Article ID: 117818, created on Oct 9, 2013, last review on May 6, 2014

  • Applies to:
  • Virtuozzo containers for Windows


  1. The hardware node experiences BSOD, pointing to vzcore.sys driver.

    Memory dump analysis produces the following (or similar) call stack :

    Child-SP          RetAddr           Call Site
    fffff880`88aa05c0 fffff800`01c4126d nt!ExfReleasePushLock+0x62
    fffff880`88aa05f0 fffff880`0c7095d5 nt! ?? ::NNGAKEGL::`string'+0x56aea
    fffff880`88aa07e0 fffff800`005fd000 vzcore!MyCmLoadKey+0x555
    fffff880`88aa0920 fffff880`88aa0950 0xfffff800`005fd000
    fffff880`88aa0928 00000000`00000000 0xfffff880`88aa0950
  2. (Or) The hardware node hangs completely on a mass container start-up event.


The issue can be caused by Windows Defender service running inside the container. It produces great load on the registry.

It is highly not recommended to use any Antivirus solution inside containers. A hardware node should have its own Antivirus, which provides protection for containers as well.


Check if Windows Defender service is running inside the containers and disable it.

The following command will stop and disable Windows Defender in all running containers :

for /f %i in ('vzlist -Ho ctid') do vzctl exec %i sc stop windefend && vzctl exec %i sc config windefend start= disabled

Search Words



Windows Defender

The computer has rebooted from a bugcheck




965b49118115a610e93635d21c5694a8 2897d76d56d2010f4e3a28f864d69223 d02f9caf3e11b191a38179103495106f

Email subscription for changes to this article
Save as PDF