Cannot start vm's anymore. RC=5640

Discussions related to using VirtualBox on Windows hosts.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Post by mpack »

@funkgun:

Makes sense. Of course it would only be acceptable to people who don't need a network connection.

I imagine that what happens is that your spyware is filtering calls to host OS networking functions. If a new application calls a filtered function then the spyware injects a copy of itself into the application.

Thanks for that observation: if nothing else it certainly provides an interesting verification test that can be performed.
funkgun
Posts: 2
Joined: 14. Nov 2018, 18:19

Re: Cannot start vm's anymore. RC=5640

Post by funkgun »

Yeah, totally don't want to Jeopardize my job, so I am not going to try to remove any programs, but I still need a little Linux in my life.
I believe you are 100% correct.

Good thing was being able to just change the network connections back after the box was back up. So I can still get out, but if I were to do an update to my box, my assumptions is I will have to do the same thing over again.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Cannot start vm's anymore. RC=5640

Post by mpack »

funkgun wrote:Good thing was being able to just change the network connections back after the box was back up.
Another telling observation! I think I'll mention this to the devs. Maybe they can delay initializing the network connection until after they've done the initial hardening check.
dkarr
Posts: 19
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Post by dkarr »

I'm running into this after my Win10 upgrade (although it's RC=-5640). I haven't tried to reinstall VirtualBox. I didn't want to try that just yet. I tried setting the network on the VM to "Not Attached" and saving it, then killing the VirtualBox process and restarting the VM. No effect.
dkarr
Posts: 19
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Post by dkarr »

If it matters, I downloaded version 6 of VirtualBox (had 5 originally), and tried to run the VM from that interface. Gets the same error.

Another developer who has also finished the Win10 upgrade had also installed VirtualBox before the upgrade, and had created a VM. She had installed version 6 originally. After the upgrade, the VM is working fine.
scottgus1
Site Moderator
Posts: 20965
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows, Linux

Re: Cannot start vm's anymore. RC=5640

Post by scottgus1 »

dkarr, you ought to start your own thread. Error -5640 isn't error 5640, there's a lot of difference in the numbers if you look at them in computer binary. See Minimum Info Needed for Assistance when you do start your new thread.
dkarr
Posts: 19
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Post by dkarr »

Uh, yeah, I know 5640 != -5640, even in decimal. However, everything else about this error reported here is identical to what I see. In fact, if you'll notice in the original error reported here, it shows "VERR_SUP_VP_THREAD_NOT_ALONE (-5640)". Note the number in parens. I have no idea why the original reporter cited "5640" instead of "-5640". I think it's likely the original reporter missed the minus sign.
scottgus1
Site Moderator
Posts: 20965
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows, Linux

Re: Cannot start vm's anymore. RC=5640

Post by scottgus1 »

Ah, yes, I see that now. Sorry about that, dkarr. "Read the whole thread", eh? :oops:

Are you still having trouble running your Virtualbox guests? If so, please post the hardening log, zipped, using the forum's Upload Attachment tab, and we'll see what we can do.
dkarr
Posts: 19
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Post by dkarr »

When I select "Show Log ..." in the context menu of my VM, I see one tab labeled "VBoxHardening.log". I selected that, and then clicked "Save" and selected a location to save it. I'm attaching that file, zipped as you request.

Can you tell me exactly what a "hardening log" is? I couldn't find any information from a casual search.
Attachments
ubuntu1604_deskimage-2019-08-30-10-19-12.log.gz
Hardening log
(13.37 KiB) Downloaded 17 times
scottgus1
Site Moderator
Posts: 20965
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows, Linux

Re: Cannot start vm's anymore. RC=5640

Post by scottgus1 »

That's the right log. See Diagnosing VirtualBox Hardening Issues for the skinny on what hardening is & why Virtualbox has to bother with it.

At the end of your hardening log is the exit code 0x1. From the Diagnosing tutorial, this means either a required program to run Virtualbox failed to load or there is "more than one thread in the process". Sure enough, you have:
1798.6084: Error -5640 in supR3HardenedWinReSpawn! (enmWhat=1)
1798.6084: More than one thread in process
The tutorial says for this error:
The usual culprits behind this error are certain kinds of "web safe" internet browser filters or remote desktop applications. Those applications must be uninstalled, or VirtualBox must be added as an exception to their activities.
Looking in the section "supR3HardenedWinFindAdversaries" in the log you have several programs from McAffee, as well as ZoneAlarm End Point Security running. These programs are causing trouble for Virtualbox, See if you can set exceptions in these programs to not scan Virtualbox programs, or as an experiment, try uninstalling them to see if Virtualbox can run then. (Note that often a mere disable will not be enough, an uninstall & reboot may be required.)
dkarr
Posts: 19
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Post by dkarr »

Thanks for that analysis, although it just confirms what I already assumed, that our security scanners are causing it. I'll have to wait for my escalated ticket to be handled by the people who have permission to request changes to that.

What's confusing to me is that I'm aware of one other user on my team who has a similar configuration, but she does not see this error. The only differences I'm aware of is that her first install of VirtualBox was version 6.x, and her VM is Ubuntu 18. My VM is Ubuntu 16, which I originally created with VIrtualBox 5.x. If I'm unable to get exceptions for the security scanners (which unfortunately is likely), do you think I could possibly have better luck creating a new VM, and perhaps Ubuntu 18? I'm not going to do that as an experiment unless I have a reasonable certainty of success. I would have to delete my existing VM and vdi file in order to have enough space on my laptop disk.
scottgus1
Site Moderator
Posts: 20965
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows, Linux

Re: Cannot start vm's anymore. RC=5640

Post by scottgus1 »

dkarr wrote:do you think I could possibly have better luck creating a new VM, and perhaps Ubuntu 18?
I doubt it. I believe the hardening checks have to pass before the VM can start executing guest OS code. (Mostly, some hardening checks continue after the guest starts, but I think you'd need a clean exit code 0x0 in the hardening log.) I may be wrong....

There may be some minor differences in the two host PCs and/or versions of the 3rd-part software, so your co-worker's works and yours doesn't. If it interferes with work, maybe your boss can escalate the ticket?
dkarr
Posts: 19
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Post by dkarr »

One thing I can do is work with that other team member who is not seeing this symptom, and get her hardening log, and compare it to mine. I'll try to do that on Tuesday.
dkarr
Posts: 19
Joined: 2. Oct 2011, 20:13
Primary OS: MS Windows 10
VBox Version: OSE other
Guest OSses: Ubuntu

Re: Cannot start vm's anymore. RC=5640

Post by dkarr »

This is the hardening log from the other user who is not having this symptom. I briefly compared this one to mine, and I see that I can't find "ZoneAlarm" in her log.
Attachments
ubuntu1804_deskimage-2019-07-25-13-06-32-manjula.log.gz
(25.03 KiB) Downloaded 18 times
scottgus1
Site Moderator
Posts: 20965
Joined: 30. Dec 2009, 20:14
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows, Linux

Re: Cannot start vm's anymore. RC=5640

Post by scottgus1 »

Yep, no ZoneAlarm & an exit code of 0x0. Maybe there's a way to set an exception in ZoneAlarm for Virtualbox?
Post Reply