exception for VirtualBox.
cortomaltese wrote:which worked succesfully till one week ago
See which one of them was updated last week.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
cortomaltese
Posts: 4
Joined: 29. Jul 2018, 21:17

Re: Cannot start vm's anymore. RC=5640

Post by cortomaltese »

Thank you for your suggestion.
Sorry for my ignorance, how can I put an exception for VirtualBox ?
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Cannot start vm's anymore. RC=5640

Post by socratis »

That depends on your software. I honestly have no clue. You have to take a look at each software that's scanning and tell it to leave VirtualBox out of their scan.
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
cortomaltese
Posts: 4
Joined: 29. Jul 2018, 21:17

Re: Cannot start vm's anymore. RC=5640

Post by cortomaltese »

And for my culture, how does the process work ? Why are there multiple threads competing since antivirus, symantec, avecto etc. one way or another will be present ?
Thank you for your explanations
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Cannot start vm's anymore. RC=5640

Post by socratis »

Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
cortomaltese
Posts: 4
Joined: 29. Jul 2018, 21:17

Re: Cannot start vm's anymore. RC=5640

Post by cortomaltese »

Hello, I saw a post created back in may 2016 where teams of virtualbox and avecto were working together to solve this issue;
Quoting the post of June 2016
'm pleased to announce to anyone reading this thread that there is a fix for this issue in the latest client release of Defendpoint.

Please contact whoever is responsible for maintaining and implementing Defendpoint at your company in order to obtain the latest client, version 4.1.255

Currently I am running version 5.1.149 of Avecto Defendpoint Client

Do you have news about it ?
Do I have to address this issue to Avecto (awesome task) ?
Thank you for your support
socratis
Site Moderator
Posts: 27330
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: Cannot start vm's anymore. RC=5640

Post by socratis »

As I said, start uninstalling programs. If you can't, put exceptions for VirtualBox. I'm a simple user (like the rest of us in the forums), I'm not Avecto, Oracle, McAfee, or anything like that. You've got to find the solution on your side I'm afraid...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
funkgun
Posts: 2
Joined: 14. Nov 2018, 18:19

Re: Cannot start vm's anymore. RC=5640

Post by funkgun »

Not sure this is an acceptable solution. I was unable to restart my Ubuntu or Mint VMs due to the same notice.

I changed my network settings to "Not attached" then restarted my Virtualbox instance. They ended up coming back up.
Once the box was up, I changed my network settings back.

Once again, not sure this would work for anyone else.
Post Reply