BSOD 0x50 Page Fault - Only When IE Is Run

[san1965]

Hi,

My problem is that the IE on my machine gives a BSOD within a few seconds of invocation. All other applications continue to work smoothly, including MSN Messenger and other browsers. My OS is XPSP3.

The error message is STOP: 0x0050 followed by a memory dump. I am attaching the dump here if it is of any help.

The first time I got this error, the IE was 7.0. I uninstalled it, to drop down to IE 6.0. Still the same problem. When I tried to install IE 8.0, during the installation process itself the BSOD occurred.

I very much appreciate your guidance on this problem...

Thanks in advance...

 

[Kcircyrd]

We are more interested in the age of the hard drive, and the amount of memory installed... and what you find in Antispyware scans.
What are your video graphics files?
What are the results of your defragmentation scans?
These IE errors are odd, and deserve further review.

 

[san1965]

Hardware Details - BSOD Problem

Hello Kcircyrd,

Thank you for your guidance, much appreciated.

Here are the details asked for by you:

Hard disk:
Hard Drive 1 - 232.88 Gb, about 3.5 years old
Hard Drive 2 - 465.76 Gb, about 1 month old

RAM:
DDR2 533Mhz, 2 Gb

Antispyware scans: I have Norton Antivirus 2009 installed, and it has reported nil spyware.

Video Graphics Files: Where can this information be found? In the Device manager, I found Intel G965 Express Chipset family mentioned.

Defragmentation scans: I carried them out for C: just now, and it has reported nothing untoward.

My CPU is Intel 2.66Ghz dual core. My hard disk has Win XPSP3 and Win Srvr 2008. Motherboard is DG965RY. Because the onboard audio has some problem, I have had to install a third-party sound card (Yamaha). But the BSOD occurs even when the soundcard is taken out and IE invoked.

Thanks in advance for all your help...

 

[Route44]

The mods will most likely move this to the BSOD subforum in the Windows OS board. Anyway...

Your error is 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
Requested data was not in memory. An invalid system memory address was referenced. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause this Stop message, as may other hardware problems (e.g., incorrect SCSI termination or a flawed PCI card).

The driver cited as causing your issue is symevent.sys and this belongs to your Norton Security software. We have lost count here of the number of people who have had issues with Norton/Symantec.

It would explain your issues with IE because Norton engages as IE engages and if there are conflicts... crash.

Three suggestions: 1) Update, 2) Uninstall and reinstall, or 3) Completely uninstall (you'll have to also use their specail removal tool) and get better solutions.

 

[san1965]

SymEvent.Sys Problem...

Hello Route44,

Thank you for your inputs; much appreciated!

I had managed to download and run a software called WinDbg from MS site. According to the software, the problem was detected in NtKrnlPA.exe file (something to do with the date/time stamp not matching). Are you sure that is Norton's SymEvent.Exe that is the cause of the problem?

Thanks again in advance...

 

[Route44]

Here is your minidump. I highlighted the error and probable cause:


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Jim\Desktop\Other Dumps\Mini100109-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/downloads/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp3_gdr.090206-1234
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Oct 1 07:42:15.140 2009 (GMT-4)
System Uptime: 0 days 3:22:18.833
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffffb0, 0, 8054b51a, 0}


Could not read faulting driver name
Unable to load image \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
Probably caused by : SYMEVENT.SYS ( SYMEVENT+14449 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffb0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054b51a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: ffffffb0

FAULTING_IP:
nt!ExFreePoolWithTag+23a
8054b51a 668b4efa mov cx,word ptr [esi-6]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

TRAP_FRAME: a901ba10 -- (.trap ffffffffa901ba10)
ErrCode = 00000000
eax=ffffff00 ebx=ffffffba ecx=8055a120 edx=000006ae esi=ffffffb6 edi=00000000
eip=8054b51a esp=a901ba84 ebp=a901bab8 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExFreePoolWithTag+0x23a:
8054b51a 668b4efa mov cx,word ptr [esi-6] ds:0023:ffffffb0=????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8052037a to 804f9f43

