[Solved] Instruction at 0x... referenced memory at 0x.. The memory could not be read

[DW55]

Vbox Version 5.1.2 r108956
Guest Additons loaded from Oracle_VM_VirtualBox_Extension_Pack-5.0.26-108824.vbox-extpack
Both are 64 bit.
Base memory 8000 MB
Storage 80.00 GB

Recently upgraded a 64x Win7 pro VM to Win10. Shortly thereafter, I began seeing error messages of the form as follows:
Instruction at 0x00007FFB355C278E referenced memory at 0x10 The memory could not be read.

These events seem to come at random times, although they may be associated with use of Windows Explorer for navigating the file structure. When these errors pop up, the VM aborts.

LMK if you need other logs or a dump. Please provide a link to appropriate guide for obtaining such additional files.

I looked at previous posts that have similar error message, but each solution seems unique or I didn't recognize the relevance for my problem, therefore, I am starting this new topic.

Many thanks for your help.

DW

[mpack]

You have quad core CPU and have assigned all four cores to the guest. Not good. In your case I'd assign a max of 2 cores.

But, I doubt this causes the exception. An error like this is usually a bad device driver. Look for drivers in the guest that are not native to Windows or VirtualBox. Since you suspect that browsing the guest filesystem is involved then I'd look first at any unusual filesystem layers, e.g. Bluetooth.

[Clipper87]

I'm seeing the same errors: W10 anniversary update host with VB 5.1.2 crashes the vm usually but not always upon exiting

A simple way to replicate the issue is to simply power off a vm by closing the vm window top right & then selecting "power off the vm" in the vb menu that pops up

I tried reverting to VB 5.0.26 but the issue remains so it is most probably an incompatibility with the W10 anniversary update

EDIT: just tested with test build 5.1.3 : the issue remains the same

[DW55]

@ mpack
Thank you for the quick reply.

You have quad core CPU and have assigned all four cores to the guest. Not good. In your case I'd assign a max of 2 cores.

I changed settings to make it 2 cores. Thanks for the advice.

An error like this is usually a bad device driver. Look for drivers in the guest that are not native to Windows or VirtualBox. Since you suspect that browsing the guest filesystem is involved then I'd look first at any unusual filesystem layers, e.g. Bluetooth.

Bluetooth is not installed on this VM. All drivers on this VM are listed as follows:

The first column is running state. The next elements on each line below are: Image Name, Location, Size, Date, and Company Name.

Code: Select all   Expand viewCollapse view

R1 ElRawDisk; C:\WINDOWS\system32\drivers\rsdrvx64.sys [26024 2009-02-12] (EldoS Corporation)
R0 VBoxGuest; C:\Windows\System32\DRIVERS\VBoxGuest.sys [164856 2016-07-21] (Oracle Corporation)
R3 VBoxMouse; C:\Windows\system32\DRIVERS\VBoxMouse.sys [129504 2016-07-21] (Oracle Corporation)
R1 VBoxSF; C:\Windows\System32\drivers\VBoxSF.sys [292728 2016-07-21] (Oracle Corporation)
R3 VBoxVideoW8; C:\Windows\system32\DRIVERS\VBoxVideoW8.sys [308784 2016-07-21] (Oracle Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
U3 idsvc; no ImagePath
U3 wpcsvc; no ImagePath

rsdrvx64.sys is IDed at SystemLookup as legitimate. http://www.systemlookup.com/search.php?list=&type=filename&search=rsdrvx64.sys&s= Quoting, "Related to dddskx64.sys RawDisk Driver. Allows write access to files and raw disk sectors for user mode applications in Windows 2000, XP, 2003, Vista, 2008. from EldoS Corporation." I know I didn't install ElRawDisk intentionally. Is it required for Vbox? Is it safe to remove it?

idsvc is a component of Windows CardSpace. http://servicedefaults.com/7/idsvc/ It is legit and it is not running.

wpcsvc is a component of Parental Controls. http://www.what-is-exe.com/filenames/wpcsvc-dll.html It is legit and it is not running.


