Returnil Quirk

Discussion in 'sandboxing & virtualization' started by Franklin, Mar 21, 2008.

Thread Status:
Not open for further replies.
  1. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    While playing around with the deletevolume test I came across this quirk.

    If I use Process Explorer whilst in Returnil mode to kill crss.exe the pc instant blue screens and I have to hit the rest button and it reboots no probs back into XP with Returnil still active.

    After restarting, Winpatrol shows a Kernel Fault Check has been added as an extra startup item.No big prob but I would have thought this wouldn't or shouldn't be the case?
    Before bsod.jpg
    After bsod.jpg
     
  2. Coolio10

    Coolio10 Registered Member

    Joined:
    Sep 1, 2006
    Posts:
    1,124
    It might be programmed to do that or windows may not function properly.
     
  3. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    Here's the event viewer error with a minidump being created and saved to C:\WINDOWS after reboot with Returnil active before and after bsod/reboot.
     
  4. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi Franklin,
    First, RVS performed as expected and designed. When a BSOD like this happens, RVS will allow Windows to create, save, and check the DUMP file but does not allow Windows to keep the autorun entry for the Microsoft error reporting feature following a reboot.

    To verify this, check your autorun key for the Windows reporting feature after your system reboots to recover from your forced BSOD. The error and dump are preserved for troublshooting and support without allowing changes to the registry.

    You can just delete the dump file if it is not needed...

    Mike
     
  5. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    OK, thanks for the explanation Mike.
     
Thread Status:
Not open for further replies.