STACK_TEXT:
a901b990 8052037a 00000050 ffffffb0 00000000 nt!KeBugCheckEx+0x1b
a901b9f8 80544588 00000000 ffffffb0 00000000 nt!MmAccessFault+0x9a8
a901b9f8 8054b51a 00000000 ffffffb0 00000000 nt!KiTrap0E+0xd0
a901bab8 806339fd ffffffb6 00000000 e10dbd78 nt!ExFreePoolWithTag+0x23a
a901bad4 8063402b e10dbd78 e1073288 e102921c nt!CmpCleanUpKcbValueCache+0x51
a901bae8 8063c6e6 e105d378 e582cb60 8063c802 nt!CmpCleanUpKcbCacheWithLock+0x19
a901baf4 8063c802 a901bb08 80634130 e1073288 nt!CmpGetDelayedCloseIndex+0x16
a901bafc 80634130 e1073288 a901bb14 80634572 nt!CmpAddToDelayedClose+0xa
a901bb08 80634572 e1073288 a901bb2c 80637004 nt!CmpDereferenceKeyControlBlockWithLock+0x48
a901bb14 80637004 e1073288 00000000 e1202da0 nt!CmpDereferenceKeyControlBlock+0x12
a901bb2c 805bb472 e1202db8 00000000 e1202da0 nt!CmpDeleteKeyObject+0x92
a901bb48 805266da e1202db8 00000000 000009d8 nt!ObpRemoveObjectRoutine+0xe0
a901bb60 805bc347 0000018a 000009d8 e14c13b0 nt!ObfDereferenceObject+0x4c
a901bb78 805c29eb e1ad9350 e1202db8 000009d8 nt!ObpCloseHandleTableEntry+0x155
a901bb98 8060da45 e14c13b0 000009d8 a901bbd8 nt!ObpCloseHandleProcedure+0x1f
a901bbb8 805c2ae4 e1ad9350 805c29cc a901bbd8 nt!ExSweepHandleTable+0x3b
a901bbe4 805d267b 847ddaf0 84650020 84650268 nt!ObKillProcess+0x5c
a901bc84 805d28d4 00000000 84650020 00000000 nt!PspExitThread+0x5e9
a901bca4 805d2aaf 84650020 00000000 c0000001 nt!PspTerminateThreadByPointer+0x52
a901bcd0 aa49b449 00000000 00000000 85c4f228 nt!NtTerminateProcess+0x105
WARNING: Stack unwind information not available. Following frames may be wrong.
a901bd54 8054162c ffffffff 00000000 0012f92c SYMEVENT+0x14449
a901bd54 7c90de6e ffffffff 00000000 0012f92c nt!KiFastCallEntry+0xfc
0000003b 00000000 00000000 00000000 00000000 0x7c90de6e


STACK_COMMAND: kb

FOLLOWUP_IP:
SYMEVENT+14449
aa49b449 ?? ???

SYMBOL_STACK_INDEX: 14

SYMBOL_NAME: SYMEVENT+14449

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4a428942

FAILURE_BUCKET_ID: 0x50_SYMEVENT+14449

BUCKET_ID: 0x50_SYMEVENT+14449

Followup: MachineOwner
---------

0: kd> lmvm SYMEVENT
start end module name
aa487000 aa4ac000 SYMEVENT T (no symbols)
Loaded symbol image file: SYMEVENT.SYS
Image path: \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
Image name: SYMEVENT.SYS
Timestamp: Wed Jun 24 16:14:58 2009 (4A428942)
CheckSum: 00024D55
ImageSize: 00025000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

 

[san1965]

Removing Norton Antivirus

Hello Route44,

Thank you for your guidance; much, much appreciated.

Since removing Norton (along with its associated LiveUpdate and LiveUpdateNotice) was a messy affair last time, I have opened a support ticket on the symantec website for my issue. Their knowledge base acknowledges the problem with SymEvent.sys vis-a-vis 0x50 BSOD only for AV versions of 2003 and 2005, but I have version 2009! My fear is that they might turn around and ask me to wait for some patch program, which might be anywhere between 1 month to 6 months! And to think that Norton 2009 and IE7.0 had been co-existing peacefully for all these years without any clashes...

Thank you once again...

P.S.: Just out of curiosity, I am providing my version of the output generated by the same WinDbg program that was used by you to pinpoint the problem to SymEvent. My version shows the problem is with NtKrnlPa.exe....

--- START OF OUTPUT ---

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini100109-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: D:\Windows Diagnostics\DebugSymbols\ListOfSymbols
Executable search path is:
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Oct 1 17:12:15.140 2009 (GMT+6)
System Uptime: 0 days 3:22:18.833
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffffb0, 0, 8054b51a, 0}
*** WARNING: Unable to verify timestamp for mssmbios.sys
Could not read faulting driver name
Probably caused by : ntkrnlpa.exe ( nt!CcTwilightLookasideList+1a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffb0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054b51a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: ffffffb0
FAULTING_IP:
nt!CcTwilightLookasideList+1a
8054b51a ?? ???
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from 8052037a to 804f9f43
STACK_TEXT:
a901b990 8052037a 00000050 ffffffb0 00000000 nt!KeSetTargetProcessorDpc+0xf
a901b99c 00000000 a901ba10 00000000 ffffffb0 nt!MiRemoveWsle+0xa
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!CcTwilightLookasideList+1a
8054b51a ?? ???
SYMBOL_NAME: nt!CcTwilightLookasideList+1a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlpa.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3
FAILURE_BUCKET_ID: 0x50_nt!CcTwilightLookasideList+1a
BUCKET_ID: 0x50_nt!CcTwilightLookasideList+1a
Followup: MachineOwner
---------

---- END OF OUTPUT ---

 

[Route44]

That driver is one of your OS drivers and they are often too general to be of much help.

So what you are saying is that Symantec doesn't have a removal tool for their 2009 version? And as you point out Symantec software removal can be messy which is a major problem with their product.

 

[san1965]

Removing Norton 2009

Hello Route44,

Thank you for your guidance; appreciated.

Norton 2009 has a standard procedure for removal (the Add/Remove Programs route). My point was that their knowledgebase does not explicitly acknowledge that Norton 2009 might have an issue with SymEvent.sys, vis-a-vis XP; though they have an entry that discusses the procedure to handle similar problem for earlier versions.

Yes, I did face difficulties in uninstalling Norton in earlier such episodes. Iirc, that was about 3 years ago.

I am proceeding to uninstall Norton 2009 now, and see what effect it has on IE's performance.

Thanks again...