TechSpot

BSOD 0x50 Page Fault - Only When IE Is Run

By san1965
Oct 7, 2009
  1. Hi,

    My problem is that the IE on my machine gives a BSOD within a few seconds of invocation. All other applications continue to work smoothly, including MSN Messenger and other browsers. My OS is XPSP3.

    The error message is STOP: 0x0050 followed by a memory dump. I am attaching the dump here if it is of any help.

    The first time I got this error, the IE was 7.0. I uninstalled it, to drop down to IE 6.0. Still the same problem. When I tried to install IE 8.0, during the installation process itself the BSOD occurred.

    I very much appreciate your guidance on this problem...

    Thanks in advance...
     
  2. Kcircyrd

    Kcircyrd TS Rookie Posts: 216

    We are more interested in the age of the hard drive, and the amount of memory installed... and what you find in Antispyware scans.
    What are your video graphics files?
    What are the results of your defragmentation scans?
    These IE errors are odd, and deserve further review.
     
  3. san1965

    san1965 TS Rookie Topic Starter

    Hardware Details - BSOD Problem

    Hello Kcircyrd,

    Thank you for your guidance, much appreciated.

    Here are the details asked for by you:

    Hard disk:
    Hard Drive 1 - 232.88 Gb, about 3.5 years old
    Hard Drive 2 - 465.76 Gb, about 1 month old

    RAM:
    DDR2 533Mhz, 2 Gb

    Antispyware scans: I have Norton Antivirus 2009 installed, and it has reported nil spyware.

    Video Graphics Files: Where can this information be found? In the Device manager, I found Intel G965 Express Chipset family mentioned.

    Defragmentation scans: I carried them out for C: just now, and it has reported nothing untoward.

    My CPU is Intel 2.66Ghz dual core. My hard disk has Win XPSP3 and Win Srvr 2008. Motherboard is DG965RY. Because the onboard audio has some problem, I have had to install a third-party sound card (Yamaha). But the BSOD occurs even when the soundcard is taken out and IE invoked.

    Thanks in advance for all your help...
     
  4. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    The mods will most likely move this to the BSOD subforum in the Windows OS board. Anyway...

    Your error is 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
    Requested data was not in memory. An invalid system memory address was referenced. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause this Stop message, as may other hardware problems (e.g., incorrect SCSI termination or a flawed PCI card).

    The driver cited as causing your issue is symevent.sys and this belongs to your Norton Security software. We have lost count here of the number of people who have had issues with Norton/Symantec.

    It would explain your issues with IE because Norton engages as IE engages and if there are conflicts... crash.

    Three suggestions: 1) Update, 2) Uninstall and reinstall, or 3) Completely uninstall (you'll have to also use their specail removal tool) and get better solutions.
     
  5. san1965

    san1965 TS Rookie Topic Starter

    SymEvent.Sys Problem...

    Hello Route44,

    Thank you for your inputs; much appreciated!

    I had managed to download and run a software called WinDbg from MS site. According to the software, the problem was detected in NtKrnlPA.exe file (something to do with the date/time stamp not matching). Are you sure that is Norton's SymEvent.Exe that is the cause of the problem?

    Thanks again in advance...
     
  6. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    Here is your minidump. I highlighted the error and probable cause:


    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\Jim\Desktop\Other Dumps\Mini100109-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/downloads/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
    Product: WinNt
    Built by: 2600.xpsp_sp3_gdr.090206-1234
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
    Debug session time: Thu Oct 1 07:42:15.140 2009 (GMT-4)
    System Uptime: 0 days 3:22:18.833
    Loading Kernel Symbols
    ............................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ...................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {ffffffb0, 0, 8054b51a, 0}


    Could not read faulting driver name
    Unable to load image \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS, Win32 error 2
    *** WARNING: Unable to verify timestamp for SYMEVENT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
    Probably caused by : SYMEVENT.SYS ( SYMEVENT+14449 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: ffffffb0, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: 8054b51a, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: ffffffb0

    FAULTING_IP:
    nt!ExFreePoolWithTag+23a
    8054b51a 668b4efa mov cx,word ptr [esi-6]

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    TRAP_FRAME: a901ba10 -- (.trap ffffffffa901ba10)
    ErrCode = 00000000
    eax=ffffff00 ebx=ffffffba ecx=8055a120 edx=000006ae esi=ffffffb6 edi=00000000
    eip=8054b51a esp=a901ba84 ebp=a901bab8 iopl=0 nv up ei pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
    nt!ExFreePoolWithTag+0x23a:
    8054b51a 668b4efa mov cx,word ptr [esi-6] ds:0023:ffffffb0=????
    Resetting default scope

    LAST_CONTROL_TRANSFER: from 8052037a to 804f9f43

    STACK_TEXT:
    a901b990 8052037a 00000050 ffffffb0 00000000 nt!KeBugCheckEx+0x1b
    a901b9f8 80544588 00000000 ffffffb0 00000000 nt!MmAccessFault+0x9a8
    a901b9f8 8054b51a 00000000 ffffffb0 00000000 nt!KiTrap0E+0xd0
    a901bab8 806339fd ffffffb6 00000000 e10dbd78 nt!ExFreePoolWithTag+0x23a
    a901bad4 8063402b e10dbd78 e1073288 e102921c nt!CmpCleanUpKcbValueCache+0x51
    a901bae8 8063c6e6 e105d378 e582cb60 8063c802 nt!CmpCleanUpKcbCacheWithLock+0x19
    a901baf4 8063c802 a901bb08 80634130 e1073288 nt!CmpGetDelayedCloseIndex+0x16
    a901bafc 80634130 e1073288 a901bb14 80634572 nt!CmpAddToDelayedClose+0xa
    a901bb08 80634572 e1073288 a901bb2c 80637004 nt!CmpDereferenceKeyControlBlockWithLock+0x48
    a901bb14 80637004 e1073288 00000000 e1202da0 nt!CmpDereferenceKeyControlBlock+0x12
    a901bb2c 805bb472 e1202db8 00000000 e1202da0 nt!CmpDeleteKeyObject+0x92
    a901bb48 805266da e1202db8 00000000 000009d8 nt!ObpRemoveObjectRoutine+0xe0
    a901bb60 805bc347 0000018a 000009d8 e14c13b0 nt!ObfDereferenceObject+0x4c
    a901bb78 805c29eb e1ad9350 e1202db8 000009d8 nt!ObpCloseHandleTableEntry+0x155
    a901bb98 8060da45 e14c13b0 000009d8 a901bbd8 nt!ObpCloseHandleProcedure+0x1f
    a901bbb8 805c2ae4 e1ad9350 805c29cc a901bbd8 nt!ExSweepHandleTable+0x3b
    a901bbe4 805d267b 847ddaf0 84650020 84650268 nt!ObKillProcess+0x5c
    a901bc84 805d28d4 00000000 84650020 00000000 nt!PspExitThread+0x5e9
    a901bca4 805d2aaf 84650020 00000000 c0000001 nt!PspTerminateThreadByPointer+0x52
    a901bcd0 aa49b449 00000000 00000000 85c4f228 nt!NtTerminateProcess+0x105
    WARNING: Stack unwind information not available. Following frames may be wrong.
    a901bd54 8054162c ffffffff 00000000 0012f92c SYMEVENT+0x14449
    a901bd54 7c90de6e ffffffff 00000000 0012f92c nt!KiFastCallEntry+0xfc
    0000003b 00000000 00000000 00000000 00000000 0x7c90de6e


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    SYMEVENT+14449
    aa49b449 ?? ???

    SYMBOL_STACK_INDEX: 14

    SYMBOL_NAME: SYMEVENT+14449

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: SYMEVENT

    IMAGE_NAME: SYMEVENT.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a428942

    FAILURE_BUCKET_ID: 0x50_SYMEVENT+14449

    BUCKET_ID: 0x50_SYMEVENT+14449

    Followup: MachineOwner
    ---------

    0: kd> lmvm SYMEVENT
    start end module name
    aa487000 aa4ac000 SYMEVENT T (no symbols)
    Loaded symbol image file: SYMEVENT.SYS
    Image path: \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
    Image name: SYMEVENT.SYS
    Timestamp: Wed Jun 24 16:14:58 2009 (4A428942)
    CheckSum: 00024D55
    ImageSize: 00025000
    Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
     
  7. san1965

    san1965 TS Rookie Topic Starter

    Removing Norton Antivirus

    Hello Route44,

    Thank you for your guidance; much, much appreciated.

