dump见附件
望解决

用户系统信息：Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; LIEBAO)

您是如何判断由防火墙导致的蓝屏？
做了哪些操作后出现蓝屏的？
请您参考此贴 http://bbs.ikaka.com/showtopic-8404665.aspx 的设置方法，补充MEMORY.DMP文件，以及以下信息：
1.操作系统类型
2.瑞星个人防火墙版本
3.是否装有其他安全类软件
感谢您对瑞星的支持！

两天内发生类似情况两次了，决定上来说说情况。不知道teddy1989是否相同情况
AMD Phenom II X4 940，8G RAM
Windows 7 7600  X64
情况描述：
1、5/9日瑞星防火墙自动更新，当时更新版本未知（5/10日蓝屏时已经删除）
2、5/10日凌晨开机，输入密码后系统蓝屏，BugCheck C5
3、使用Windbg对MEMORY.DMP进行分析，结果说是VBoxNetFlt.sys导致，但是VBox安装已经多月了，不是主因
4、删除瑞星防火墙后使用“最后一次正确配置”启动系统，网络无法使用
5、删除Rising RfwNdis Driver和Rising RfwARP Driver服务后网络恢复正常
6、5/10日下午不死心安装瑞星防火墙2012后重启后，系统卡在用户名输入后
7、再次删除瑞星防火墙2012及Rising RfwNdis Driver和Rising RfwARP Driver服务后终于正常
推测：C5蓝屏主要与驱动冲突有关，既然VBox安装已久，虽然VBox造成蓝屏，但是问题应该是Rising RfwNdis Driver和Rising RfwARP Driver服务的，仅仅推测而已，还望技术员也做调查。
PS：MEMORY.DMP压缩后也有70多M，无法放出，贴个Windbg的log吧，不过可能用处不大，
========================================================


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [J:\miniDump\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`0244f000 PsLoadedModuleList = 0xfffff800`0268ce70
Debug session time: Thu May 10 02:12:54.737 2012 (UTC + 8:00)
System Uptime: 0 days 0:07:56.627
Loading Kernel Symbols
...............................................................
...............................................................
Loading User Symbols

Loading unloaded module list
........
*******************************************************************************
*                                                                            *
*                        Bugcheck Analysis                                    *
*                                                                            *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {ea89, 2, 0, fffff800025f40f3}

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for VBoxNetFlt.sys -
Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+3aca )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                            *
*                        Bugcheck Analysis                                    *
*                                                                            *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 000000000000ea89, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800025f40f3, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP:
nt!ExFreePoolWithTag+43
fffff800`025f40f3 418b45f0        mov    eax,dword ptr [r13-10h]

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

TRAP_FRAME:  fffff880020f6770 -- (.trap 0xfffff880020f6770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000000000ea99
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800025f40f3 rsp=fffff880020f6900 rbp=fffffa8008a45e70
r8=0000000000000000  r9=0000000000000000 r10=fffffa80087cc020
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0        nv up ei pl nz na po nc
nt!ExFreePoolWithTag+0x43:
fffff800`025f40f3 418b45f0        mov    eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800024beb29 to fffff800024bf5c0

