TechSpot

Page Fault In NonPage Area BSOD

By jpeterson92
Aug 10, 2008
Topic Status:
Not open for further replies.
  1. Hi!

    After about 30 minutes of doing random things on my computer (checking e-mail,surfing the internet, etc.), it will randomly drop a BSOD. I have already run memtest86+, installed new Nvidia drivers, cleaned my registry, defragged my drive, and run a checkdisk. Here's a sample BSOD I get and I'll attach the dump files! Thanks


    Code:
    [
    Microsoft (R) Windows Debugger Version 6.9.0003.113 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Windows\Minidump\Mini081008-09.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*
    Executable search path is: 
    Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 6001.18063.amd64fre.vistasp1_gdr.080425-1930
    Kernel base = 0xfffff800`02a47000 PsLoadedModuleList = 0xfffff800`02c0cdb0
    Debug session time: Sun Aug 10 10:37:53.672 2008 (GMT-5)
    System Uptime: 0 days 1:08:46.456
    Loading Kernel Symbols
    ...........................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ..................................................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 50, {fffffa610b3a9ff8, 0, fffffa6001219130, 5}
    
    
    Could not read faulting driver name
    Probably caused by : Ntfs.sys ( Ntfs!memcpy+2c0 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffa610b3a9ff8, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffffa6001219130, If non-zero, the instruction address which referenced the bad memory
    	address.
    Arg4: 0000000000000005, (reserved)
    
    Debugging Details:
    ------------------
    
    
    Could not read faulting driver name
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002c70080
     fffffa610b3a9ff8 
    
    FAULTING_IP: 
    Ntfs!memcpy+2c0
    fffffa60`01219130 4c8b4c0af8      mov     r9,qword ptr [rdx+rcx-8]
    
    MM_INTERNAL_CODE:  5
    
    CUSTOMER_CRASH_COUNT:  9
    
    DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT
    
    BUGCHECK_STR:  0x50
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    TRAP_FRAME:  fffffa60055b0ce0 -- (.trap 0xfffffa60055b0ce0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000040 rbx=0000000000000000 rcx=fffffa8104fea000
    rdx=ffffffe0063c0000 rsi=fffff880090b3140 rdi=fffffa6001220374
    rip=fffffa6001219130 rsp=fffffa60055b0e78 rbp=00000000ffffffff
     r8=00000000ffffffff  r9=0000000007ffffff r10=fffffa60055b14f0
    r11=fffffa8004fea001 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po nc
    Ntfs!memcpy+0x2c0:
    fffffa60`01219130 4c8b4c0af8      mov     r9,qword ptr [rdx+rcx-8] ds:1970:fffffa61`0b3a9ff8=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002aaa4e2 to fffff80002a9c390
    
