SUPR3HARDNTCHILDPURIFY 5637

[APKVIRTUALBOX]

Hi! When I start my VM Windows XP, I get this error message:

"supHardenedWinVerifyProcess failed with VERR_SUP_VP_NT_QI_VIRTUAL_MEMORY_ERROR: (rc=-5637)
where: supR3HardNtChildPurify what: 5 VERR_SUP_VP_NT_QI_VIRTUAL_MEMORY_ERROR (-5637) - Process Verification Failure: Error query virtual memory information."

Here is information about this error in "Security & Maintenance":

Problem event name: BEX64
Application name: VirtualBoxVM.exe
Application version: 7.0.12.9484
Application timestamp: 652832c2
Form name with errors: Qt5CoreVBox.dll
Form version with errors: 5.15.2.0
Form timestamp with errors: 606c96da
Exception offset: 000000000001fe38
Exception code: c0000409
Exception data: 0000000000000007
SO Version: Windows 10.0.19042.2.0.0.256.48
Local settings ID: 1040
Additional information 1: a707
Further information 2: a7076bddca6edd333d6cbd4421dd27ee
Further information 3: f75d
Further information 4: f75d6d22fb9320898cc2627a61eeff40

And here's a final part of VBOXHardening.log:

3ac4.43b0: supR3HardenedWinSetupChildInit: Start child.
3ac4.43b0: supR3HardNtChildWaitFor: Found expected request 0 (PurifyChildAndCloseHandles) after 0 ms.
3ac4.43b0: supR3HardNtChildPurify: Startup delay kludge #1/0: 521 ms, 31 sleeps
3ac4.43b0: supHardNtVpScanVirtualMemory: enmKind=CHILD_PURIFICATION
3ac4.43b0: Error (rc=-5637):
3ac4.43b0: NtQueryVirtualMemory failed for 0000000000000000: 0xc000010a
3ac4.43b0: Error (rc=-5637):
3ac4.43b0: supHardenedWinVerifyProcess failed with -5637: NtQueryVirtualMemory failed for 0000000000000000: 0xc000010a
3ac4.43b0: Error -5637 in supR3HardNtChildPurify! (enmWhat=5)
3ac4.43b0: supHardenedWinVerifyProcess failed with -5637: NtQueryVirtualMemory failed for 0000000000000000: 0xc000010a
3ac4.43b0: supR3HardNtEnableThreadCreationEx:

And here's a VBOXHardening.log entire file log. I hope this will be helpful in understanding what is causing this error problem. Thanks!

[mpack]

See FAQ: Diagnosing VirtualBox Hardening Issues.

You have superfluous third party AntiVirus installed. Specifically MalwareBytes.

[APKVIRTUALBOX]

How is it possible? Until a few months ago, VirtualBox worked great with MalwareBytes installed. And now why did he do this? I have read that VirtualBox doesn't work because it is triggered by certain AntiVirus programs (as in the case of TrendMicro), but with MalwareBytes it is absurd and impossible... until today! In this case, however, does MalwareBytes have to be deactivated or do I even have to uninstall it to make the Windows XP VM work on VirtualBox?

[mpack]

See the FAQ.

To give my blunt IMO: you don't need Malwarebytes. Windows 10 is not Windows 95. It needs no third party help in the security dept. On the contrary, installing third party code with that level of access when you really don't have to - is a really dumb risk.

[APKVIRTUALBOX]

I've tried to uninstall MalwareBytes and VirtualBox and reinstall this last, but I get same 5637 error message. In any case I will try to uninstall VirtualBox and restart the computer so that the VM restarts again.

[APKVIRTUALBOX]

Nothing to do, I still get the same message as before! How should I do it? I need assistance with this problem, I can't wait any longer!

[APKVIRTUALBOX]

See FAQ: Diagnosing VirtualBox Hardening Issues.

You have superfluous third party AntiVirus installed. Specifically MalwareBytes.

In this case, it's not MalwareBytes because there application aren't open at Windows start.

[mpack]

If you want further comments we need to see a new zipped log.

[APKVIRTUALBOX]

Here's a new VBOXHardening.log update.

[mpack]

Apparantly you missed the part about using zip, and instead provided only a part of the log.

[APKVIRTUALBOX]

This is ZIP version of LOG file.

[fth0]

There is still some software running on your host OS that is invading the memory of the VirtualBoxVM process and intercepting Windows function calls. VirtualBox couldn't identify any such software in your latest log files. Typical candidates are so-called security software and malware.

[APKVIRTUALBOX]

The only way is to change the virtual machine and remove VirtualBox because if this is the case and it is impossible to locate it, then it is unusable. In this case I will switch to Hyper-V hoping that it can also open files with the VBox extension. And to think that VM Windows XP used to run via VBox and is now a useless VM.

[mpack]

That's fine by us. We're all users here, we have no stake in your choices.