STACK_TEXT: 
fffff880`020f6628 fffff800`024beb29 : 00000000`0000000a 00000000`0000ea89 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`020f6630 fffff800`024bd7a0 : fffffa80`08bd9b60 fffffa80`089c2020 00000000`00000001 fffff800`025b1846 : nt!KiBugCheckDispatch+0x69
fffff880`020f6770 fffff800`025f40f3 : 00000000`00000000 fffff880`09acb38c fffffa80`0800273b fffff880`0123e514 : nt!KiPageFault+0x260
fffff880`020f6900 fffff880`016d5695 : fffffa80`087cc810 00000000`00000001 00000000`00000000 00000000`0000ea99 : nt!ExFreePoolWithTag+0x43
fffff880`020f69b0 fffff880`09b05aca : fffffa80`08a45e70 fffffa80`08a45e70 fffffa80`087cc810 fffffa80`0810c1a0 : ndis!NdisFreeMemory+0x15
fffff880`020f69e0 fffff880`0179062e : fffffa80`08396300 fffffa80`08a45e70 fffffa80`08a4c010 fffffa80`08a4c010 : VBoxNetFlt+0x3aca
fffff880`020f6a20 fffff880`017904fd : fffffa80`08a4c010 fffffa80`083963c0 fffffa80`08a4c010 00000000`00000000 : ndis!ndisSendCompleteWithPause+0xde
fffff880`020f6a70 fffff880`0178b46f : fffffa80`00000000 fffffa80`08a45e70 00000000`00000000 fffffa80`088b2690 : ndis!ndisMSendNetBufferListsCompleteToNdisPackets+0x9d
fffff880`020f6ac0 fffff880`0178b5ad : fffffa80`00000000 fffffa80`083963c0 fffffa80`00000001 fffffa80`00000000 : ndis!ndisMSendCompleteNetBufferListsInternal+0x10f
fffff880`020f6b60 fffff880`09810ce7 : fffffa80`0810c1a0 fffffa80`083963c0 fffffa80`089a6760 fffffa80`08975000 : ndis!NdisMSendNetBufferListsComplete+0x6d
fffff880`020f6ba0 fffff880`09804d4e : fffffa80`08a42900 fffffa80`08a42900 00000000`00000000 00000000`00000000 : Rt64win7!MpHandleSendInterrupt+0x35b
fffff880`020f6bf0 fffff880`016e9653 : 00000000`00000000 fffffa80`08a429c0 00000000`00000000 fffffa80`0810c1a0 : Rt64win7!MPHandleInterrupt+0x38a
fffff880`020f6c40 fffff800`024caa9c : fffffa80`08a429e8 fffff800`00000000 00000000`00000000 fffff880`020ce180 : ndis! ?? ::FNODOBFM::`string'+0x6f33
fffff880`020f6cd0 fffff800`024c7d8a : fffff880`020ce180 fffff880`020d8fc0 00000000`00000000 fffff880`016cec50 : nt!KiRetireDpcList+0x1bc
fffff880`020f6d80 00000000`00000000 : fffff880`020f7000 fffff880`020f1000 fffff880`020f6d40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP:
VBoxNetFlt+3aca
fffff880`09b05aca f08383b0000000ff lock add dword ptr [rbx+0B0h],0FFFFFFFFh

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  VBoxNetFlt+3aca

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: VBoxNetFlt

IMAGE_NAME:  VBoxNetFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4e4911c5

FAILURE_BUCKET_ID:  X64_0xC5_2_VBoxNetFlt+3aca

BUCKET_ID:  X64_0xC5_2_VBoxNetFlt+3aca

Followup: MachineOwner
---------

您在安装2011版瑞星个人防火墙时出现蓝屏的？还是安装2012版防火墙出现的？
如果方便，请您加Q：1752324493 将 MEMORY.DMP 传给我。
感谢您对瑞星的支持！

5/9日是瑞星防火墙2011的自动升级
5/10日手动安装的是瑞星防火墙2012版，并升级到最新版本。
已经加了Q了。

已通过QQ收到 MEMORY.DMP 文件。问题已收集反馈。

已在QQ上联系您，请您查收QQ消息。
您安装的VBox软件名称是什么？版本号是多少？出现蓝屏机器的IE浏览器版本号是多少？
建议您暂时卸载Vbox软件，单独安装2011版瑞星个人防火墙判断。
如仍出现蓝屏，请您将MEMORY.DMP发给我。感谢您对瑞星的支持！

VirtualBox 4.1.2-73507
是甲骨文公司的虚拟机程序，现已卸载

您的IE浏览器版本是多少？
卸载Vbox后是否出现蓝屏？

IE9.0
具体版本：9.0.8112.16421
Vbox卸载后不能联网