Windows XP Professional SP2 PAGE_FAULT_IN_NONPAGED_AREA Suddenly

[Giapo]

Hi everyone, I need help.
I write this new post after another one, in which I had initially problems with all the Windows-like VMs since the last Windows 10 20H2 Update, and then I found out that for some unreasonable reason there was the Hyper-V activated (also if it was even checked into the Windows Functionalities)... By the way, this didn't resolve everything, and this new post is for one of the VMs which is still having problems.
I have a VM with Windows Professional SP2, and until 10 days ago, the last time I opened it, it was still working fine.
Now, if I try to open it, it can't start Normally, it manages to only in the Safe modes. If I try to start Windows XP Normally or with the Last Good Configuration, after 1-2 seconds of Windows Logo loading screen it goes on BSoD with the error PAGE_FAULT_IN_NONPAGED_AREA (0x00000050); and has a critical shutdown. If I disable the Audio Driver, the Windows Logo loading screen manages to last more, like it can load all or most of the OS, but the problem remains and still goes on BSoD.
I attach a Vbox.log file to help everyone to understand where's the problem and how can I resolve it.
Someone can help me, please?
I thank for every answer, hoping to get some as soon as possible.
Bye ^_^

[mpack]

00:00:17.250837 Changing the VM state from 'RUNNING' to 'GURU_MEDITATION'
00:00:17.250861 Console: Machine state changed to 'GuruMeditation'
00:00:17.251033 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
00:00:17.251033 !!
00:00:17.251034 !! VCPU0: Guru Meditation -4063 (VERR_SVM_IPE_3)
00:00:17.251073 !!
00:00:17.251078 !!
00:00:17.251079 !! {mappings, <NULL>}
00:00:17.251079 !!
00:00:17.251087 !!
00:00:17.251087 !! {hma, <NULL>}
00:00:17.251088 !!
00:00:17.251089 Hypervisor Memory Area (HMA) Layout: Base 00000000a0000000, 0x02800000 bytes

There still seems to be something wrong with the SVM (a.k.a. AMD-v) feature of the host CPU. Normally this is caused by some other software leaving the VT-x or SVM feature in an invalid state. I would in the first instance treat this as yet another Hyper-v intrusion, but Hyper-v is not the only other software that grabs this feature - some third party AV does this too.

Read related FAQ: I have a 64bit host, but can't install 64bit guests.

[Giapo]

There still seems to be something wrong with the SVM (a.k.a. AMD-v) feature of the host CPU. Normally this is caused by some other software leaving the VT-x or SVM feature in an invalid state. I would in the first instance treat this as yet another Hyper-v intrusion, but Hyper-v is not the only other software that grabs this feature - some third party AV does this too.

Read related FAQ: I have a 64bit host, but can't install 64bit guests.

I did everything wrote on that post, but nothing changed.
For a while I had Kaspersky Free Cloud 4 as Antivirus, so I reinstalled it and uninstalled it using Revo Uninstaller in order to find some Register key or some other file saved into the PC which could block the VM, but I found nothing.
I've got Avast Free Antivirus, but also uninstalling it the things don't change at all.
I also checked Windows Functionalities, and i had Microsoft Defender Application Guard checked, but also unchecking it the problems did'nt resolve.
Have you got any other ideas?

[mpack]

There is never a need to disable Defender, that is not "third party AV". Defender is the primary AV by the people who made the OS, everybody has that as a default, and nobody ever has a problem with it.

You told me some additional things that you think it isn't, but I don't have anything to add to what I already said above.

[Giapo]

Windows Defender Application Guard is not Windows Defender, it's the additional part of Windows Defender for Microsoft Edge Isolated Exploration. I installed ita few weeks ago and now I just tried to roll back to when it wasn't installed.
You told about some third party aggressive AV, so I told you that none of my AV was creating problems with Virtualbox.

[scottgus1]

Application Guard is not Windows Defender, it's the additional part of Windows Defender for Microsoft Edge Isolated Exploration.

This sounds a lot like Core Isolation, referenced in "64-bits" post 2, as a user of Hyper-V.

Did you try the bcdedit command?

[Giapo]

Did you try the bcdedit command?

Yes, i used the bcdedit command and I have Core Isolation Disabled.

[scottgus1]

Start the VM again, wait for it to crash. Then Inspect the VM's vbox.log, search for the words:

Attempting fall back to NEM

If you find them, Hyper-V is still enabled. If the words are not in the log, Hyper-V is off.

If you still have the guru meditation highlighting an SVM issue, then something else is using the "virtualization technology" capabilities that Virtualbox needs. There is not way for us to tell what it is. You'll have to investigate your installed programs for anything that uses 'virtualization'.

[Giapo]

Start the VM again, wait for it to crash. Then Inspect the VM's vbox.log, search for the words:

Attempting fall back to NEM

If you find them, Hyper-V is still enabled. If the words are not in the log, Hyper-V is off.

I did what you told me, and in the Vbox.log file I didn't find anything similar to this sentence, so I guess the Hyper-V, also after using all the command to disable it, is defintely off.
I used the Find function of Notepad, at least I found only the command UseNEMInstead set to 0x00000000 (0); and this I think is right.
I attach also this Vbox.log file, If you want to check it too.

P.S.: If this could be useful, the Error code of the BSoD is 0x00000050 (0x0FFFFFA8000B76000,0x000000000000,0xFFFFF80001025AA4,0x0000000000000) or 0x00000050 (0xFFFFFA80C9941FBE, 0x000000000000000, 0xFFFFF80001025B51, 0x0000000000000002).

[scottgus1]

This vbox.log does not have the tell-tale words, so Hyper-V is off.

It does not contain any indication of a guru meditation or the typical close-down of the Virtualbox environment, so we can't tell if SVM is still being interfered with.

Post another log, this time with the VM's window closed.

[Giapo]

Well in the meanwhile, in a quite casual way, I found what caused all of this. On the VM i Had installed Avast Free Antivirus, since the begin. For some reason, after the Windows 10 Update, VirtualBox is unable to load the Avast drivers and goes to BSoD. Now in Safe mode i Uninstalled it and the problem disappeared; but still I don't get what caused this casual "change of mind" about the AV in the VM.
I found out this trying to make a new installation of Windows XP on a new VHD; when i Installed the AV the VM blocked and showed a red and black glitch con the top of the screen. When I rebooted the VM, it showed the BSoD like the other VM...
So I guess I can't have anymore a Vbox.log file with the Guru Meditation, until i Install again Avast or AVG on the VM; but I can attach the VBox.log file of the new VHD which wshowed the same problem, and went in Guru Mediatation, if I remeber well.

Now, does someone know a still valid Antivirus for Windows XP? Because I think that it's easier to change it on the VM than find what caused the glitch and the VirtualBox problems about it.

[scottgus1]

Great! Glad you kept up the hunt and found a solution!

VirtualBox is unable to load the Avast drivers and goes to BSoD.

Virtualbox is just a 'hardware' provider. The changing factor appears to be:

I had initially problems with all the Windows-like VMs since the last Windows 10 20H2 Update

If Windows or other Antivirus on the host is able to scan the VM's disk file, which they can by default, it might catch and block access to things without the VM OS knowing, which might cause a BSOD in the VM. You can block host Antivirus access to the VM's disk file and let the VM's OS handle antivirus in the VM.

does someone know a still valid Antivirus for Windows XP?

Someone here might offer suggestions, but a web-search might get you an answer quicker.

[Giapo]

Well, this should be a good explanation, but sure is not a Host Antivirus problem, because also without it the VM wasn't still able to start... Indeed, the thing could be connected actually to the last update, with which Windows managed to block some internal file into the VDI file of the VM. As I've already told, exactly in the moment in which Windows XP ends the Avast Antivirus installation on Windows XP, it starts to glitch and block itself and goes to critical shutdown; so this could be in some way connected to the sensibility that VirtualBox or the Host OS now have about Antivirus files in the VM.
Unluckily, on the Web I can't find a still active Antivirus for Windows XP, excluded Avast and AVG, which are basically the same company Antivirus and give to the VM exactly the same critical problem... So I hope for some suggestion, because now I'm only have a link to VirusTotal on the Desktop and an Adblock on Mypal Palemoon browser, it's like trying to prevent an illness only with the hope of not getting it

Anyway, thank you for the help, I hope that if it's a bug of VirtualBox or of Windows that it will be resolved soon, because it's kinda tricky to find and resolve because it pratically blocks suddenly the VM without a reason

[scottgus1]

Please don't use Quote to start a reply unless you plan to quote a part of the previous posts, like I did above. Use Post Reply instead.

XP is sorely inadequate for internet usage today. Security protocols are very out of date. The only reason one might want to let XP access the internet today is to see how long it takes to get hacked.

I have no further ideas why your XP installations are failing when antivirus is installed. If you have another computer that can run Virtualbox you could try copying the VM's folder & files to that computer and see what happens.

Also, try to have suitable backups of your host PC so you can revert major updates if troubles occur. It is Microsoft Windows, problems likely will occur.

[mpack]

I wouldn't bother with AV in my own XP VMs. Just make a backup and be prepared to overwrite XP from the backup if it has problems of any kind.

And obviously, don't put anything sensitive in there: you'd be nuts to prefer XP for serious work today, so it should be easy to avoid having personal data in there. And mind what home network access XP has.