ntfs.sys PAGE FAULT IN NONPAGE AREA bluescreen

Ntfs.sys Page_fault Bsod Bluescreen Help!

Hiya,

I've been reading your responses about the BSOD and ntfs.sys files. Hopefully someone can lend a hand with their expertise!

I got the bsod one day out of the blue. Nothing changed. I've reseated ram, same thing. I cannot boot to the drive at all. Infininte reboot cycle. Can't load ghost as it locks. Can't boot hdd as slave as pc reboots. Cannot get to safe mode. Cannot access drive in anyway, shape or form except via ntfsdos but read only. Cannot chkdsk /f...Nothing. I'm stuck and have been banging my head for 3 days now until I came across the posts.

Thanks so much in advance if anyone can help.


dump below-------


Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Administrator\Desktop\RBEAR PC CRASH FILES\MINI08~1.DMP]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
********************************************************************** ******
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
********************************************************************** ******
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Aug 30 01:20:11.843 2005 (GMT-4)
System Uptime: 0 days 0:20:45.428
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...................................................................... ...................................................................... ............................................
Loading unloaded module list
..........
Loading User Symbols
********************************************************************** *********
* *
* Bugcheck Analysis *
* *
********************************************************************** *********

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {f12ac544, 1, f84b4f4e, 3}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
********************************************************************** ***
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***

Hi.
Surprisingly I'm having the same problem as well.
It happened one day, out of the blue, there was a blue screen.
PAGE FAULT IN NONPAGE AREA.

Now sometimes when windows is starting or when i'm uninstalling a program and even when i'm browsing the internet , the blue screen will appear.

I have no idea what is wrong. I've attached the minidumps and I hope the experts here will shed me some light.


Thanks

can anyone help me out???

i got errors when I use xp.

it ramdomly restart or i get a blue screen

i have a minidump file can anyone fix this.


please reply..... need to fix this before it becomes worst .......

help!!!!!

Hi, i am new to this site and have just signed up, i have been having a lot of problems with my pc. I will sometimes recieve the Windows stop error screen and it seems like a few system files may be corrupt. One that i noticed last nite was ntfs.sys. I also find that when i run programs a windows error message will appear. I am not sure wot to do?? r these the symptoms of bad ram. Please help drws2kuk

minidumps

I am not sure whether this is the stuff to be anaylsed but would appreciate it if someone could help me out

Hi,
All of your minidumps crash at nt!RtlInitUnicodeString+1b. I have no idea why your windows crash. Probably it is faulty ram but I am not sure. Maybe some experts have the answer.

Hi goneout,

5 of your minidumps have memory corruption. Probably it is overheat within the CPU or m/b. If your PC is not overheat, it is faulty ram.


AGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e1340c84, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bfdba85c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e1340c84

FAULTING_IP:
nv4_bfdb0000+a85c
bfdba85c ?? ???

MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 00000000 to bfdba85c

TRAP_FRAME: f844d1f4 -- (.trap fffffffff844d1f4)
ErrCode = 00000000
eax=e1ae54b8 ebx=00001500 ecx=0000005e edx=0000000e esi=e1340c70 edi=00000240
eip=bfdba85c esp=f844d268 ebp=f844d274 iopl=0 nv up ei ng nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
nv4_bfdb0000+0xa85c:
bfdba85c ?? ???
Resetting default scope

STACK_TEXT:
f844d264 00000000 00000180 e1ae5010 f844d290 nv4_bfdb0000+0xa85c

CHKIMG_EXTENSION: !chkimg -lo 50 -d !hal
806b5fa9-806b5faa 2 bytes - hal!KeGetCurrentIrql+a85
[ 00 00:40 38 ]
806b5fad-806b5fae 2 bytes - hal!KeGetCurrentIrql+a89 (+0x04)
[ 00 00:02 10 ]
806b5fb0-806b5fb6 7 bytes - hal!KeGetCurrentIrql+a8c (+0x03)
[ 00 00 00 00 00 00 00:62 50 70 73 df ff 02 ]
806b5fb8-806b5fb9 2 bytes - hal!KeGetCurrentIrql+a94 (+0x08)
[ 00 00:d4 03 ]
806b5fbb-806b5fbc 2 bytes - hal!KeGetCurrentIrql+a97 (+0x03)
[ 00 00:20 79 ]
806b5fbf-806b5fc0 2 bytes - hal!KeGetCurrentIrql+a9b (+0x04)
[ 00 00:30 79 ]
806b5fc3-806b5fc4 2 bytes - hal!KeGetCurrentIrql+a9f (+0x04)
[ 00 00:40 38 ]
806b5fc6-806b5fc8 3 bytes - hal!KeGetCurrentIrql+aa2 (+0x03)
[ 00 00 00:08 06 68 ]
806b5fca-806b5fd0 7 bytes - hal!KeGetCurrentIrql+aa6 (+0x04)
[ 00 00 00 00 00 00 00:62 50 f0 89 df ff 40 ]
806b5fd2-806b5fd7 6 bytes - hal!KeGetCurrentIrql+aae (+0x08)
[ 00 00 00 00 00 00:c4 03 40 10 4d 80 ]
806b5fdb-806b5fdf 5 bytes - hal!KeGetCurrentIrql+ab7 (+0x09)
[ 00 00 00 00 00:10 eb a8 01 01 ]
806b5fe2-806b5fe7 6 bytes - hal!KeGetCurrentIrql+abe (+0x07)
[ 00 00 00 00 00 00:a7 73 04 80 e2 1f ]
806b5feb - hal!KeGetCurrentIrql+ac7 (+0x09)
[ 00:f0 ]
806b5fee-806b5ffa 13 bytes - hal!KeGetCurrentIrql+aca (+0x03)
[ 00 00 00 00 00 00 00 00:30 cd fa 0f 10 73 2c 99 ]
806b5ffc-806b5ffe 3 bytes - hal!KeGetCurrentIrql+ad8 (+0x0e)
[ 00 00 00:02 08 12 ]
63 errors : !hal (806b5fa9-806b5ffe)

MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
STACK_COMMAND: .trap fffffffff844d1f4 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE

Hey cpc2004, could you *please* check out my thread here. I spent half of my student-loan building this pc and I fear I'm going to have to spend more if I can't diagnose this problem. Thanks in advance for any help.

Hi Boaby,

Maybe it is faulty ram but I am not very sure. Do you have any minidumps not crash with bugcheck code '50'? If yes, attach the minidump here.

Do you have any update of your problem?

hey cpc, thanks for looking into it.

I've attached a minidump obtained from an 8E error.


As i mentioned i get the blue screen when zonealarm tries to start up (specifically when it starts the TrueVector Client). But this was zonealarm v4.5. I wanted this older version as i find the later versions quite bloated. I've been using v4.5 for some time on my other pc which btw is running the exact same OS as installed on this new system.

However i decided to see if i got the same problem with v6. So I've installed v6 on the new system and been using it for a day or so and have had no problems with it so far.......confused.

hey man, any joy with the above dump?

There's definately some specific problem why v4.5 won't work on this machine when it works on the other, but I still can't determine whether its a hardware issue or not.

I've tried both the ram sticks in different ways and i get the same error with both and im thinking its unlikely that i could have TWO faulty sticks of ram so im suspecting the mobo. Wondering whether to just RMA it (?)

Hi drw2kuk,

I've investigate your minidumps and it is faulty ram.

Suggestion
1. Reseat the memory stick to another memory slot
2. Downclock the ram
3. Clean the inside the computer case
4. Make sure that the ram is compatible to the motherboard
If it still crashes, diagnostic which memory stick is faulty
1. Take out one memory stick. If windows does not crash, the removed memory stick is faulty.
2. If you have only one memory stick, replace the ram

Hi, I have a similar problem, can you please look at my minidumps and find out problem.

Here is my thread :

http://www.techspot.com/vb/topic33257.html

Ntfs.sys problems

I am having problems with this also. My system was automatically restarting after 15-20 minutes of idling. I changed the option in the control panal to disable automatic reboots on crashes, and I could then see on the blue screen that the problem is with Ntfs.sys. I have a 256mb memory stick and a 128mb memory stick. I haven't changed anything in my PC in a looooong time and this just started out of the blue. I took the memory sticks out and cleaned everything really good, but it did not help.

I have attached some minidumps.

Thanks in advance for any help you can offer!!

Thanks,

Mikey

DrWtsn32.exe Errors

Hi cpc,

I'm getting a drwtsn32.exe error whenever I exit Battlefield 2. I attached the minidumps. Any help/info will be greatly appreciated. Thanks!

Hi pxlai675,

I've investigate your minidumps and faulty ram is the culprit.

Mini091705-01.dmp D1 (00000000, 00000006, 00000008, 00000000) USBPORT!USBPORT_InterruptService+3d

Hi CPC,

Sorry to bother you - have you had a chance to take a look at my minidumps in my previous message? My PC is now crashing while I'm working on it whereas before it was only if it was sitting idle for 15 or so minutes. Any help is greatly appreciated.

Thanks,

Mikey

Hi Mikey,

Your problem is very weired. All the system crashes are memory corruption but the overlaid storage is very conistent. I cannot whether it is ram problem or device driver problem. Usually memory corruption is caused by faulty ram. If it is ram problem, the memory corruption must be different at each crash.

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: d7c3dd45, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: f73bf89d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: d7c3dd45

FAULTING_IP:
Ntfs!NtfsDefragFile+8c1
f73bf89d ff8b45bc8b55 dec dword ptr [ebx+0x558bbc45]

MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 18
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from f73f3a2a to f73bf89d

