4.3.20 doesn't start virtual machines any more (supHardenedWinVerifyProcess failed)

[JackyRyan]

Hi, yesterday I upgraded from 4.3.12 to 4.3.20 r96997 and every virtual machine on my Win7-32bit SP1 Enterprise Host hangs on startup with this messages (see screenshots):

Error in supR3HardNtChildPurify: supHardenedWinVerifyProcess failed with VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED: (rc=-5673)

I executed KB3024777-x86.exe to remove KB3004394 but it doesn't seem to do anything. In system control, programs, "installed updates" I can't find KB3004394.

It would be great to get some help on this issue! If you need any further information about it I'll provide it:-) Thanks in advance.

[JackyRyan]

Machine 2

[JackyRyan]

Machine 2

[JackyRyan]

After 3 weeks... any idea? Would be great to get a reply from you. Did you plan a new version soon?

[Frank Mehnert]

Which virus scanning application do you have installed? Is that software up-to-date?

[JackyRyan]

I've got the latest version of Trend Micro OfficeScan (cannot deactivate because it's a business computer).

Now I installed Virtualbox 4.3.22 and it's just the same. It seems this bug isn't fixed with the new version.

Is there anything I can do / check / test?

[Henson]

Same issue with 4.3.24. Running Windows 7 SP1 64-bit with Symantec Endpoint Protection.

[forderud]

Same issue with 4.3.28 and 4.3.29-100833 (latest test build). Running Windows 7 SP1 x64 (fully patched) with McAfee anti-virus & firewall.

[forderud]

Same issue with 5.0.0 r101573. Running Windows 7 SP1 x64 (fully patched) with McAfee anti-virus & firewall.

[Rajasekhar]

Same issue with Vbox 5.0 , Running on Win 7 SP1 X64 Eneterprise with TrendMicro Anti Virus

[Anh Ta]

Same issue with Vbox 5.0 , Running on Win 7 SP1 X64 Eneterprise with TrendMicro Anti Virus

[slsh]

The only workaround I've found is to go back to 4.3.12 from https://www.virtualbox.org/wiki/Download_Old_Builds

That works flawlessly. Apparently versions after that have "hardened security" meaning it seems to crash with several antivirus software.

[piotr_kowalkowski]

I have the same problem as mentioned here. Is this really the only one option to go back to 4.3.12? Seriously? I need usb 3.0 support and this was added finally in 5.0 version. Please help!

[Frank Mehnert]

The solution is to use the most recent VBox 5.0.x release. Any hardening issues need to be debugged. As starting point, attach the VBoxHardening.log file for the failing sessions.

[Bugfinder]

This is still the same in 5.0.14.105127 today..

[freealx]

5.0.16r105871

[freealx]

It's really impressive how stable is moved this bug across the different versions I just gave a try to v5.0.16r105871 and it's still presented... the log file is attached.

The solution is obviously to use the last well working version, since nobody is trying to fix the most recent ;-)

[freealx]

btw, the last well working (at least for me) is v4.3.12r93733

[dheater]

Failing with 5.0.20: Failed to open a session for the virtual machine precise64_default_1463073156221_41510.

The virtual machine 'precise64_default_1463073156221_41510' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'C:\Users\502618458\VirtualBox VMs\precise64_default_1463073156221_41510\Logs\VBoxHardening.log'.

Result Code: E_FAIL (0x80004005) Component: MachineWrap Interface: IMachine {f30138d4-e5ea-4b3a-8858-a059de4c93fd}

AV info:
System Information  
Computer Name: G13G3Q72E 
   
McAfee Host Intrusion Prevention  
Version number: 8.0 
Build date: Wednesday, June 10, 2015 
Build Number: 8.0.0.3363 
License Type: Licensed 
Expiration Date  
Language: Automatic 
Security Content Version: 8.0.0.6952 
Security Content Created On: Tuesday, May 03, 2016 
Patch: 6 
   
   
McAfee Agent  
Version number: 4.8.0.1938 
Managed  
Last security update check: 5/12/2016 12:22:16 PM 
Last agent-to-server communication: 5/12/2016 12:39:14 PM 
Agent to Server Communication Interval (every): 3 hours 
Policy Enforcement Interval (every): 30 minutes 
Agent ID: {7E8F0B53-DBCF-45A7-80B2-4697C655A54A} 
ePO Server/Agent Handler  
DNS Name: americas2.epo.blue.ge.com 
IP Address: 3.49.168.143 
Port Number: 9443 
   
   
McAfee Drive Encryption Agent  
Version number: 7.1.3.547 
Language: Multiple 
   
   
McAfee Drive Encryption  
Version number: 7.1.3.547 
   
   
McAfee GTI Proxy Agent  
Version number: 2.0.0.633 
Language: English (United States) 
   
   
McAfee VirusScan Enterprise + AntiSpyware Enterprise  
Version number: 8.8.0 (8.8.0.1445) 
Build date: 8/21/2015 
   
Anti-virus License Type: licensed 
   
Scan engine version (32-bit): 5800.7501 
   
Scan engine version (64-bit): 5800.7501 
   
DAT version: 8162.0000 
DAT Created on: 5/11/2016 
   
Number of Signatures in extra.dat: 1 
Name of threats that extra.dat can detect:   
 EICAR test file (ED) 
Buffer Overflow and Access Protection DAT version: 700 
   
Installed Patches: 6 
   
Installed Modules:  
   
  
Copyright © 1995-2015 McAfee, Inc.  
All Rights Reserved.  
www.mcafee.com  

[gnash.s]

+1. Still Failing with 5.0.20. Went back 4.3.12 as someone suggested here. How is this not being addressed yet? over 18mos now. Please address.

[RIckDavis]

Oracle's fix for the problem in Virtual Box version 5.1 was to add additional rhetoric to the error dialog box blaming your virus-scanning software and saying that your scanner has a "fatal" bug.

A better approach (IMHO) would have been either to: (1) petition Trend Micro and McAfee to put VirtualBox versions > 4.3.12 on an amnesty list, or (2) to make it possible to switch-off the supHardenedWinVerifyProcess feature in VirtualBox, on Windows, where necessary.

[Nemess_]

I have the same problem with VirtualBox 5.1.4 on Windows 7. I think, this problem is not related to the Virus scanner software. I tested on 3 computers in our company environment. All of them have the same image with the same McAfee configurations.

Dell laptop: Windows 7 64-bit, Intel Core i5-4310 (4 core) CPU 8 GB RAM => Works

HP-Z820 : Windows 7 64-bit, Intel Xeon E5-2640 (2x6 core) 32 GB RAM => Works

HP-Z840 : Windows 7 64-bit, Intel Xeon E5-2620v3 (2x6 core) 64 GB RAM => NOT WORKING.

With HP-Z840 computer McAffee was uninstalled, and still the same error was pop-up.

[Corsair]

This is still the same in 5.1.4-110228 today..

[aiv]

Experiencing problem with Version 5.1.14 r112924.

[leonsy]

The issue is still there. I used the following versions: VirtualBox-5.1.22-115126-Win & VirtualBox-5.1.26-117224-Win. Finally I'm now switching to VirtualBox-4.3.12-93733-Win

[Erich9O)92384923804938]

Does somebody know if the new beta release 5.2 has still this annoying bug ? It would also be very nice if somebody from Oracle could drop a comment if they have any intention to release a version without this problem.

[Socratis]

This is not an annoying bug, it's a security feature, which I personally believe that it is never going to go away. You can talk to vendors that ship unsigned DLLs and want to inject themselves to other processes' memory.

Please read the FAQ: ​Diagnosing VirtualBox Hardening Issues to better understand what's going on.

[Klaus Espenlaub]

Correct. Hardening is not going to go away in the foreseeable future. Any software which injects itself into a VM process needs to meet very high security standards, otherwise VirtualBox will refuse to run. The issues with most AV software is sorted these days (and if there are issues, please report them), so what remains is some random software which can't keep its fingers away from stuff it has no business with. This is usually mentioned in VBoxHardening.log, so without having this log file together with the problem report we can't do anything, not even help pinpointing the software which interferes.

I see a lot of more or less generic "me too" messages in this ticket, without the log file.

[Nemess_]

Hi,

I tested again with VirtualBox 5.1.28 on HP-Z840 (Windows 7 64-bit, Intel Xeon E5-2620v3 2x6 cores 64 GB RAM) which was failed earlier with VirtualBox 5.1.4. I wanted to send the requested log. Sorry, I cannot send it, because it works well. The computer image is not changed, same McAfee (it is possible it was a upgraded to newer version by IT), and of cause windows updates are installed.

The big question, why does it work now?

[Klaus Espenlaub]

There have been a lot of hardening fixes since VirtualBox 5.1.4 (which was released about 13 months before 5.1.28, so plenty of time to work on issues which have been reported with good information).

I suspect that there are a lot of different issues lumped into this ticket, but it's impossible to tell anything without logs.

I can only encourage anyone who is considering to throw out the baby with the bathwater by going back to 4.3.12 to think twice. We didn't invent hardening to annoy users. It's there to protect your VMs by preventing whole classes of security vulnerabilites. 4.3.12 is almost 3.5 years old and has an extremely long list of known bugs, in particular a number of otherwise long fixed serious security issues which have exploits out in the wild. The far better alternative than running known buggy code is working constructively with us to get the issues ironed out whenever possible.

[rogan]

I've never been able to create or start a new ubuntu VM on my Windows 7 machines at work due to this VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED error. I'm forced to use virtualbox 4.3.12 but then I run into issues with ridiculously small screen resolutions or the VM not being able to accept keyboard or mouse input. Please find attached a VBoxHardening.log from trying to start a 64-bit ubuntu VM. This VM was newly created in a freshly installed VirtualBox 5.1.28 with the corresponding extension pack (VirtualBox-5.1.28-117968-Win.exe and Oracle_VM_VirtualBox_Extension_Pack-5.1.28-117968.vbox-extpack respectively).

Bear in mind we do not have admin control over our machines so the chances that we would be able to uninstall McAfee is probably close to nil.