vmware player bsod

[andrew129260]

Hello, I was in vmware player (latest version) running 3 different linux distros: zorin x64, ubuntu x64, elementary x64.

Each have 4gb ram dedicated to them to use.

I got the bsod-it saved to dump, it saved to disk and restarted.

I used windows memory diagnostic and ran the extended test until completion. It took 14 hours :shock:

Passed though with no issues according to event viewer and the little balloon at logon.

Did hard disk check, everything good there.

I am uploading the diag report.

NOTE: I have no longer had any bsods since. Just that one time. But I want to know if vmware or another app was the cause.

I am suspecting malwarebytes anti-exploit as it is in beta and is a known cause of bsods in some situations.

This is the first bsod I have ever had where I did not know the cause. 2nd bsod in my life of pcs.

 

[essenbe]

Andrew, see if this helps

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a01a0d0038, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88004915b60, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 0000000000000000, (reserved)

lmvm  NNSStrm
start             end                 module name
fffff880`048df000 fffff880`04925000   NNSStrm  T (no symbols)           
    Loaded symbol image file: NNSStrm.sys
    Image path: \SystemRoot\system32\DRIVERS\NNSStrm.sys
    Image name: NNSStrm.sys
    Timestamp:        Fri May 02 08:17:33 2014 (53639AED)
    CheckSum:         0004D9A9
    ImageSize:        00046000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As in a very recent discussion, this is Panda Streamer Streamer it can be updated at http://www.pandasecurity.com/homeusers/downloads/

If this has not happened before I would think it was from running 3 VMs at the same time. Linux will normally use 2 GB of memory at the max, I have found, so I give my Linux VMs only 2 GB and never run but one at a time. You feel free to do it however you like, but you could have just run out of resources. Plus, Windows Memory diagnostics is not the best to use. Next time use memtest86+ Memtest86+ - Advanced Memory Diagnostic Tool

 

[andrew129260]

Thank you essenbe.

I do have panda up to date. (latest version 3.0.1) So you think it was me running out of resources more than it was panda? If it is panda I can report it to them as long as I know what info to give them.

If this has not happened before I would think it was from running 3 VMs at the same time.

Correct, this has never happened before in all my time using Virtual Machines. Come to think of it, this was the first time I ran all 3 distros at once. I was also installing updates in all of them at once. I guess I did run out of system resources. I have 16gb ram though, but maybe that was not enough?

Plus, Windows Memory diagnostics is not the best to use. Next time use memtest86+ Memtest86+ - Advanced Memory Diagnostic Tool

Not disagreeing with you in any way, but Is there a reason why this one is better at testing? Do you think I should test again with memtest to be sure?

Thank you for all your help. Very appreciated. I would rep if I could.

 

[essenbe]

memtest86+ is the industry standard and considered by most hardware people as the best. Even so, nothing is 100% all of the time, but it is the best we have. But, I would not think you need to run it again unless this happens again when you don't have 3 VMs open at once. I really think that is what happened. You know how much ram it takes you to just idle on the desktop, add 12Gb to that and you will see that you have only a little ram left, plus updating 3 VMs at the same time took some ram too. I have 16 GB too, and I would have had very little left doing that. Then if Panda decided to update, scan or do something, you could have been in trouble. That is, of course, just my opinion.

 

[andrew129260]

memtest86+ is the industry standard and considered by most hardware people as the best. Even so, nothing is 100% all of the time, but it is the best we have. But, I would not think you need to run it again unless this happens again when you don't have 3 VMs open at once. I really think that is what happened. You know how much ram it takes you to just idle on the desktop, add 12Gb to that and you will see that you have only a little ram left, plus updating 3 VMs at the same time took some ram too. I have 16 GB too, and I would have had very little left doing that. Then if Panda decided to update, scan or do something, you could have been in trouble. That is, of course, just my opinion.

Ok thank you so much for the info.
I won't run 3 of them at once from now on.
I appreciate your opinion and insight.

I also think I will drop the distros down to 2gb like you stated. It really makes sense now what you said. With all the updates installing for the linux distros, then the ram maybe maxed out, then the disk was thrashing with all the installing updates and then the whole thing just went kaput.

I will let you know and post again if this bsod happens again. Thank you.

