We were running VirtualBox 4.3.16 on a Windows 7 Enterprise SP1 x64 host. A couple of days ago, our Corporate IT decided they were going to silently install a newer version Symantec Endpoint Protection, 12.1.5337.5000. Previously running v12.1.4013.4013. Since then, when trying to start a VirtualBox guest (doesn't matter what guest), nothing happens. You can see the VirtualBox.exe instance running in the task manager, but if you try and kill it refuses to go away.

I've tried every trick I know to kill the process including: Windows Task Manager -> Processes -> Right click and select Terminate; Process Explorer; pskill; taskkill /f /pid. The worst part, is you cannot even shutdown the PC. When you attempt to initiate a shutdown/reboot, Windows does nothing. If you try to launch any programs after that, nothing will come up. The only option left is to do a 3-second hold on the power button.

I can uninstall Symantec and VirtualBox becomes functional again, but unfortunately, changes to Symantec are not much of an option in fixing this. We're stuck with the version Corporate IT has dished out. I've tried upgrading to VirtualBox 4.3.18 but that has not made a difference. Temporarily disabling Symantec Endpoint also has no affect.

This is what I see in the VBoxStartup.log

ac8.159c: Error (rc=258):
ac8.159c: Timed out after 60001 ms waiting for child request #1 (CloseEvents).
ac8.159c: Error 258 in supR3HardNtChildWaitFor! (enmWhat=5)
ac8.159c: Timed out after 60001 ms waiting for child request #1 (CloseEvents).

Searches online have yielded a few forums talking about the same or similar issues, but as far as I could tell, no real solutions. At this point any help, even it's just a sure fire to kill the process so I don't have kill power to the PC would be much appreciated.

Proactive Threat Protection Settings in Symantec:

    • Enable SONAR = Checked
    • High risk detection = Quarantine
    • Low risk detection = Log
    • Enable Aggressive Mode = Unchecked
    • Show alert upon detection = Checked
    • Prompt before terminating a process = Unchecked
    • Prompt before stopping a service = Unchecked
  • Suspicious Behavior Detection
    • High risk detection = Block
    • Low risk detection = Ignore
  • System Change Detection
    • DNS change detection = Ignore
    • Host file change detected = Ignore
    • Exceptions = Tried adding VirtualBox directory, makes no difference.
  • Would the downvoter care to comment? – Drew Chapin Oct 23 '14 at 2:48
  • I assume you mean Symantec Endpoint Protection? What are your Proactive Threat Protection settings configured as currently. Do your SEP logs show anything relevant; anything listed as blocked? – Robin Hood Oct 23 '14 at 6:24
  • @RobinHood, details added. – Drew Chapin Oct 23 '14 at 11:59
  • What does your IT department say? – Dave M Dec 19 '14 at 13:33
  • @DaveM, yeah... They aren't much help. You may as well give up on that route. – Drew Chapin Dec 19 '14 at 18:57

Hope this thread helps.


I had a similar problem. There seems to be some regression from 4.3.12 onwards. Possible reason seems to be "hardened" security features that does not work well with SEP latest release.

I have reverted to 4.2.x VB release, which solved my problem.


You can remove by going to Programs and Features, selecting "Change" on SEP and set Proactive Threat Protection -> Application and Device control to "Entire Feature will be unavailable". Bear in mind in a Coroprate environment this may be controlled by a password.

The effect of removing it really depends on what policy is being used and unfortunately this is not visible apart from by the SEP admins.

  • This is a better answer. You should delete your previous answer. – fixer1234 Jan 7 '15 at 18:39

I have also encountered the same problem on my windows 7 (64-bit) PC, but it is my anti-virus Avira that causes the improper startup of VBox (4.3.30). windows errors The VBox could be started up smoothly as before after I uninstalled Avira. It may happen to VBox 4.0 version and onward. Because I had tried the VBox 4.0.36, 4.2.36 and 5.0.10 besides 4.3.30 before I found this post. thx.


You can resolve this issue by uninstalling Application and Device control component of SEP

  • 1
    Can you expand your answer to include what other effects that might have and how to do that? – fixer1234 Dec 19 '14 at 0:42
  • I don't see why the author should explain what other effects this might have, considering the setting is likely controlled by corporate configuration, its likely not even possible without IT department. – Ramhound Jan 2 '15 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.