STACK_TEXT:
f1d74afc f73f3a2a 81eb40f0 82077008 f1d74b40 Ntfs!NtfsDefragFile+0x8c1
f1d74b10 f73da859 81eb40f0 82077008 f1d74b40 Ntfs!NtfsUserFsRequest+0x198
f1d74b24 f73da7b3 81eb40f0 82077008 804e91a1 Ntfs!NtfsCommonFileSystemControl+0x44
f1d74b98 804e3d77 82382020 82077008 823656c0 Ntfs!NtfsFsdFileSystemControl+0x116
f1d74ba8 f7456ee5 82340908 f1c47e5c f1d74be0 nt!IopfCallDriver+0x31
f1d74bb8 804e3d77 823656c0 82077008 f1d74c14 sr!SrFsControl+0x121
f1d74bc8 f1c3e18b 00000000 f1d74c14 00000000 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
f1d74be0 f1c40e72 82365608 8216fce8 f1d74c14 SYMEVENT+0x118b
f1d74c34 804e3d77 81efe348 82077008 806ee2d0 SYMEVENT+0x3e72
f1d74c44 8056a9ab 820771bc 8228f0a8 82077008 nt!IopfCallDriver+0x31
f1d74c58 8057d9f7 81efe348 82077008 8228f0a8 nt!IopSynchronousServiceTail+0x60
f1d74d00 8057da37 00000148 00000000 00000000 nt!IopXxxControlFile+0x611
f1d74d34 804df06b 00000148 00000000 00000000 nt!NtFsControlFile+0x2a
f1d74d34 7c90eb94 00000148 00000000 00000000 nt!KiFastCallEntry+0xf8
00c1eda8 00000000 00000000 00000000 00000000 0x7c90eb94

CHKIMG_EXTENSION: !chkimg -lo 50 -db !Ntfs
24 errors : !Ntfs (f73bf828-f73bffd8)
f73bf820 40 24 13 c2 89 8d 00 ff *f7 ff 89 85 04 ff ff ff @$.................
f73bf880 fe ff 8b 45 98 8b 4d 0c *81 41 04 0f be 83 18 01 ...E..M..A.........
f73bf8f0 18 01 00 00 89 85 2c ff *f7 ff 8b 47 10 89 85 f0 ......,....G.......
f73bf920 c2 d3 e0 89 95 bc fe ff *f7 89 85 b8 fe ff ff 6a ...............j...
f73bf940 fe ff 56 e8 44 e5 fe ff *83 46 28 8b 40 0c 85 c0 ..V.D....F(.@......
f73bf970 6a 00 50 56 e8 cb 28 ff *f7 8b 45 0c 83 60 1c 00 j.PV..(...E..`.....
f73bf9a0 ff 75 ac ff 75 a8 51 50 *f7 75 ac ff 75 a8 51 50 .u..u.QP.u..u.QP...
f73bfaa0 90 90 83 7d d8 00 74 16 *f7 75 d8 ff 75 98 e8 91 ...}..t..u..u......
f73bfb40 00 00 00 ff 75 c4 ff 75 *04 56 e8 69 db fe ff 8b ....u..u.V.i.......
f73bfbb0 0d 00 00 c0 57 ff 75 0c *e3 1a 8b 5d 0c 8b 4d d4 ....W.u....]..M....
f73bfcd0 5d d0 8b 45 28 89 45 d4 *81 5d d8 8d 45 c0 50 6a ]..E(.E..]..E.Pj...
f73bfd50 90 90 90 90 90 8b ff 55 *83 ec 51 51 53 56 8b 75 .......U..QQSV.u...
f73bfda0 10 ff 75 08 e8 28 5e ff *f7 80 7e 26 00 8b 1e 74 ..u..(^...~&...t...
f73bfdc0 89 45 20 76 47 89 45 0c *83 46 18 03 45 0c 8b 55 .E vG.E..F..E..U...
f73bfde0 4d fc ff 70 14 8b 48 10 *85 45 f8 50 8d 04 19 50 M..p..H..E.P...P...
f73bfe90 23 45 14 89 45 b0 0f 84 *35 01 00 00 8b 87 18 01 #E..E...5.......
f73bfea0 00 00 89 85 7c ff ff ff *83 8d 7c ff ff ff 8b 45 ....|.....|....E...
f73bfed0 51 52 50 ff 75 10 ff 75 *00 e8 88 dc fe ff 88 45 QRP.u..u.......E...
f73bfef0 23 8b 4d d0 8b 55 b0 2b *c2 33 c0 8b 75 e4 8d 3c #.M..U.+.3..u..<
f73bff00 32 8b d1 c1 e9 02 f3 ab *83 ca 83 e1 03 f3 aa e9 2..................
f73bff90 18 00 0f 8c e2 01 00 00 *83 45 d0 8b 55 b0 2b c2 .........E..U.+.
f73bffa0 39 45 1c 73 03 8b 45 1c *81 45 a8 8b c8 8b 75 e4 9E.s..E..E....u.
f73bffb0 03 f2 8b 7d d4 8b d1 c1 *e1 02 f3 a5 8b ca 83 e1 ...}...............
f73bffd0 01 00 00 8b 7d a4 8b 75 *94 8b c6 23 45 1c 89 45 ....}..u...#E..E

MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: STRIDE
STACK_COMMAND: kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE
BUCKET_ID: MEMORY_CORRUPTION_STRIDE

@cpc2004

Hi there.
When you analyze all these dumps, do you use DumpCheck (dumpchk.exe)? If so, what parameters do you use?

Thank you.

:EDIT
Added some minidump's in case you want to help me and got some time to spare.