EDIT: Essenbe, what you said about panda got me thinking. I looked at panda history log, and sure enough panda was catching up on a scheduled full scan that the task missed as my pc was not on. So while all that was going on that I was doing, Panda was also Running a FULL system scan. No wonder!

Edit 2: So guess what? malwarebytes was scanning too at that time. Good lord. No wonder I blue screened.

edit 3: removed attachment since they include a lot of info.

 

[essenbe]

You're right. I would be surprised if it didn't do something... bad.

 

[andrew129260]

Hey guys, it came back.

This time (learning my lesson from last time) I have every program disabled for auto scanning and have my security software to ignore the virtual machine folders. I have confirmed nothing was happening in the background when this one occurred. I was in other vms today updating them and none of them gave any issues until I got to zorin. I was in my virtual machine (only 1 this time!) zorin x64 and it was updating to the latest version-distro upgrade through software updates. It was installing the update to the new version of zorin. The only program I had open was windows media player at the time. It was playing a song, then the bsod happened. System resources were at 15% cpu and 20% ram. So this time resources were not the issue. As far as I know. The only thing I can think of is maybe my hard disk could not take all the data being thrown at it and gave up? Idk.

Thanks for any help in advance!


Just thought of something, is it zorin? That is what I was in last time when it went nutz.

UPDATE: I restored the zorin vm back to a few days ago, and I turned off all protection software-completely disabled it. I then started the upgrade process again. It bsod at the same exact screen as before when zorin was updating. So I have deleted the zorin vm and I am going to get the latest version and install it in vm player. I will report back if this fixes it. I am starting to think it is only zorin, seeing as how I was in multiple other vms today (windows and linux ones) and had no issues doing all kinds of things. (Even scanning the VM for threats.) So I will report back.

 

[essenbe]

The dump file is blaming

lmvm NNSStrm
start             end                 module name
fffff880`040c0000 fffff880`04106000   NNSStrm  T (no symbols)           
    Loaded symbol image file: NNSStrm.sys
    Image path: \SystemRoot\system32\DRIVERS\NNSStrm.sys
    Image name: NNSStrm.sys
    Timestamp:        Wed Jun 04 09:37:37 2014 (538F2F31)
    CheckSum:         0004AEEE
    ImageSize:        00046000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Panda Streamer Streamer

lmvm  psinknc
start             end                 module name
fffff880`04060000 fffff880`04095000   psinknc  T (no symbols)           
    Loaded symbol image file: psinknc.sys
    Image path: \SystemRoot\system32\DRIVERS\psinknc.sys
    Image name: psinknc.sys
    Timestamp:        Thu Jul 24 13:07:41 2014 (53D14B6D)
    CheckSum:         0003614C
    ImageSize:        00035000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Cloud Antivirus Platform Panda Anti Virus
PSINKNC Kernel Controller for XP32.

And, just in case you want to know

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a010485038, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880040f6b90, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 0000000000000000, (reserved)

STACK_COMMAND:  kb
FOLLOWUP_IP: 
NNSStrm+36b90
fffff880`040f6b90 488b040a        mov     rax,qword ptr [rdx+rcx]
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  NNSStrm+36b90
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: NNSStrm
IMAGE_NAME:  NNSStrm.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  538f2f31
FAILURE_BUCKET_ID:  X64_0x50_NNSStrm+36b90
BUCKET_ID:  X64_0x50_NNSStrm+36b90
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:x64_0x50_nnsstrm+36b90
FAILURE_ID_HASH:  {1845a46d-a7ad-6a38-5686-a86e4b01a70b

 

[essenbe]

Andrew, both times it was Panda. And the way I understand what happened, it wasn't an issue of running out of resources. I really think Panda is your problem. Just to make sure you could uninstall it for a while as a test and install one of the free versions of another AV and just see what happens. I'm testing out Avast right now. I'm not sure whether I'll keep it or not, but it seems to do a pretty good job in the AV department, but can annoy the crap out of you with all the pop ups, but I guess that isn't totally bad.

 

[andrew129260]

Andrew, both times it was Panda. And the way I understand what happened, it wasn't an issue of running out of resources. I really think Panda is your problem. Just to make sure you could uninstall it for a while as a test and install one of the free versions of another AV and just see what happens. I'm testing out Avast right now. I'm not sure whether I'll keep it or not, but it seems to do a pretty good job in the AV department, but can annoy the crap out of you with all the pop ups, but I guess that isn't totally bad.