I noticed the All Aboard keyboard manager on this VM as follows:

Code: Select all   Expand viewCollapse view

C:\Users\VM10\AppData\Roaming\Mozilla\Firefox\Profiles\hv1gcpce.default\Extensions\@all-aboard-v1

I know I didn't install it intentionally. Is this a required part of Vbox? Although it may not contribute to the current problem, I'd like to know whether it is safe to remove it.


@ Clipper87
I have deferred upgrade to Anniversary edition for two months. This VM is still running Win10 Version 1511 (X64).


The only change I've made so far is to change from 4 cores to 2. I'll post back again after running for a while to see if the "memory could not be read" error returns.

Thanks again for your help.

DW

[DW55]

Hello again,

After running the VM for about two hours, I received the same error message including the same memory address:

Instruction at 0x00007FFB355C278E referenced memory at 0x10 The memory could not be read.

This caused the VM to abort. Prior to the abort, I had visited several sites and had read and sent Gmail using Firefox v48.0. I also had used the GOM player to view several videos that had been previously downloaded. The abort occurred just as I closed a video that I had viewed previously without incident. The 64x Win10 host had the following programs open while I was using the VM, but they were all idling: Firefox v48, MS Internet Explorer v11, the NoteTab text editor v6.2/fv, and the Search Everything utility.

Any suggestions for troubleshooting this recurring error? Please LMK whether you need another copy of Vbox.log.

Thank you,

DW

[DW55]

I just looked at the Windows error logs. I see instances of the following Application error five times within one hour and 14 minutes tonight:

Application errors:
==================
Error: (08/10/2016 01:22:27 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: VM10-PC)
Description: Activation of app Microsoft.Messaging_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2147024894 See the Microsoft-Windows-TWinUI/Operational log for additional information.

I also see the following six System errors today:

System errors:
=============
Error: (08/10/2016 01:22:27 AM) (Source: DCOM) (User: VM10-PC)
Description: "C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe" -ServerName:SkypeHost.ServerServer2App.AppXck5aaxyarfx8gxrgfk6pvakmmxeqvepc.mcaUnavailableUnavailable

Error: (08/10/2016 01:03:31 AM) (Source: EventLog) (User: ) <=== This when the abort occurred
Description: The previous system shutdown at 12:41:14 AM on ‎8/‎10/‎2016 was unexpected.

Error: (08/10/2016 00:56:12 AM) (Source: DCOM) (User: VM10-PC)
Description: "C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe" -ServerName:SkypeHost.ServerServer2App.AppXtjcey7sh4wvcw7hy21b0nmp0bq18dyzd.mcaUnavailableUnavailable

Error: (08/10/2016 00:41:12 AM) (Source: DCOM) (User: VM10-PC)
Description: "C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe" -ServerName:SkypeHost.ServerServer2App.AppXtjcey7sh4wvcw7hy21b0nmp0bq18dyzd.mcaUnavailableUnavailable

Error: (08/10/2016 00:21:58 AM) (Source: DCOM) (User: VM10-PC)
Description: "C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe" -ServerName:SkypeHost.ServerServer2App.AppXtjcey7sh4wvcw7hy21b0nmp0bq18dyzd.mcaUnavailableUnavailable

Error: (08/10/2016 00:08:09 AM) (Source: DCOM) (User: VM10-PC)
Description: "C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe" -ServerName:SkypeHost.ServerServer2App.AppXtjcey7sh4wvcw7hy21b0nmp0bq18dyzd.mcaUnavailableUnavailable



Although I have never used Skype on the host or in this VM, it is causing errors. I have re-installed Skype in the VM just now and will report back after running the VM for a while.

DW

[mpack]

Although I have never used Skype on the host or in this VM, it is causing errors.

Microsoft owns Skype now. I think they bundle some kind of client in Win10. You should be able to uninstall it (ISTR I did on my own Win10 host). But, I can't see why that would cause any aborts: I don't see why it would need to work at kernel level, and I don't see user level code causing aborts.

You mentioned finding a driver which you described as "legitimate". That doesn't really impress me: signing has absolutely nothing to do with being bug free.

[DW55]

@mpack
Thank you for your reply.

