Cannot start vm's anymore. RC=5640

Discussions related to using VirtualBox on Windows hosts.

Re: Cannot start vm's anymore. RC=5640

Postby mpack » 14. Nov 2018, 18:34

@funkgun:

Makes sense. Of course it would only be acceptable to people who don't need a network connection.

I imagine that what happens is that your spyware is filtering calls to host OS networking functions. If a new application calls a filtered function then the spyware injects a copy of itself into the application.

Thanks for that observation: if nothing else it certainly provides an interesting verification test that can be performed.
mpack
Site Moderator
 
Posts: 29977
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Postby funkgun » 14. Nov 2018, 18:41

Yeah, totally don't want to Jeopardize my job, so I am not going to try to remove any programs, but I still need a little Linux in my life.
I believe you are 100% correct.

Good thing was being able to just change the network connections back after the box was back up. So I can still get out, but if I were to do an update to my box, my assumptions is I will have to do the same thing over again.
funkgun
 
Posts: 2
Joined: 14. Nov 2018, 18:19

Re: Cannot start vm's anymore. RC=5640

Postby mpack » 14. Nov 2018, 19:12

funkgun wrote:Good thing was being able to just change the network connections back after the box was back up.

Another telling observation! I think I'll mention this to the devs. Maybe they can delay initializing the network connection until after they've done the initial hardening check.
mpack
Site Moderator
 
Posts: 29977
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Postby dkarr » 29. Aug 2019, 23:00

I'm running into this after my Win10 upgrade (although it's RC=-5640). I haven't tried to reinstall VirtualBox. I didn't want to try that just yet. I tried setting the network on the VM to "Not Attached" and saving it, then killing the VirtualBox process and restarting the VM. No effect.
dkarr
 
Posts: 17
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Postby dkarr » 30. Aug 2019, 22:40

If it matters, I downloaded version 6 of VirtualBox (had 5 originally), and tried to run the VM from that interface. Gets the same error.

Another developer who has also finished the Win10 upgrade had also installed VirtualBox before the upgrade, and had created a VM. She had installed version 6 originally. After the upgrade, the VM is working fine.
dkarr
 
Posts: 17
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Postby scottgus1 » 31. Aug 2019, 14:16

dkarr, you ought to start your own thread. Error -5640 isn't error 5640, there's a lot of difference in the numbers if you look at them in computer binary. See Minimum Info Needed for Assistance when you do start your new thread.
Human government is like that crazy uncle who hides a quarter in his fist behind his back, then asks you to guess which fist the quarter is in...
No matter which side you choose, Left or Right, both Sides are empty.
scottgus1
Volunteer
 
Posts: 4751
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Win7

Re: Cannot start vm's anymore. RC=5640

Postby dkarr » 31. Aug 2019, 18:35

Uh, yeah, I know 5640 != -5640, even in decimal. However, everything else about this error reported here is identical to what I see. In fact, if you'll notice in the original error reported here, it shows "VERR_SUP_VP_THREAD_NOT_ALONE (-5640)". Note the number in parens. I have no idea why the original reporter cited "5640" instead of "-5640". I think it's likely the original reporter missed the minus sign.
dkarr
 
Posts: 17
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Postby scottgus1 » 31. Aug 2019, 19:17

Ah, yes, I see that now. Sorry about that, dkarr. "Read the whole thread", eh? :oops:

Are you still having trouble running your Virtualbox guests? If so, please post the hardening log, zipped, using the forum's Upload Attachment tab, and we'll see what we can do.
Human government is like that crazy uncle who hides a quarter in his fist behind his back, then asks you to guess which fist the quarter is in...
No matter which side you choose, Left or Right, both Sides are empty.
scottgus1
Volunteer
 
Posts: 4751
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Win7

Re: Cannot start vm's anymore. RC=5640

Postby dkarr » 31. Aug 2019, 19:34

When I select "Show Log ..." in the context menu of my VM, I see one tab labeled "VBoxHardening.log". I selected that, and then clicked "Save" and selected a location to save it. I'm attaching that file, zipped as you request.

Can you tell me exactly what a "hardening log" is? I couldn't find any information from a casual search.
Attachments
ubuntu1604_deskimage-2019-08-30-10-19-12.log.gz
Hardening log
(13.37 KiB) Downloaded 9 times
dkarr
 
Posts: 17
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Postby scottgus1 » 31. Aug 2019, 19:50

That's the right log. See Diagnosing VirtualBox Hardening Issues for the skinny on what hardening is & why Virtualbox has to bother with it.

At the end of your hardening log is the exit code 0x1. From the Diagnosing tutorial, this means either a required program to run Virtualbox failed to load or there is "more than one thread in the process". Sure enough, you have:
1798.6084: Error -5640 in supR3HardenedWinReSpawn! (enmWhat=1)
1798.6084: More than one thread in process


The tutorial says for this error:
The usual culprits behind this error are certain kinds of "web safe" internet browser filters or remote desktop applications. Those applications must be uninstalled, or VirtualBox must be added as an exception to their activities.


Looking in the section "supR3HardenedWinFindAdversaries" in the log you have several programs from McAffee, as well as ZoneAlarm End Point Security running. These programs are causing trouble for Virtualbox, See if you can set exceptions in these programs to not scan Virtualbox programs, or as an experiment, try uninstalling them to see if Virtualbox can run then. (Note that often a mere disable will not be enough, an uninstall & reboot may be required.)
Human government is like that crazy uncle who hides a quarter in his fist behind his back, then asks you to guess which fist the quarter is in...
No matter which side you choose, Left or Right, both Sides are empty.
scottgus1
Volunteer
 
Posts: 4751
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Win7

Re: Cannot start vm's anymore. RC=5640

Postby dkarr » 31. Aug 2019, 20:49

Thanks for that analysis, although it just confirms what I already assumed, that our security scanners are causing it. I'll have to wait for my escalated ticket to be handled by the people who have permission to request changes to that.

What's confusing to me is that I'm aware of one other user on my team who has a similar configuration, but she does not see this error. The only differences I'm aware of is that her first install of VirtualBox was version 6.x, and her VM is Ubuntu 18. My VM is Ubuntu 16, which I originally created with VIrtualBox 5.x. If I'm unable to get exceptions for the security scanners (which unfortunately is likely), do you think I could possibly have better luck creating a new VM, and perhaps Ubuntu 18? I'm not going to do that as an experiment unless I have a reasonable certainty of success. I would have to delete my existing VM and vdi file in order to have enough space on my laptop disk.
dkarr
 
Posts: 17
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Postby scottgus1 » 31. Aug 2019, 21:49

dkarr wrote:do you think I could possibly have better luck creating a new VM, and perhaps Ubuntu 18?

I doubt it. I believe the hardening checks have to pass before the VM can start executing guest OS code. (Mostly, some hardening checks continue after the guest starts, but I think you'd need a clean exit code 0x0 in the hardening log.) I may be wrong....

There may be some minor differences in the two host PCs and/or versions of the 3rd-part software, so your co-worker's works and yours doesn't. If it interferes with work, maybe your boss can escalate the ticket?
Human government is like that crazy uncle who hides a quarter in his fist behind his back, then asks you to guess which fist the quarter is in...
No matter which side you choose, Left or Right, both Sides are empty.
scottgus1
Volunteer
 
Posts: 4751
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Win7

Re: Cannot start vm's anymore. RC=5640

Postby dkarr » 1. Sep 2019, 16:20

One thing I can do is work with that other team member who is not seeing this symptom, and get her hardening log, and compare it to mine. I'll try to do that on Tuesday.
dkarr
 
Posts: 17
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Postby dkarr » 3. Sep 2019, 19:24

This is the hardening log from the other user who is not having this symptom. I briefly compared this one to mine, and I see that I can't find "ZoneAlarm" in her log.
Attachments
ubuntu1804_deskimage-2019-07-25-13-06-32-manjula.log.gz
(25.03 KiB) Downloaded 9 times
dkarr
 
Posts: 17
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Postby scottgus1 » 3. Sep 2019, 20:06

Yep, no ZoneAlarm & an exit code of 0x0. Maybe there's a way to set an exception in ZoneAlarm for Virtualbox?
Human government is like that crazy uncle who hides a quarter in his fist behind his back, then asks you to guess which fist the quarter is in...
No matter which side you choose, Left or Right, both Sides are empty.
scottgus1
Volunteer
 
Posts: 4751
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Win7

PreviousNext

Return to VirtualBox on Windows Hosts

Who is online

Users browsing this forum: No registered users and 24 guests