Wow. That sucks. Thank you for looking. I guess I will have to let panda know.

Here is the weird thing though, I deleted zorin and now everything is fine. Every other vm is working great. Any Ideas why that would be? Updating, intensive hard disk etc. All fine. Wonder what pandas beef with zorin or vmware player is. I would only bsod with zorin.

Anyways, when the bsod happened now windows update is screwed up, and will not install updates. So I said no big deal I will do a restore from an image. I did so, yet the windows update error is still there! How is that possible? Windows update was working fine when the system image was taken.....

I am just going to reinstall windows. Today just is not my day at all. I have not felt this crappy for a long time. Its one of those if it can go wrong it did.

 

[essenbe]

Have you tried sfc /scannow to try to fix it, or a repair install? You could try this too, http://windows.microsoft.com/en-us/windows/troubleshoot-problems-installing-updates#1TC=windows-7

 

[andrew129260]

Have you tried sfc /scannow to try to fix it, or a repair install?

Yes. thanks Everything fails on me now. (Windows side of things anyways.) I had been meaning to do a clean install but I was going to wait till I got an ssd that I wanted.

Looks like it may be coming sooner than later. Thanks for all your help.

 

[andrew129260]

Would having panda see the dump files or this thread help them in fixing the issue?

 

[essenbe]

It may. I guess it depends on them, how they want to see it. FWIW, I'm running Zorin in VWare and have yet to have any problem with it. It running in a VM, I wouldn't think it should be able to do anything to system files. At least, I wouldn't think so. VMware is actually the only thing installed on the system as I understand it. Zorin is running inside VMware. At least that's the way I understand the way it works, but I'm no expert with VMware.

 

[essenbe]

in the FWIW dept. I just updated Zorin, everything went fine, except for my crappy internet connection. But the update failed apparently. It can't configure my monitor, for some reason. I'll just do the same as you, most likely.

 

[andrew129260]

It may. I guess it depends on them, how they want to see it. FWIW, I'm running Zorin in VWare and have yet to have any problem with it. It running in a VM, I wouldn't think it should be able to do anything to system files. At least, I wouldn't think so. VMware is actually the only thing installed on the system as I understand it. Zorin is running inside VMware. At least that's the way I understand the way it works, but I'm no expert with VMware.

That is the way it should work. Anyways, looks like Because I was low on sleep I missed a few things.

I got the system image to work. (I was being dumb and not thinking as I was extremely frustrated.)

This is odd, but here is some background. Panda is set to not monitor the folders where my VM are stored. And here is the thing, the bsod happens exactly when I reproduce it in zorin when I tried to update it last time.

Every single bsod I have gotten was when I was in zorin. Every other vm I was in and had works fine and does not bsod. Even when doing updates. I have elementary and ubuntu and never have any issues. They are all x64 with 4gb ram. (Which I had brought down to 2 since the last time we talked.)

So, why zorin? That is what I am trying to figure out. VMware is separating the os virtuality, so why am I able to reproduce it and it happens at the exact same point of the update?

It is extremely odd. I have never bsod unless I was in zorin.

in the FWIW dept. I just updated Zorin, everything went fine, except for my crappy internet connection. But the update failed apparently. It can't configure my monitor, for some reason. I'll just do the same as you, most likely.

Thank you for testing. I sincerely appreciate your assistance.

 

[essenbe]

Andrew, I honestly don't know the answer. I've reinstalled Zorin twice today and had no problem, except for me. But, I can't figure out why Zorin would make you crash. I know the dump file said Panda did it, which doesn't necessarily mean it did.

 

[andrew129260]

I have deleted the zorin VM and I am going to reinstall it with the newest version available. I will see what happens and get back to you.

 

[essenbe]

OK, no problem. I did that today.

 

[andrew129260]

I have sent the issue to the panda forums to see if they can see something wrong with their software if it is in fact the cause.

http://support.pandasecurity.com/fo...3&sid=14d6288e4ffc39f43d2feec7bc1fe7ca#p12893

I am now going to install zorin latest version and attempt updates and report my findings.