After running the VM for about one hour tonight, I received the same error message including the exact same memory address:

Instruction at 0x00007FFB355C278E referenced memory at 0x10 The memory could not be read.


Before shutting down last night, I had reinstalled Skype because I wasn't sure my previous attempt to uninstall it had been successful. I agree that Skype is not causing the invalid memory reference, but I wanted to avoid any more systems errors like the ones I reported yesterday at 10. Aug 2016, 08:21. Skype is now properly installed and it auto-starts when I boot into the VM. I always exit Skype before I do any other work in the VM.

When the abort occurred, no browsers were loaded. I had not viewed any videos tonight. The only program in use was Windows Explorer, and I had just double-clicked on a folder to see the files in it. That's when I got the error message and my only option was to click OK on the message box.

You mentioned finding a driver which you described as "legitimate". That doesn't really impress me: signing has absolutely nothing to do with being bug free.

I had researched C:\Windows\System32\drivers\rsdrvx64.sys and provided the link to SystemLookup which identified the file name to be legitimate. See:

http://www.systemlookup.com/search.php?list=&type=filename&search=rsdrvx64.sys&s=

For further proof of validity, tonight, I uploaded rsdrvx64.sys to VirusTotal. See:

https://virustotal.com/en/file/8683639ff5cc4db9955c61c28922637d10bb9cdaa20ad260292f8e90de198205/analysis/1470893098/

None of the 53 antivirus vendors detected any problem with rsdrvx64.sys. As a result of these scans, VirusTotal reports, "Probably harmless! There are strong indicators suggesting that this file is safe to use. "

I listed all the installed drivers in a previous post. They all look legitimate to me, but I'll research any that you question.

Can you suggest any other troubleshooting ideas? Plese tell me whether you want any other logs.

Thank you for your continuing help.

DW

[mpack]

We seem to be talking at cross purposes. At no time did I suggest that your problem was due to malware, so your comments about antivirus, malware check sites, "legitimate" etc are all irrelevant.

To get my code signed I verify my identity and pay a fee. It's an identity vetting service, not a code quality report. So signing is also irrelevant.

I suggested that your problem could be due to a buggy driver, hence I asked you to look for any third party drivers in the VM (i.e. if it was a native driver then everyone would be reporting these aborts).

[DW55]

Hi mpack,

I suggested that your problem could be due to a buggy driver, hence I asked you to look for any third party drivers in the VM (i.e. if it was a native driver then everyone would be reporting these aborts).

I showed you all the drivers on this VM on August 9th. Here they are again quoted from above:

Bluetooth is not installed on this VM. All drivers on this VM are listed as follows:

The first column is running state. The next elements on each line below are: Image Name, Location, Size, Date, and Company Name.

R1 ElRawDisk; C:\WINDOWS\system32\drivers\rsdrvx64.sys [26024 2009-02-12] (EldoS Corporation)
R0 VBoxGuest; C:\Windows\System32\DRIVERS\VBoxGuest.sys [164856 2016-07-21] (Oracle Corporation)
R3 VBoxMouse; C:\Windows\system32\DRIVERS\VBoxMouse.sys [129504 2016-07-21] (Oracle Corporation)
R1 VBoxSF; C:\Windows\System32\drivers\VBoxSF.sys [292728 2016-07-21] (Oracle Corporation)
R3 VBoxVideoW8; C:\Windows\system32\DRIVERS\VBoxVideoW8.sys [308784 2016-07-21] (Oracle Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
U3 idsvc; no ImagePath
U3 wpcsvc; no ImagePath

Do you see any suspicious third party drivers?

The only "3rd party" driver is rsdrvx64.sys from EldoS Corporation which was checked at SystemLook and at VirusTotal. I also checked the SHA1 hash against that published at VT. My copy has the same SHA1 as published at VT. How else can I disprove "buggy drivers"? All the other drivers are from Oracle or Microsoft or are not running.


I left the VM running unattended for about four hours tonight. I used the FireFTP extension in Firefox to download 10 GB of video image data from an astronomy website in the form of 100 KB RAR files. I used QuickPar to confirm integrity of the archives then extracted the archived videos. I didn't get any error messages and the VM did not abort, however, I don't consider the problem resolved. The VM just didn't abort tonight, but I've operated this VM for longer stretches in the past without the invalid memory reference.

I also ran the MemTest86 utility to check the RAM on my physical machine. It reported no errors after running for 40 cycles on 16 GB of DDR3 RAM.

Do you have any other troubleshooting ideas?

Thank you,

DW

[mpack]

I said to look for unusual drivers (i.e. non native), I said nothing about suspicious drivers. And yes, we can both very clearly see which is the unusual driver in the set you showed me. A quick Google shows me many associations between BSODs and this driver in the physical world.

The way to disprove a buggy driver is by disabling it and see if you still get the problem. I really don't know what that rsdrvx64.sys driver is doing in a VM anyway, since a VM cannot get raw access to a host drive via a guest driver, and the (in fact entirely virtual) feature which VirtualBox calls raw disk access needs no help from any guest driver.

[DW55]

Hi mpack,

I said to look for unusual drivers (i.e. non native), I said nothing about suspicious drivers.

I don't have enough experience with Vbox to be able to recognize an unusual driver when I see one. Thank you for clarifying that rsdrvx64.sys is an unusual driver. I have renamed it and have rebooted the VM. It came up normally and appears to be running well, but I don't have time to do any real testing now.

I'll post back late on Thursday night (Eastern time) about the VM's performance.

Thanks again,

DW

[DW55]

On Friday evening, the same memory addressing error occurred after only a short while.

Instruction at 0x00007FFB355C278E referenced memory at 0x10 The memory could not be read.

I had previously renamed rsdrvx64.sys. After rebooting, I totally deleted the following from the VM:
rsdrvx64.sys
idsvc
wpcsvc

I rebooted again and used the VM for about an hour without incident, but the memory addressing error came up again. It happened when I clicked the back arrow in Windows Explorer to go back to the previous folder.

Here below are the services and drivers that are currently running in the VM:

Code: Select all   Expand viewCollapse view

=== Services ====

The first column is running state. The next elements on each line below are: Image Name, Location, Size, Date, and Company Name.

R2 VBoxService; C:\Windows\System32\VBoxService.exe [1797144 2016-07-21] (Oracle Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-07-01] (Microsoft Corporation)

==== Drivers ===

R0 VBoxGuest; C:\Windows\System32\DRIVERS\VBoxGuest.sys [164856 2016-07-21] (Oracle Corporation)
R3 VBoxMouse; C:\Windows\system32\DRIVERS\VBoxMouse.sys [129504 2016-07-21] (Oracle Corporation)
R1 VBoxSF; C:\Windows\System32\drivers\VBoxSF.sys [292728 2016-07-21] (Oracle Corporation)
R3 VBoxVideoW8; C:\Windows\system32\DRIVERS\VBoxVideoW8.sys [308784 2016-07-21] (Oracle Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

Later, when I shut down the physical machine, an error window titled, "VB application Error" prevented shutdown. It displayed the following error:
Plugin-container.exe 0x80000003 in location 0x000000006E45F035 could not be read. Maybe this error is related to my original complaint.

Any troubleshooting ideas?

Thank you,

DW

[DW55]

This is second of two consecutive posts.


I ran sfc /scannow at the Command Prompt as administrator in the VM. Here's the result in the Command Prompt window:

Code: Select all   Expand viewCollapse view

Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

%windir%\logs\cbs\cbs.log contains 197 triple-line entries like the following:

Code: Select all   Expand viewCollapse view

2016-08-13 19:44:42, Info                  CSI    0000000a [SR] Verifying 100 (0x0000000000000064) components
2016-08-13 19:44:42, Info                  CSI    0000000b [SR] Beginning Verify and Repair transaction
2016-08-13 19:44:45, Info                  CSI    00000070 [SR] Verify complete

No other [SR] lines are in %windir%\logs\cbs\cbs.log

I hope that helps.

DW

[Clipper87]

V5.1.4 seems to correct all my issues ; 5.1.3 did not even allow to keep a vm running for more than a minute, now all seems to work rather smooth; THANK YOU!