[Solved] VERR_INVALID_NAME with HP Sure Sense

[sgadsby]

Hi guys,

Just a heads up since this has caught me out more than once. Yesterday VMs ran fine and this morning they didn't. Got the following error:

Please try reinstalling VirtualBox.
where: supR3HardenedWinReSpawn what: 5 VERR_INVALID_NAME (-104) -
Invalid (malformed) file/path name.

The VBoxHardening.log contains stuff like this which did not seem very helpful:

Code: Select all

1158.2934: supHardenedWinVerifyImageByHandle: -> 0 (\Device\HarddiskVolume3\Windows\System32\ntdll.dll)
1158.2934: supR3HardenedWinVerifyCacheInsert: \Device\HarddiskVolume3\Windows\System32\ntdll.dll
1158.2934: supR3HardenedWinVerifyCacheProcessImportTodos: Processing 'rpcrt4.dll'...
1158.2934: supR3HardenedWinVerifyCacheProcessImportTodos: 'rpcrt4.dll' -> '\Device\HarddiskVolume3\Windows\System32\rpcrt4.dll' [rcNtRedir=0xc0150008]
1158.2934: supR3HardenedScreenImage/Imports: cache hit (VINF_SUCCESS) on \Device\HarddiskVolume3\Windows\System32\rpcrt4.dll [lacks WinVerifyTrust]
1158.2934: supR3HardenedMonitor_LdrLoadDll: pName=C:\WINDOWS\System32\ntdll.dll (Input=ntdll.dll, rcNtResolve=0xc0150008) *pfFlags=0x0 pwszSearchPath=0000000000000801:<flags> [calling]
1158.2934: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ff9a6620000 'C:\WINDOWS\System32\ntdll.dll'
1158.2934: Error -104 in supR3HardenedWinReSpawn! (enmWhat=5)
1158.2934: Error relaunching VirtualBox VM process: 5

I checked what had been installed recently and noted that HP Sure Sense was updated. HP Sure Sense is an HP anti-malware product pre-installed on recent HP business models. It includes an Enhanced Threat Protection mode that utilises a hypervisor. This hypervisor conflicts with VirtualBox.

Solution is to disable Enhanced Threat Protection, or uninstall the product. Annoyingly it appears to keep re-enabling this setting periodically when it updates itself, which it does silently in the background, so I need to remember to check it.

Cheers,
Simon.

Capture.PNG (21.95 KiB) Viewed 16237 times

[scottgus1]

Thanks, sgadsby, for reporting what you found! This will come in handy for someone.

Often the hardening log looks like gibberish, but it does mean something. Exactly what is only known by a couple of the developers, and they play those cards extremely close to the chest, so the bad guys can't turn Virtualbox into a major malware vector.

There's a few places that the forum gurus have identified as indicators of where the problem might be. You can see what they've discovered in Diagnosing VirtualBox Hardening Issues.

[DaveO]

Thank you! This exactly fixed the issue. I didn't realize the setting got re-set when it was updated which kept biting me. Riddle solved!

Dave O

[Marc.BT]

Thanks, sgadsby, for reporting what you found!

Exactly my issue !!