0

I have a recurring problem where I get a blue screen of death when I hibernate my computer while I have VirtualBox open. I'm running Windows 7 64-bit with a xubuntu on Ubuntu 14.04 (trusty) guest. I'm also using version 4.3.30 of virtualbox and version 4.3.24 of the guest additions. My BSOD provided the following information: the error was a DRIVER_IRQL_NOT_LESS_OR_EQUAL, and was attributed to VBoxNetFlt.sys. I ran WinDbg on the MEMORY.DMP (full dump, not minidump) and got the following info:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18741.amd64fre.win7sp1_gdr.150202-1526
Machine Name:
Kernel base = 0xfffff800`0300f000 PsLoadedModuleList = 0xfffff800`03253890
Debug session time: Fri Apr 10 15:50:18.376 2015 (UTC - 4:00)
System Uptime: 3 days 14:35:58.020
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols

Loading unloaded module list
................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {112337, 2, 0, fffff80003076615}

*** ERROR: Module load completed but symbols could not be loaded for avgidsdrivera.sys
Probably caused by : avgidsdrivera.sys ( avgidsdrivera+10634 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000112337, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003076615, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  0000000000112337 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiInsertQueueApc+69
fffff800`03076615 488b4108        mov     rax,qword ptr [rcx+8]

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800bffb710 -- (.trap 0xfffff8800bffb710)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80003341a58 rbx=0000000000000000 rcx=000000000011232f
rdx=fffffa800a6373e0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003076615 rsp=fffff8800bffb8a0 rbp=fffff880009e8180
 r8=0000000000000001  r9=000000000011231f r10=fffff880009e8c01
r11=fffffa800fd26b00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!KiInsertQueueApc+0x69:
fffff800`03076615 488b4108        mov     rax,qword ptr [rcx+8] ds:00000000`00112337=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003083469 to fffff80003083ec0

STACK_TEXT:  
fffff880`0bffb5c8 fffff800`03083469 : 00000000`0000000a 00000000`00112337 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0bffb5d0 fffff800`030820e0 : fffff880`0bffb738 fffff800`03083153 ffffffff`8000297c fffffa80`105c1060 : nt!KiBugCheckDispatch+0x69
fffff880`0bffb710 fffff800`03076615 : fffff880`00000001 fffffa80`00000000 00000000`00000000 00000000`00000001 : nt!KiPageFault+0x260
fffff880`0bffb8a0 fffff800`030656b0 : fffffa80`105c1060 00000000`00000000 00000000`00000078 fffffa80`0a6373d0 : nt!KiInsertQueueApc+0x69
fffff880`0bffb8d0 fffff880`04c10634 : 00000000`00000000 00000000`778e7ac0 00000000`00000078 00000000`000007ff : nt!KeInsertQueueApc+0x80
fffff880`0bffb930 fffff880`04c107b4 : 00000000`0000ed04 fffff880`04c3cf50 ffffffff`8000397c fffffa80`1769b6c0 : avgidsdrivera+0x10634
fffff880`0bffba10 fffff880`04c10866 : ffffffff`8000397c fffffa80`1769b6c0 fffffa80`168f6520 00000000`000007ff : avgidsdrivera+0x107b4
fffff880`0bffbac0 fffff880`04c2925c : 00000000`00000001 fffff880`0bffbba8 fffffa80`0fd26b50 fffff880`0bffbba8 : avgidsdrivera+0x10866
fffff880`0bffbb10 fffff800`0337cb43 : 00000000`00000001 00000000`00000001 00000000`00000000 fffffa80`0fd26b50 : avgidsdrivera+0x2925c
fffff880`0bffbb40 fffff800`0308da95 : fffff800`03338b00 fffff800`0322b201 fffffa80`0fd26b00 fffffa80`00000000 : nt!IopProcessWorkItem+0x23
fffff880`0bffbb70 fffff800`03322b8a : fffffa80`105029d0 fffffa80`0fd26b50 00000000`00000080 fffffa80`0698eb30 : nt!ExpWorkerThread+0x111
fffff880`0bffbc00 fffff800`030758e6 : fffff880`03365180 fffffa80`0fd26b50 fffffa80`06d40290 00000000`07fa1011 : nt!PspSystemThreadStartup+0x5a
fffff880`0bffbc40 00000000`00000000 : fffff880`0bffc000 fffff880`0bff6000 fffff880`0bffb8a0 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
avgidsdrivera+10634
fffff880`04c10634 84c0            test    al,al

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  avgidsdrivera+10634

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: avgidsdrivera

IMAGE_NAME:  avgidsdrivera.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  55128c2a

FAILURE_BUCKET_ID:  X64_0xA_avgidsdrivera+10634

BUCKET_ID:  X64_0xA_avgidsdrivera+10634

Followup: MachineOwner
---------

Please provide any assistance you can on determining the cause of and solution to this problem.

1
  • have you tried using the current version of Vbox?
    – Ramhound
    Commented Jul 24, 2015 at 15:14

1 Answer 1

1

The crash IRQL_NOT_LESS_OR_EQUAL seams to be caused by the driver avgidsdrivera.sys

FAILURE_BUCKET_ID: X64_0xA_avgidsdrivera+10634

which is part of AVG AntiVirus.

Make sure AVG is up to date and if nothing helps, uninstall AVG.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .