Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Windows crashed after unsuccessful access attempt from AV software #716

Open
weaponmasterjax opened this issue Dec 24, 2024 · 1 comment

Comments

@weaponmasterjax
Copy link

weaponmasterjax commented Dec 24, 2024

My PC was set to never hibernate and I left it for a virus scan overnight. In the morning it crashed. Minidump is available.
Here's the result from WinDBG:
I got the AV_btrfs!unknown_function bucket.


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff8040eeea129, Address of the instruction which caused the BugCheck
Arg3: ffff9b86e56ce470, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff8040eeea129

BUGCHECK_P3: ffff9b86e56ce470

BUGCHECK_P4: 0

FILE_IN_CAB:  122424-10359-01.dmp

DUMP_FILE_ATTRIBUTES: 0x21808
  Kernel Generated Triage Dump

FAULTING_THREAD:  ffffe70f3daf10c0

CONTEXT:  ffff9b86e56ce470 -- (.cxr 0xffff9b86e56ce470)
rax=ffffe70f3fbd6ba0 rbx=ffffe70f240691a0 rcx=0000000000000000
rdx=ffffe70f4ed376c0 rsi=0000000000000001 rdi=ffffe70f3fbd6920
rip=fffff8040eeea129 rsp=ffff9b86e56ceec0 rbp=0000000000000000
 r8=ffffe70f3fbd6920  r9=ffffe70f1e13d770 r10=ffffe70f19764170
r11=ffffe70f3fbd6ba0 r12=00000000c0000001 r13=ffffe70f3384e5c0
r14=ffffe70f429d5640 r15=0000000000000001
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
btrfs+0x2a129:
fffff804`0eeea129 488b4970        mov     rcx,qword ptr [rcx+70h] ds:002b:00000000`00000070=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  HipsDaemon.exe

STACK_TEXT:  
ffff9b86`e56ceec0 ffffe70f`3f3b39b0     : 00000000`00000010 00000000`00000010 ffffe70f`19764170 ffffe70f`3fbd6920 : btrfs+0x2a129
ffff9b86`e56ceec8 00000000`00000010     : 00000000`00000010 ffffe70f`19764170 ffffe70f`3fbd6920 fffff804`4ecd3757 : 0xffffe70f`3f3b39b0
ffff9b86`e56ceed0 00000000`00000010     : ffffe70f`19764170 ffffe70f`3fbd6920 fffff804`4ecd3757 ffffe70f`3f3b39b0 : 0x10
ffff9b86`e56ceed8 ffffe70f`19764170     : ffffe70f`3fbd6920 fffff804`4ecd3757 ffffe70f`3f3b39b0 00000000`00000010 : 0x10
ffff9b86`e56ceee0 ffffe70f`3fbd6920     : fffff804`4ecd3757 ffffe70f`3f3b39b0 00000000`00000010 00000000`00000010 : 0xffffe70f`19764170
ffff9b86`e56ceee8 fffff804`4ecd3757     : ffffe70f`3f3b39b0 00000000`00000010 00000000`00000010 00000000`00000000 : 0xffffe70f`3fbd6920
ffff9b86`e56ceef0 ffffe70f`3f3b39b0     : 00000000`00000010 00000000`00000010 00000000`00000000 ffff96d1`1653726a : sysdiag+0x53757
ffff9b86`e56ceef8 00000000`00000010     : 00000000`00000010 00000000`00000000 ffff96d1`1653726a fffff804`7aead8b2 : 0xffffe70f`3f3b39b0
ffff9b86`e56cef00 00000000`00000010     : 00000000`00000000 ffff96d1`1653726a fffff804`7aead8b2 ffff96d1`1653721a : 0x10
ffff9b86`e56cef08 00000000`00000000     : ffff96d1`1653726a fffff804`7aead8b2 ffff96d1`1653721a fffff804`7aead8b2 : 0x10


SYMBOL_NAME:  btrfs+2a129

MODULE_NAME: btrfs

IMAGE_NAME:  btrfs.sys

STACK_COMMAND:  .cxr 0xffff9b86e56ce470 ; kb

BUCKET_ID_FUNC_OFFSET:  2a129

FAILURE_BUCKET_ID:  AV_btrfs!unknown_function

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {b85fd618-58a2-ec48-a3ed-69e8ccffae13}

Followup:     MachineOwner
---------

I also have minidump file avail:
122424-10359-01.dmp

As we can see, Hipsdamon is Huorong Internet Security software's component.

@weaponmasterjax
Copy link
Author

#696 looks the same like this one but my drive is a M.2 NVME one installed on mobo.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant