vmware player bsod

Hello, I was in vmware player (latest version) running 3 different linux distros: zorin x64, ubuntu x64, elementary x64.

Each have 4gb ram dedicated to them to use.

I got the bsod-it saved to dump, it saved to disk and restarted.

I used windows memory diagnostic and ran the extended test until completion. It took 14 hours

Passed though with no issues according to event viewer and the little balloon at logon.

Did hard disk check, everything good there.

I am uploading the diag report.

NOTE: I have no longer had any bsods since. Just that one time. But I want to know if vmware or another app was the cause.

I am suspecting malwarebytes anti-exploit as it is in beta and is a known cause of bsods in some situations.

This is the first bsod I have ever had where I did not know the cause. 2nd bsod in my life of pcs.

Andrew, see if this helps

Code:

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a01a0d0038, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88004915b60, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 0000000000000000, (reserved)

Code:

lmvm  NNSStrm
start             end                 module name
fffff880`048df000 fffff880`04925000   NNSStrm  T (no symbols)           
    Loaded symbol image file: NNSStrm.sys
    Image path: \SystemRoot\system32\DRIVERS\NNSStrm.sys
    Image name: NNSStrm.sys
    Timestamp:        Fri May 02 08:17:33 2014 (53639AED)
    CheckSum:         0004D9A9
    ImageSize:        00046000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As in a very recent discussion, this is Panda Streamer Streamer it can be updated at http://www.pandasecurity.com/homeusers/downloads/

If this has not happened before I would think it was from running 3 VMs at the same time. Linux will normally use 2 GB of memory at the max, I have found, so I give my Linux VMs only 2 GB and never run but one at a time. You feel free to do it however you like, but you could have just run out of resources. Plus, Windows Memory diagnostics is not the best to use. Next time use memtest86+ Memtest86+ - Advanced Memory Diagnostic Tool

Thank you essenbe. :)

I do have panda up to date. (latest version 3.0.1) So you think it was me running out of resources more than it was panda? If it is panda I can report it to them as long as I know what info to give them.

essenbe said:

If this has not happened before I would think it was from running 3 VMs at the same time.

Correct, this has never happened before in all my time using Virtual Machines. Come to think of it, this was the first time I ran all 3 distros at once. I was also installing updates in all of them at once. I guess I did run out of system resources. I have 16gb ram though, but maybe that was not enough?

essenbe said:

Plus, Windows Memory diagnostics is not the best to use. Next time use memtest86+ Memtest86+ - Advanced Memory Diagnostic Tool

Not disagreeing with you in any way, but Is there a reason why this one is better at testing? Do you think I should test again with memtest to be sure?

Thank you for all your help. Very appreciated. :) I would rep if I could. :)

memtest86+ is the industry standard and considered by most hardware people as the best. Even so, nothing is 100% all of the time, but it is the best we have. But, I would not think you need to run it again unless this happens again when you don't have 3 VMs open at once. I really think that is what happened. You know how much ram it takes you to just idle on the desktop, add 12Gb to that and you will see that you have only a little ram left, plus updating 3 VMs at the same time took some ram too. I have 16 GB too, and I would have had very little left doing that. Then if Panda decided to update, scan or do something, you could have been in trouble. That is, of course, just my opinion.

essenbe said:

memtest86+ is the industry standard and considered by most hardware people as the best. Even so, nothing is 100% all of the time, but it is the best we have. But, I would not think you need to run it again unless this happens again when you don't have 3 VMs open at once. I really think that is what happened. You know how much ram it takes you to just idle on the desktop, add 12Gb to that and you will see that you have only a little ram left, plus updating 3 VMs at the same time took some ram too. I have 16 GB too, and I would have had very little left doing that. Then if Panda decided to update, scan or do something, you could have been in trouble. That is, of course, just my opinion.

Ok thank you so much for the info.
I won't run 3 of them at once from now on.
I appreciate your opinion and insight. :)

I also think I will drop the distros down to 2gb like you stated. It really makes sense now what you said. With all the updates installing for the linux distros, then the ram maybe maxed out, then the disk was thrashing with all the installing updates and then the whole thing just went kaput.

I will let you know and post again if this bsod happens again. Thank you.

EDIT: Essenbe, what you said about panda got me thinking. I looked at panda history log, and sure enough panda was catching up on a scheduled full scan that the task missed as my pc was not on. So while all that was going on that I was doing, Panda was also Running a FULL system scan. No wonder!

Edit 2: So guess what? malwarebytes was scanning too at that time. Good lord. No wonder I blue screened.

edit 3: removed attachment since they include a lot of info.

