Virtualbox problem with Trusteer Rapport

[socratis]

---

ModEdit; Please see the workaround provided by the IBM Security Trusteer Technical Support.

---

I often use various technical forums but rarely contribute. However as I think I've found a new Virtualbox failure situation and a solution I thought I'd add it here.

I've just spent a couple of days becoming increasingly frustrated with Virtual box not loading a Win XP virtual machine. I've been using Virtual box for running a couple of quite expensive to replace programs that do not run on Win 7. Until recently I've had no problems at all and was still using Virtualbox 4. I clearly changed something. This could have been a Windows update, but I suspect it was something else. I had all the references others have reported to log files and hardening.

After much unloading and loading of Virtual box I suddenly had a feeling that the problem might have started when I installed the Rapport extension to work with Firefox.

To cut a long story to the essentials if you unload (not simply deactivate) Rapport Virtualbox 5.2.12 works fine. The unloading and reloading of Rapport is fortunately quite quick.

For anybody not familiar with Trusteer Rapport, it is a program widely supported by banking companies that checks the integrity of the connection between your PC and primarily banking websites, although you can use it for any website. I've never had a defective connection flagged but it is supposed to ensure you have not been rerouted via somebody who is interested in your login details. It does quite a lot more as well.

[andyp73]

There are plenty of postings about the forums about Trusteer Rapport. Their 1st June 2018 update broke something. They are aware of it and hopefully will fix it soon.

-Andy.

[Monstercarp]

Thanks Andy

All I can say is over the last couple of days I spent a long time searching the internet and came across absolutely nothing that mentioned Rapport. Hopefully a less onerous solution will arise in the near future. I actually first noticed the problem on May 22nd but didn't do anything about until recently when a Revenue filing deadline was rapidly approaching.

[socratis]

I spent a long time searching the internet and came across absolutely nothing that mentioned Rapport.

Which is why I changed the title of your post to be a little bit more generic to cover all VMs, moved it to "Windows Hosts", and I made it a Sticky (shows up in front of the other posts) until this is resolved.

[BitUser]

Socratis, thank you so much. The problem was indeed IBM Rapport. I've just uninstalled Rapport and now everything is working fine with Virtual Box.

[Boxster1971]

Socratis, thank you for making this thread a sticky. Ive been chasing this problem for several weeks and found this thread tonight.
Agree problem was indeed caused by IBM Trusteer prpogram. I've just uninstalled my Trusteer program and now everything is working fine with Virtual Box.

I had Trusteer Endpoint Protection installed on my Windows 7-64 Host running a legacy Windows XP Machine I've been using for years. It was updated in early June. I only use my VirtualBox occasionally as it is not mission critical. In mid June when I tried to use the VirtualBox it crashed for a Hardening error. Unloading Trusteer Endpoint Protection was a little involved and ultimately directed me to an IBM web page to enter a reason why I removed it. I sent IBM the problem - hopefully they will get this fixed.

Not sure what the difference is between Trusteer Endpoint Protection and Trustee Rapport. From what I could find they are the same thing.

[marki]

Thanks to your posts I have also found that Trusteer Endpoint was the cause of my 'hardening' error on Windows 7 host. All had been well up to a month or so ago.
I have now uninstalled it as well as reporting to IBM as a problem.

[forumsergio29]

Hi,
Thanks for your workaround (disable Trusted rapport). It works, but after a reboot of the PC I had the same problem : I can't start my VMs.
I tried the last version of VirtualBox Version 5.2.18 r124319 (Qt5.6.2) : same problem
Any ideas?

[socratis]

@forumsergio29
Since you don't think that this it Trusteer Rapport related, please open a new thread. Post in there a ZIPPED version of the VBoxHardening.log for the VM that failed, after a "VirtualBox start" / "VM failed attempt" / "VirtualBox quit".

[socratis]

All,

I had the same issue with virtualbox (latest version) and I unable to start any of my VM's as it reports a hardening issue.

After many hours googling the issue, the finger of suspicion was pointing to Trusteer Rapport which is software strongly recommended by my bank for safer online banking. I uninstalled the software and the VM's now all start. I reinstalled the rapport software and initially the VM's continued to start but within a day they started to fail again.

Looking at the Trusteer website very little support information was available. However, I logged a support ticket and surprisingly received a response within the hour and the suggested "workaround". This is a know problem by Trusteer Support:

Dear Nick,

Thank you for contacting IBM Security Trusteer Technical Support.

The issue you have reported may be related to Rapport Cerberus, one of Rapport's Anti-malware protection mechanisms.
To verify this, please try to disable Rapport Cerberus in Safe Mode and let us know if the issue is resolved.

To do so, please follow the below instructions (we recommend writing them down before restarting your computer):

1. Open the Run command box by pressing the 'Windows' key + 'R' on your keyboard simultaneously.
2. Type: "msconfig" and click on OK.
3. Under System Configuration, select the Boot tab.
4. Check the box next to Safe Boot and choose the Network option under Boot Options.
5. Click on OK.
6. Restart your PC to enter Safe Mode automatically.
7. Log on to your computer with a user account that has administrator rights.
8. Open the Run command box by pressing the 'Windows' and 'R' keys on your keyboard simultaneously (alternatively, click Start > Programs > Accessories > Run).
9. Enter the following directory:
   C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus
10. Locate and open the folder named 'Baseline'.
11. Re-name all system files named 'RapportCerberus.sys' so that their names will contain an underscore first (e.g. '_RapportCerberus00_00000.sys'). Do not re-name files which do not end with '.sys'.
12. Follow steps 1-3 to get to your 'System Configuration' again, then un-check 'Safe Boot'
13. Restart your PC to exit safe mode.

Please note, these steps are temporary as part of our investigation. Please notify us regarding the results so we can provide you with a permanent solution.

Thank you for your cooperation.

Should you need additional assistance, feel free to contact us by submitting the following form:
We also have helpful information available in our FAQ:
Sincerely,

I suggest you try this as it fixed my issue or log a support ticket with Trusteer. This is not a virtualbox software issue.

I hope this helps

Regards

Nick Holmes

[socratis]

Great, thanks for the feedback Nick! I'll amend the first post to point to the reply that you received from IBM.

[firlas]

If you have IBM Security Trusteer Rapport installed, then you will have problems to
start any virtual machine, in most cases a hardening problem will occur.
For any Oracle VirtualBox hardening problem, uninstall IBM Security Trusteer Rapport.
After 3 months searching for a solution, I found the solution on the Kaspersky support site.

[socratis]

After 3 monts searching for a solution, I found the solution on the Kaspersky support site.

Impressive! Well, funny thing... there is a sticky post here as well (with a workaround), in the "Windows Hosts" section (Virtualbox problem with Trusteer Rapport), which is where I'm going to merge your post into.

[Monstercarp]

As I pointed out in the first post it is essential to unload Virtual Box not simply disable it as a contributor here suggested.

I assume from the absence of any response from IBM being mentioned on this forum that the failure to load VMs under virtualbox has not changed. Tiresome.

[socratis]

I assume from the absence of any response from IBM being mentioned on this forum

Are you kidding, or you didn't read the edited part of your original post?
The part that talks about the workaround provided by IBM Security Trusteer Technical Support?