    Since removing Norton (along with its associated LiveUpdate and LiveUpdateNotice) was a messy affair last time, I have opened a support ticket on the symantec website for my issue. Their knowledge base acknowledges the problem with SymEvent.sys vis-a-vis 0x50 BSOD only for AV versions of 2003 and 2005, but I have version 2009! My fear is that they might turn around and ask me to wait for some patch program, which might be anywhere between 1 month to 6 months! And to think that Norton 2009 and IE7.0 had been co-existing peacefully for all these years without any clashes...

    Thank you once again...

    P.S.: Just out of curiosity, I am providing my version of the output generated by the same WinDbg program that was used by you to pinpoint the problem to SymEvent. My version shows the problem is with NtKrnlPa.exe....

    --- START OF OUTPUT ---

    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.
    Loading Dump File [C:\WINDOWS\Minidump\Mini100109-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: D:\Windows Diagnostics\DebugSymbols\ListOfSymbols
    Executable search path is:
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
    Product: WinNt
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
    Debug session time: Thu Oct 1 17:12:15.140 2009 (GMT+6)
    System Uptime: 0 days 3:22:18.833
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .............
    Loading User Symbols
    Loading unloaded module list
    ...................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 50, {ffffffb0, 0, 8054b51a, 0}
    *** WARNING: Unable to verify timestamp for mssmbios.sys
    Could not read faulting driver name
    Probably caused by : ntkrnlpa.exe ( nt!CcTwilightLookasideList+1a )
    Followup: MachineOwner
    ---------
    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: ffffffb0, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: 8054b51a, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)
    Debugging Details:
    ------------------
    Could not read faulting driver name
    READ_ADDRESS: ffffffb0
    FAULTING_IP:
    nt!CcTwilightLookasideList+1a
    8054b51a ?? ???
    MM_INTERNAL_CODE: 0
    CUSTOMER_CRASH_COUNT: 2
    DEFAULT_BUCKET_ID: DRIVER_FAULT
    BUGCHECK_STR: 0x50
    LAST_CONTROL_TRANSFER: from 8052037a to 804f9f43
    STACK_TEXT:
    a901b990 8052037a 00000050 ffffffb0 00000000 nt!KeSetTargetProcessorDpc+0xf
    a901b99c 00000000 a901ba10 00000000 ffffffb0 nt!MiRemoveWsle+0xa
    STACK_COMMAND: .bugcheck ; kb
    FOLLOWUP_IP:
    nt!CcTwilightLookasideList+1a
    8054b51a ?? ???
    SYMBOL_NAME: nt!CcTwilightLookasideList+1a
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME: ntkrnlpa.exe
    DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3
    FAILURE_BUCKET_ID: 0x50_nt!CcTwilightLookasideList+1a
    BUCKET_ID: 0x50_nt!CcTwilightLookasideList+1a
    Followup: MachineOwner
    ---------

    ---- END OF OUTPUT ---
     
  8. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    That driver is one of your OS drivers and they are often too general to be of much help.

    So what you are saying is that Symantec doesn't have a removal tool for their 2009 version? And as you point out Symantec software removal can be messy which is a major problem with their product.
     
  9. san1965

    san1965 TS Rookie Topic Starter

    Removing Norton 2009

    Hello Route44,

    Thank you for your guidance; appreciated.

    Norton 2009 has a standard procedure for removal (the Add/Remove Programs route). My point was that their knowledgebase does not explicitly acknowledge that Norton 2009 might have an issue with SymEvent.sys, vis-a-vis XP; though they have an entry that discusses the procedure to handle similar problem for earlier versions.

    Yes, I did face difficulties in uninstalling Norton in earlier such episodes. Iirc, that was about 3 years ago.

    I am proceeding to uninstall Norton 2009 now, and see what effect it has on IE's performance.

    Thanks again...
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...