You're right. I would be surprised if it didn't do something... bad.

Hey guys, it came back.

This time (learning my lesson from last time) I have every program disabled for auto scanning and have my security software to ignore the virtual machine folders. I have confirmed nothing was happening in the background when this one occurred. I was in other vms today updating them and none of them gave any issues until I got to zorin. I was in my virtual machine (only 1 this time!) zorin x64 and it was updating to the latest version-distro upgrade through software updates. It was installing the update to the new version of zorin. The only program I had open was windows media player at the time. It was playing a song, then the bsod happened. System resources were at 15% cpu and 20% ram. So this time resources were not the issue. As far as I know. The only thing I can think of is maybe my hard disk could not take all the data being thrown at it and gave up? Idk.

Thanks for any help in advance!


Just thought of something, is it zorin? That is what I was in last time when it went nutz.

UPDATE: I restored the zorin vm back to a few days ago, and I turned off all protection software-completely disabled it. I then started the upgrade process again. It bsod at the same exact screen as before when zorin was updating. So I have deleted the zorin vm and I am going to get the latest version and install it in vm player. I will report back if this fixes it. I am starting to think it is only zorin, seeing as how I was in multiple other vms today (windows and linux ones) and had no issues doing all kinds of things. (Even scanning the VM for threats.) So I will report back.

The dump file is blaming

Code:

lmvm NNSStrm
start             end                 module name
fffff880`040c0000 fffff880`04106000   NNSStrm  T (no symbols)           
    Loaded symbol image file: NNSStrm.sys
    Image path: \SystemRoot\system32\DRIVERS\NNSStrm.sys
    Image name: NNSStrm.sys
    Timestamp:        Wed Jun 04 09:37:37 2014 (538F2F31)
    CheckSum:         0004AEEE
    ImageSize:        00046000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Panda Streamer Streamer

Code:

lmvm  psinknc
start             end                 module name
fffff880`04060000 fffff880`04095000   psinknc  T (no symbols)           
    Loaded symbol image file: psinknc.sys
    Image path: \SystemRoot\system32\DRIVERS\psinknc.sys
    Image name: psinknc.sys
    Timestamp:        Thu Jul 24 13:07:41 2014 (53D14B6D)
    CheckSum:         0003614C
    ImageSize:        00035000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Cloud Antivirus Platform Panda Anti Virus
PSINKNC Kernel Controller for XP32.

And, just in case you want to know

Code:

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a010485038, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880040f6b90, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 0000000000000000, (reserved)

Code:

STACK_COMMAND:  kb
FOLLOWUP_IP: 
NNSStrm+36b90
fffff880`040f6b90 488b040a        mov     rax,qword ptr [rdx+rcx]
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  NNSStrm+36b90
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: NNSStrm
IMAGE_NAME:  NNSStrm.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  538f2f31
FAILURE_BUCKET_ID:  X64_0x50_NNSStrm+36b90
BUCKET_ID:  X64_0x50_NNSStrm+36b90
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:x64_0x50_nnsstrm+36b90
FAILURE_ID_HASH:  {1845a46d-a7ad-6a38-5686-a86e4b01a70b

Andrew, both times it was Panda. And the way I understand what happened, it wasn't an issue of running out of resources. I really think Panda is your problem. Just to make sure you could uninstall it for a while as a test and install one of the free versions of another AV and just see what happens. I'm testing out Avast right now. I'm not sure whether I'll keep it or not, but it seems to do a pretty good job in the AV department, but can annoy the crap out of you with all the pop ups, but I guess that isn't totally bad.

essenbe said:

Andrew, both times it was Panda. And the way I understand what happened, it wasn't an issue of running out of resources. I really think Panda is your problem. Just to make sure you could uninstall it for a while as a test and install one of the free versions of another AV and just see what happens. I'm testing out Avast right now. I'm not sure whether I'll keep it or not, but it seems to do a pretty good job in the AV department, but can annoy the crap out of you with all the pop ups, but I guess that isn't totally bad.

Wow. That sucks. Thank you for looking. I guess I will have to let panda know.

Here is the weird thing though, I deleted zorin and now everything is fine. Every other vm is working great. Any Ideas why that would be? Updating, intensive hard disk etc. All fine. Wonder what pandas beef with zorin or vmware player is. I would only bsod with zorin.

Anyways, when the bsod happened now windows update is screwed up, and will not install updates. So I said no big deal I will do a restore from an image. I did so, yet the windows update error is still there! How is that possible? Windows update was working fine when the system image was taken.....

I am just going to reinstall windows. Today just is not my day at all. I have not felt this crappy for a long time. Its one of those if it can go wrong it did.