两天内发生类似情况两次了，决定上来说说情况。不知道teddy1989是否相同情况
AMD Phenom II X4 940，8G RAM
Windows 7 7600 X64
情况描述：
1、5/9日瑞星防火墙自动更新，当时更新版本未知（5/10日蓝屏时已经删除）
2、5/10日凌晨开机，输入密码后系统蓝屏，BugCheck C5
3、使用Windbg对MEMORY.DMP进行分析，结果说是VBoxNetFlt.sys导致，但是VBox安装已经多月了，不是主因
4、删除瑞星防火墙后使用“最后一次正确配置”启动系统，网络无法使用
5、删除Rising RfwNdis Driver和Rising RfwARP Driver服务后网络恢复正常
6、5/10日下午不死心安装瑞星防火墙2012后重启后，系统卡在用户名输入后
7、再次删除瑞星防火墙2012及Rising RfwNdis Driver和Rising RfwARP Driver服务后终于正常
推测：C5蓝屏主要与驱动冲突有关，既然VBox安装已久，虽然VBox造成蓝屏，但是问题应该是Rising RfwNdis Driver和Rising RfwARP Driver服务的，仅仅推测而已，还望技术员也做调查。
PS：MEMORY.DMP压缩后也有70多M，无法放出，贴个Windbg的log吧，不过可能用处不大，
========================================================
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [J:\miniDump\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\Symbols*
http://msdl.microsoft.com/download/symbolsExecutable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`0244f000 PsLoadedModuleList = 0xfffff800`0268ce70
Debug session time: Thu May 10 02:12:54.737 2012 (UTC + 8:00)
System Uptime: 0 days 0:07:56.627
Loading Kernel Symbols
...............................................................
...............................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C5, {ea89, 2, 0, fffff800025f40f3}
*** ERROR: Symbol file could not be found. Defaulted to export symbols for VBoxNetFlt.sys -
Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+3aca )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 000000000000ea89, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800025f40f3, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExFreePoolWithTag+43
fffff800`025f40f3 418b45f0 mov eax,dword ptr [r13-10h]
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
TRAP_FRAME: fffff880020f6770 -- (.trap 0xfffff880020f6770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000000000ea99
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800025f40f3 rsp=fffff880020f6900 rbp=fffffa8008a45e70
r8=0000000000000000 r9=0000000000000000 r10=fffffa80087cc020
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!ExFreePoolWithTag+0x43:
fffff800`025f40f3 418b45f0 mov eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800024beb29 to fffff800024bf5c0
STACK_TEXT:
fffff880`020f6628 fffff800`024beb29 : 00000000`0000000a 00000000`0000ea89 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`020f6630 fffff800`024bd7a0 : fffffa80`08bd9b60 fffffa80`089c2020 00000000`00000001 fffff800`025b1846 : nt!KiBugCheckDispatch+0x69
fffff880`020f6770 fffff800`025f40f3 : 00000000`00000000 fffff880`09acb38c fffffa80`0800273b fffff880`0123e514 : nt!KiPageFault+0x260
fffff880`020f6900 fffff880`016d5695 : fffffa80`087cc810 00000000`00000001 00000000`00000000 00000000`0000ea99 : nt!ExFreePoolWithTag+0x43
fffff880`020f69b0 fffff880`09b05aca : fffffa80`08a45e70 fffffa80`08a45e70 fffffa80`087cc810 fffffa80`0810c1a0 : ndis!NdisFreeMemory+0x15
fffff880`020f69e0 fffff880`0179062e : fffffa80`08396300 fffffa80`08a45e70 fffffa80`08a4c010 fffffa80`08a4c010 : VBoxNetFlt+0x3aca
fffff880`020f6a20 fffff880`017904fd : fffffa80`08a4c010 fffffa80`083963c0 fffffa80`08a4c010 00000000`00000000 : ndis!ndisSendCompleteWithPause+0xde
fffff880`020f6a70 fffff880`0178b46f : fffffa80`00000000 fffffa80`08a45e70 00000000`00000000 fffffa80`088b2690 : ndis!ndisMSendNetBufferListsCompleteToNdisPackets+0x9d
fffff880`020f6ac0 fffff880`0178b5ad : fffffa80`00000000 fffffa80`083963c0 fffffa80`00000001 fffffa80`00000000 : ndis!ndisMSendCompleteNetBufferListsInternal+0x10f
fffff880`020f6b60 fffff880`09810ce7 : fffffa80`0810c1a0 fffffa80`083963c0 fffffa80`089a6760 fffffa80`08975000 : ndis!NdisMSendNetBufferListsComplete+0x6d
fffff880`020f6ba0 fffff880`09804d4e : fffffa80`08a42900 fffffa80`08a42900 00000000`00000000 00000000`00000000 : Rt64win7!MpHandleSendInterrupt+0x35b
fffff880`020f6bf0 fffff880`016e9653 : 00000000`00000000 fffffa80`08a429c0 00000000`00000000 fffffa80`0810c1a0 : Rt64win7!MPHandleInterrupt+0x38a
fffff880`020f6c40 fffff800`024caa9c : fffffa80`08a429e8 fffff800`00000000 00000000`00000000 fffff880`020ce180 : ndis! ?? ::FNODOBFM::`string'+0x6f33
fffff880`020f6cd0 fffff800`024c7d8a : fffff880`020ce180 fffff880`020d8fc0 00000000`00000000 fffff880`016cec50 : nt!KiRetireDpcList+0x1bc
fffff880`020f6d80 00000000`00000000 : fffff880`020f7000 fffff880`020f1000 fffff880`020f6d40 00000000`00000000 : nt!KiIdleLoop+0x5a
STACK_COMMAND: kb
FOLLOWUP_IP:
VBoxNetFlt+3aca
fffff880`09b05aca f08383b0000000ff lock add dword ptr [rbx+0B0h],0FFFFFFFFh
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: VBoxNetFlt+3aca
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: VBoxNetFlt
IMAGE_NAME: VBoxNetFlt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e4911c5
FAILURE_BUCKET_ID: X64_0xC5_2_VBoxNetFlt+3aca
BUCKET_ID: X64_0xC5_2_VBoxNetFlt+3aca
Followup: MachineOwner
---------