Page_fault_in_nonpaged_area even in safemode - is recovery possible?

By michaelrepucci
Nov 10, 2009
  1. Please pardon the length of this post, but I've already tried many things, and I just want to give all the information that I have gathered. Thank you for taking the time to read and help me. I appreciate it very much!

    In short: Windows XP refuses to boot in any mode, despite good hardware, giving only the blue screen (BSOD) message page_fault_in_nonpaged_area.

    The full story: I'm running a dual boot Windows XP SP2 (OEM), and Ubuntu Linux 9.04, on a Lenovo/IBM ThinkPad T60. My hardware (and XP drivers) have not been changed in almost a year. The software was stable for at least 6 months prior to the first BSOD, though the most recent Windows updates were installed about a month ago. I rarely use Windows, and typically boot into Ubuntu instead.

    About 3 months ago, while in Windows, I had strange behavior (pop ups telling me my computer was unprotected), and discovered that I had some malware running (forget which one at this point). I Googled it, removed it completely, and haven't had a problem with it since. But about a month ago, I started noticing some other strange behavior, including a sort of hijacking of my browser (Firefox 3.0.15), whereby I would Google something, but when I clicked on any of the search results, I would be redirected to a string of (presumably suspicious) websites. I figured I had more malware/trojans or whatever, but didn't have the time to address the issue. Besides, I wasn't often booted into Windows anyway.

    Then last Saturday morning, I booted into Windows, did some work (ignoring said odd behavior), and upon shutting down, Windows hung. I gave it plenty of time, but eventually had to just power off. Later that day, I tried to boot into Windows again, but received the BSOD with the message page_fault_in_nonpaged_area (STOP 0x00000050). No file was listed as the culprit. The same error was produced when I tried safemode (aka, safe mode), but the last file listed before safemode BSOD'd was mup.sys.

    I proceeded to spend the entire weekend trying to fix this, Googling for tips/answers, but to no avail. The list of things I've tried are numerous, so I may not remember them all, but here goes. It's not the RAM, since fundamentally Ubuntu is running fine, but I checked it anyway with Memtest86+. Same goes for other hardware, which all runs fine in Ubuntu, and passes all hardware tests I have available, including (most importantly) that chkdsk (via Windows Recovery Console) reports no problems.

    I read that Windows update KB971486 had caused this problem for some people, so I uninstalled that (again via Windows Recovery Console), but no change. I created a bootable USB stick with UBCD (this tool is awesome btw!), then analyzed the Windows XP partition for ad/mal/spyware and virus/worms/trojans. A couple trojans (win32.agent.msv and virtumonde) were found, and removed, neither of which would appear from reports to have been the cause of BSOD. But still no change.

    Finally I chose to repair the Windows installation with the original XP CD, but this didn't change anything, except that once or twice I received system_thread_exception_not_handled (STOP 0x0000007E) instead of the page fault BSOD. Again, no file was mentioned, and mup.sys was the last file to load in safemode. This error eventually, and inexplicably, reverted to the page fault.

    I think that's about everything. Had the system been changed more recently, I would suspect a device driver, or something, given that mup.sys tends to indicate a hardware issue. But again, Ubuntu works fine, and hardware passes all tests. It was fine for several reboots, and the malware, while bad, don't seem to be the cause of the problem. So what gives? Any thoughts? BTW, I'm not concerned about the data, per say, since I not only have a recent backup, but can access it all from Ubuntu. But the system had lots of work-related software installed and configured that would be a real pain to redo.

    Sorry if I've left out anything that you might find important. I'd be happy to keep an active discussion on this. And thank you very much to anyone who offers to help! May all your computers run smoothly, and without hassle.

    :) Michael
  2. raybay

    raybay TS Evangelist Posts: 7,241   +9

    Yes, recovery is possible, but you have some work to do.
    You should look for the Techspot 8 Steps for removals... follow them carefully, and post the results here.
    One thing I would do now is to run Avira Antivir or Avast in <SAFE MODE>, as well as MalwareBytes or SpySweeper or Spyware Doctor.

    I think if you take the time to carefully read through all the information in the 8 Steps, then follow them as completely as you can, then post the results here for one of TechSpot's experts, you will soon be on the way to recovery.

    By the way, how old is your hard drive?
    Have you considered using another drive and install as a test to be sure it is not hardware?
  3. michaelrepucci

    michaelrepucci TS Rookie Topic Starter

    Hi raybay, thank you for the response. The Techspot 8 Steps are great; I found them last Saturday when I first had this problem.

    Unfortunately, as I'd mentioned above, I am not able to boot in safe mode (or any mode), so I was unable to apply the 8 steps. As mentioned in my original post, however, I was able to boot into a USB drive running Windows (UBCD), and from this OS run various malware/antivirus software on the non-bootable Windows XP partition, such as Malware-Bytes, Avira Antivirus, Spybot S&D, Avast, etc. This did clean up a couple trojans (as mentioned above), and several adware cookies, but nothing that would appear to have had any malignant effect on the registry or systems files. Moreover, after clearing these threats, I am still unable to boot into my Windows XP partition in any mode.

    Do you have any other suggestions?

    P.S. - The drive is, like the computer, about 2 years old. Also, I can be sure that it's not the hardware, as Ubuntu runs just fine on the exact same hardware. (Of course, Ubuntu is on a different logical partition on the same drive, but the Windows XP partition checks out fine with chkdsk.)
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...