    STACK_TEXT:  
    fffffa60`055b0be8 fffff800`02aaa4e2 : 00000000`00000050 fffffa61`0b3a9ff8 00000000`00000000 fffffa60`055b0ce0 : nt!KeBugCheckEx
    fffffa60`055b0bf0 fffff800`02a9af19 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`ffffffff : nt!MmAccessFault+0x4f2
    fffffa60`055b0ce0 fffffa60`01219130 : fffffa60`0123988e fffffa00`06000000 fffffa60`012d1f9a 00000000`00000000 : nt!KiPageFault+0x119
    fffffa60`055b0e78 fffffa60`0123988e : fffffa00`06000000 fffffa60`012d1f9a 00000000`00000000 fffffa60`055b14f0 : Ntfs!memcpy+0x2c0
    fffffa60`055b0e80 fffffa60`0123a735 : 00000000`00000000 fffffa60`055b1194 fffff880`090b3140 00000000`00000030 : Ntfs!NtfsCopyFromMdl+0x17b
    fffffa60`055b0f60 fffffa60`0120d684 : fffff880`090b3140 fffffa60`055b1140 00000000`00000000 00000000`00010000 : Ntfs!NtfsPrepareSparseWriteBuffer+0x85
    fffffa60`055b0fb0 fffffa60`01221bc7 : fffffa60`055b14f0 fffffa80`04642010 fffff880`090b3101 00000000`00000010 : Ntfs! ?? ::FNODOBFM::`string'+0x46f7
    fffffa60`055b1070 fffffa60`0121f963 : 00000000`00000000 fffffa60`055b14f0 fffffa60`055b1190 00000000`0002d000 : Ntfs!NtfsPrepareBuffers+0x177
    fffffa60`055b10f0 fffffa60`0121bf2e : fffffa60`055b14f0 fffffa80`04642010 00000000`00004000 00000000`00000000 : Ntfs!NtfsNonCachedIo+0x1c3
    fffffa60`055b12c0 fffffa60`0121f118 : fffffa60`055b14f0 fffffa80`04642010 fffffa60`055b1601 fffffa60`055b1600 : Ntfs!NtfsCommonWrite+0x4ce
    fffffa60`055b14c0 fffffa60`00764e17 : fffffa80`046423b0 fffffa80`04642010 fffffa80`03e9c040 fffffa80`09c23cb0 : Ntfs!NtfsFsdWrite+0x208
    fffffa60`055b1730 fffffa60`007640dd : fffffa80`04d82ac0 fffffa80`0958e050 fffffa80`03e9c000 fffff800`02bc0b00 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227
    fffffa60`055b17a0 fffff800`02abbbcd : fffffa80`03e9c040 fffffa80`03e9c040 00000000`0000000b fffffa80`0958e050 : fltmgr!FltpDispatch+0xcd
    fffffa60`055b1800 fffff800`02aba90d : 00000000`00000008 fffff880`0a4c7180 fffffa60`055b1920 00000000`00000000 : nt!IoSynchronousPageWrite+0x14d
    fffffa60`055b1830 fffff800`02aae069 : fffff880`0a4c7160 fffff880`0a4c7180 fffffa80`0994aea0 fffffa80`0994aea0 : nt!MiFlushSectionInternal+0x7ce
    fffffa60`055b1a30 fffff800`02ab1989 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`0896d720 : nt!MmFlushSection+0x2a9
    fffffa60`055b1af0 fffff800`02ab5450 : fffffa80`09dbc360 00000000`00000000 fffffa60`00000001 fffffa60`055b1ca0 : nt!CcFlushCache+0x65a
    fffffa60`055b1be0 fffff800`02ab5f9b : 00000000`00000100 00000000`00000000 00000000`00000000 fffff800`02c45800 : nt!CcWriteBehind+0x1c0
    fffffa60`055b1c70 fffff800`02aa905a : fffffa80`039b74a0 fffff800`02c458a0 fffffa80`09ced520 fffffa80`00000001 : nt!CcWorkerThread+0x17b
    fffffa60`055b1cf0 fffff800`02cbff73 : fffffa80`039b74a0 fffffffe`9a5f4400 fffffa80`0896d720 00000000`00000080 : nt!ExpWorkerThread+0x11a
    fffffa60`055b1d50 fffff800`02ad6526 : fffff800`02bbb680 fffffa80`0896d720 fffffa80`0896d040 00000000`00000001 : nt!PspSystemThreadStartup+0x57
    fffffa60`055b1d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    Ntfs!memcpy+2c0
    fffffa60`01219130 4c8b4c0af8      mov     r9,qword ptr [rdx+rcx-8]
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  Ntfs!memcpy+2c0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: Ntfs
    
    IMAGE_NAME:  Ntfs.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  479190d1
    
    FAILURE_BUCKET_ID:  X64_0x50_Ntfs!memcpy+2c0
    
    BUCKET_ID:  X64_0x50_Ntfs!memcpy+2c0
    
    Followup: MachineOwner
    ---------
    
  2. woody1191

    woody1191 Newcomer, in training Posts: 638

  3. jpeterson92

    jpeterson92 Newcomer, in training Topic Starter

    I ran memtest for 7 passes. And I don't think I can run my HDD manufacturer's (Western Digital), because it says it's only for 32-bit and I can't find a 64-bit version (I may just be blind). I'll try running the Prime and get back to you. Thanks for the help!
  4. jpeterson92

    jpeterson92 Newcomer, in training Topic Starter

    Prime ran fine. So my memory's not bad, and my process is not either. Any other suggestions?
  5. jpeterson92

    jpeterson92 Newcomer, in training Topic Starter

    I found a Western Digital Diagnostic Utility,and ran the long version. It came up passing. So Hard Drive OK, CPU OK, Ram OK.
  6. G_Mez

    G_Mez Newcomer, in training Posts: 21

    You might want to try this....

    Some of the latest malware uses a BSOD message screen, it's not a real message, and you can alt+tab out of it back to desktop. I've seen a couple of these infections recently. If you find that's the case them I suggest getting a good malware/spyware remover. 2 really good free ones that work really well on this problem are SuperAntiSypware and MalwareBytes. Just be sure to get the downloads from a reputable source.

    Good luck, hope this helps

    _mez
  7. jpeterson92

    jpeterson92 Newcomer, in training Topic Starter

    Would it still restart after 20 seconds?
  8. G_Mez

    G_Mez Newcomer, in training Posts: 21

    Yep, it even fakes drive activity

    If I remember correctly its called fake.av or something like that It installs a corrupt version of explorer.exe (desktop proggy) and then disables a few antispyware processes too. Your antispyware program has already most likely been compromised. If you have anti spyware/malware on machine try updating it, disconnect from internet ( to keep downloader infection from also updating), and then running a ful scan. If that doesn't work you will most likely have to uninstall it (old spyware protection) to allow another spyware/malware program to be installed.

    Good luck, hope this helps

    _mez
  9. woody1191

    woody1191 Newcomer, in training Posts: 638

    Well thats a new 1 for me, these 0x50 errors are normally associated with Hardware or Software problems. Suppose it doesn't hurt to try.

    jpeterson92 do you have a Graphics card, I'm assuming you have a Nvidia card because in your OP you mentioned you reinstalled Nvidia Drivers.

    Try taking the Graphics card out and running the comp for a bit to see if that is causing the problem.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.