Hardening Error after Upgrade to 6.0 TrendMicro VirusScan

[BaboM]

After upgrading to Version 6.0, i cannot start VMs anymore.
In the Hardening Log i can see TrendMicro Dlls. Its not an option to uninstall the Virusscan.

In Version 5.2 everything works fine.

Error Code: E_FAIL (0x80004005)
Komponente: MachineWrap
Interface: IMachine {5047460a-265d-4538-b23e-ddba5fb84976}

[mpack]

FAQ: Diagnosing VirtualBox Hardening Issues.

If it is truly not an option to provide an execution environment which is compatible with VirtualBox, then uninstall VirtualBox.

[vdir]

Same issue. Got it working by opening the TM Agent, clicking Settings (gear icon on bottom) -> Protection -> Trusted Programs List and adding VirtualBoxVM.exe to the list.

[Greg Bailey]

Just upgraded from VirtualBox 5.2.22 to the new 6.0.0 version, and am unable to launch any VMs with a graphical display.

Starting a headless VM (via "vagrant") appeared to work OK.

I've performed full uninstall / reboot / reinstall after the initial failure, and the same error persists.

I don't have an easy way to disable Trend since my Windows 10 workstation is "managed" by my organization, although I've reached out for help there as well.

I'm attaching a ZIP file containing VBoxHardening.log files from both the 5.2.22 and 6.0.0 versions.

[BuddOvit]

You are not alone

I've got exactly the same issue. Hardening log is pretty much identical to yours. Also running Trend Micro managed by the organisation.

[socratis]

@Greg Bailey, @BuddOvit
I merged your topic with an existing one talking about the same thing. Read the thread (and the solution) from the beginning please...

It helps if you search before creating a new topic, make my life easier and yours less complicated...

[poshcodebear]

I'm running into the same problem, also have Trend Micro, and also have no option to uninstall due to company policy (and a different department manages the AV, so I can't add exceptions for it). Thanks to Greg Bailey's comment about headless launch, I tried to launch one of my servers in headless mode (using the downward drop-down arrow next to the "Start" button), which worked, AND I was able to attach to it by hitting the "Start" (now changed to "Show") button.

Considering this was working fine in 5.22 and previous, and the only change was upgrading to 6.0, either VirtualBox turned up the hardening past a point Trend Micro isn't yet compatible with (have additional hardening features been activated in the new release?), or we all had an exclusion list that included VirtualBox in Trend Micro and it doesn't recognize the new executables.

Or it's a bug and the new version just doesn't like Trend (I'd get rid of it and stick with Windows Defender if my company would let me; I'm sure most of us would).

Anyway, that means we have a functioning workaround (at least, it works for me) until this gets fixed (either by Trend Micro, Oracle, or our individual IT departments, depending on what the root cause is).

Workaround steps:
(repeated as bullet list to make it easier for people to find when scanning through the replies)

1. Click the downward arrow next to the Start arrow
2. Select Headless start
3. Click on the Show button to bring up the console window

I hope this helps!

[socratis]

@poshcodebear
Do you mind posting a VBox.log and a VBoxhardening.log from a Normal start when it fails? ZIPPED...

[buker]

I experience the same problem. I use VirtualBox 6.0.2 r128162 (Qt5.6.2) and Trend Micro OfficeScan 12.0.5261.
I'm attaching VboxHardening.log

[GregB169]

Hello

I have upgraded several times from the 5.2 branch to the 6.x branch and cannot get VMs to either build or start if they were built under 5.2. I have my local IT team add exemptions to see if my AV, Trend Micro, was the issue.

Attached is my vBox Hardening log to see if there is something else that I am missing.

Thanks

Greg

[socratis]

4f80.4758: supR3HardenedWinFindAdversaries: 0x8
4f80.4758: \SystemRoot\System32\drivers\tmcomm.sys:
...
4f80.4758:     FileDescription: TrendMicro Common Module

Please read really carefully the following FAQ: Diagnosing VirtualBox Hardening Issues for some generic guidelines/ideas.

I'm merging your topic with the other posts that deal with TrendMicro and I'm going to make it a sticky until this is resolved.

[TomSmi]

Hi, I had simiar issues with VirtualBox and TrendMicro OfficeScan.
Adding those exceptions to TM OS allowed me to run VMs in VirtualBox Again:

C:\Windows\System32\ntdll.dll
C:\Windows\System32\kernel32.dll
C:\Windows\System32\KernelBase.dll
C:\Windows\System32\apisetschema.dll
C:\Windows\System32\apisetschema.dlC:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe

--
Best regards,
Tom

[socratis]

@Tom,
I don't think that the system DLLs are necessary. Just the "C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" is required.

[TomSmi]

@socratis, you're right!
Thanks for help.

[GregB169]

The path update was the issue for me. Not sure why Trend is not allowing this but adding this to the exclusion list worked. "C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe"