System suddenly crashes - Page Fault in Non Paged Area

By leapbrother
Jun 10, 2005
Topic Status:
Not open for further replies.
  1. Hi..

    I wonder if you can help. I saw a thread http://tinyurl.com/78csd where several answers were given by cpc2004, but I don’t know how to do the analysis to find out what my problem is.

    Simply, my system has started from time to time to shut down, like a power cut and always with the same error code (1003). It also always shuts down when I try to burn a DVD, but I will come to that later. It’s a long post, so please bear with me. System details are as follows.

    XP Pro (SP2)
    P4 2.26gb
    768Mb Ram
    Pioneer DVD-Rom (slave)
    NEC DVD_RW 3540A (master – newly fitted to replace Hitachi CDRW)
    Internal 60gb drive partitioned to drive c: (OS and programmes) and drive E: (data)
    Internal 200gb hard drive (newly fitted, same time as DVD-RW and to replace E: for data storage
    External drive H: (back up of data)
    Floppy
    nVidia GeFroce 6600 (driving two LCD’s) driver version 7.1.8.9

    I followed some advice and have the following information. I “turned on” the Blue Screen of Death to get this error report after it had crashed.



    A problem has been detected and windows has been shut down to prevent damage to your computer.

    The problem seems to be caused by the following file: ntfs.sys

    PAGE_FAULT_IN_NONPAGED_AREA

    If this is the first time you have seen this stop error screen, restart your computer. If this screen appears again, follow threes steps

    Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows updates you might need.

    If problems continue, disable or remove any news installed hardware or software. Disable BIOS memory options such as cashing or shadowing. If you need to use safe mode to recover or disable components, restart your computer , press F* to select advanced start-up options, and then select safe mode.

    Technical information:

    *** STOP: 0x00000050 (0xDCE1549B, 0x00000000, 0xF73D2257, 0x000000000)


    *** ntfs.sys – Address F73D2257 base at F73D1000, datestamp 41107ee

    Beginning dump of physical memory
    Physical memory dump complete
    Contact your system administrator or technical support group for further assistance.



    Following the advice given by cpc2004 in an earlier thread http://www.techspot.com/vb/topic17691-pg2.html I have also produced this information

    My software (taken from msinfo32) can be found here www.remarked.net/softwarelist.txt

    And then the error information from system events can be found here www.remarked.net/wtf/wtf5.jpg

    Again following the advice given I installed and ran pstat.exe. The log from this can be found here www.remarked.net/wtf/pstat.txt

    Now, I only recently fitted the DVD-RW and at the same time the HD. I had experienced this problem occasionally before but what I have found it is that when I try to burn a DVD (using Nero Burning Rom 6.6.0.3) to back up some files – hence why I replaced the CDRW with the DVD-RW and bought a bigger drive as I was running out of storage that just after I press for Nero to burn, it crashes with the same error code. All the time

    HELP Please.. this is driving me nuts.

    Massive thanks.
  2. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    When Windows crashes with blue screen, it writes a system event 1001 and a minidump to the folder \windows\minidump. Check system event 1001 and it has the content of the blue screen

    Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001. Copy the content and paste it back here

    Zip 4 to 6 minidumps and attach the zip files here.
  3. leapbrother

    leapbrother Newcomer, in training Topic Starter

    BSoD Mini Dump

    Hi cpc2004,

    Dump Zip can be found here www.remarked.net/wtf/minidump.zip This should be the last six dumps from my system crashes.

    I really appreciate this, thanks..
  4. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Two of your minidumps has 4 bytes memory corruption at ntoskrnl. Faulty RAM is the culprit. If you have only one memory stick, buy a new memory stick.

    If you have two memory stick, you have to determine which memory stick is in error. You can memtest to test the ram. If memtest reports hardware error, the RAM is faulty. Vice versa if memtest does not detect any error, it does not mean the memory is good as some faulty ram can pass memtest.
    If you have more than one memory stick, take out a memory stick. If BSOD dose not occur, that memory stick is faulty.


    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
    [ ad 94 58 80:88 de ea 82 ]
    4 errors : !nt (804e2724-804e2727)

    MODULE_NAME: memory_corruption
    IMAGE_NAME: memory_corruption
    FOLLOWUP_NAME: memory_corruption
    DEBUG_FLR_IMAGE_TIMESTAMP: 0
    MEMORY_CORRUPTOR: LARGE
    STACK_COMMAND: .trap fffffffff1b0b38c ; kb
    FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
    BUCKET_ID: MEMORY_CORRUPTION_LARGE
  5. leapbrother

    leapbrother Newcomer, in training Topic Starter

    still no joy..

    Hi cpc2004,

    Thanks for that info. I have two memory sticks, one 256k and one 512k. This morning I took one out, booted Nero and tried to burn a data DVD. My system crashed, same fault code as before. I swapped memory sticks and tried again, and again my system crashed, and again same error code.

    I have attached the windows dump logs here www.remarked.net/wtf/Minidump2.zip (both dated 12/06) along with a 3rd when my system crashed on it’s own last night (dated 11/06). Hope this helps.

    And again, a huge thanks for your support with this. I do very much appreciate it.
  6. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    LeapBrother,

    One minidump crashed with one bit corruption, one minidump crashed with 4 bytes corruption and other crashed with bugcheck code 50. As you've taken out one memory stick and the culprit is the L2 cache memory of the CPU or cache memnory of the M/B. If you can get a same CPU , replace the CPU. If it doesn't crashed, CPU is the culprit.
  7. leapbrother

    leapbrother Newcomer, in training Topic Starter

    try again - just to be sure..

    Hi cpc2004,

    Just to be sure, I tried again. The first time using my 256mb memory stick. I loaded Nero and went to burn and system went down – the dump file for this crash is Mini061205-03.dmp

    I then removed the 256mb and replaced it with my 512mb, same slor, again loaded Nero and tried to burn, and once more it crashed. The dump for this crash is Mini061205-04.dmp. Both files can be found here www.remarked.net/wtf/minidump3.zip

    If it helps any, I filmed it for you so you can see at what point it crashes. It is always at the same point when it is going to cache the files that I want to burn. The movie can be found here www.remarked.net/wtf/crash.mpg

    Hope this helps..

    Thanks..
  8. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    As it is a hardware error, I expect your XP has a huge DrWatson logs. As hardware error occurs at usermode, the application crashes and writes the dump to DrWatson. If hardware error occurs at kernel mode, XP crashes with blue screen.

    Attach the following files here.
    C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log
    C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp
  9. leapbrother

    leapbrother Newcomer, in training Topic Starter

  10. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    I've examined your DrWatson log and it does not have a lot of entries and it doesn't look like it is a hardware error. You have three memory corruption and they are corrupt at the same location nt!KiServiceTable+7c and the overlaid value is different

    If it is a hardware error, I expect the corrupt location is random. Your problem is not related to hardware. It is a sofware error, Nero maybe the culprit.

    Mini061005-02.dmp 1000007F (00000008, 80042000, 00000000, 00000000)
    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
    [ ad 94 58 80:88 de ea 82 ]
    original value:current value
    Mini061205-01.dmp 1000007F (00000008, 80042000, 00000000, 00000000)
    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
    [ ad 94 58 80:28 26 18 81 ]
    original value:current value
    Mini060805-02.dmp 1000007F (00000008, 80042000, 00000000, 00000000)
    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
    [ ad 94 58 80:38 38 d6 82 ]
    original value:current value

    There have 7 crashes with bugcheck 50 at Ntfs!LfsReleaseLch+0x9. I've searched google and there has no known hit for Ntfs!LfsReleaseLch. I am sidetrack by the memory corruption as usually memory corruption is caused by hardware. However kernel mode state can change storage within kernel. Y your poblem may be related to storage overlay by a faulty device driver. One of my MPG card driver at my PC screwed up the kernel storage and cause various system crash. Your symptom is very consistent (ie either bugcheck 50 or 7F) and my case the bugcheck code is random.

    Are you using the latest version of Nero Burn?

    I need a full memory dump to diagnostic your dump. You have to change the dump option to full dump. When the BSOD occurs, upload your full dump at any webspace, paste the url here and I will download the dump to find out who screw up your XP.
  11. leapbrother

    leapbrother Newcomer, in training Topic Starter

    Hi cpc2004,

    Yes I am using the latest version of Nero, version 6.6.0.3. It is part of the Nero Reloaded package and is a full original version.

    I'm sorry, I'm not sure how to change my computer to produce a full memory dump. Could you please advise.


    As always, thanks
  12. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Control Panel --> System --> Advance --> Startup and Recovery --> Write debugging information --> Change minidump to full dump
  13. leapbrother

    leapbrother Newcomer, in training Topic Starter

    Hi cpc2004,

    I just tried to use Nero to get it to crash, which of course it did. I had changed the settings and the memory dump is now around 800mb. Is that what you want..? Can I send it to you using www.yousedit.com and if so to what email?

    Cheers
     
  14. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Obviously the problem is related to Nero. If you are license user, you can send the full dump to Nero for further investigation. If you can attach the dump at any webspace, I will download the dump and confirm it is Nero problem.
  15. leapbrother

    leapbrother Newcomer, in training Topic Starter

    Hi cpc2004,

    Again thanks. I'm not sure it is Nero as my system crashed a few times before I had fitted my DVD-RW or installed Nero. It seems though Nero "forces" it to crash so I use that to test advice given rather than waiting for it to happen on it's own.

    Dump is zipped and and can be found here

    http://s23.yousendit.com/d.aspx?id=16Q7WJ393T4GW3JH7YOVNB5RYH

    Thanks as always.
  16. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    PROCESS 8255f7c8 SessionId: 0 Cid: 0f20 Peb: 7ffd7000 ParentCid: 024c
    DirBase: 1ede0000 ObjectTable: e39173e0 HandleCount: 297.
    Image: nero.exe
    VadRoot 826238b8 Vads 197 Clone 0 Private 2362. Modified 1832. Locked 0.
    DeviceMap e19ab5e8
    Token e11253a8
    ElapsedTime 0:02:27.0562
    UserTime 0:00:02.0125
    KernelTime 0:00:03.0781
    kd> !chkimg -lo 50 -d !nt
    804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
    [ ad 94 58 80:20 9a d4 82 ]

    There have 4 bytes overlaid at the same location. The crash is at nero+2c0062 because the instruction is misaligned. Windows recovery is taken control and it encounters recursive abend loop because there have 4 bytes overlaid at nt!KiServiceTable+7c. Finally the stack is overflowed. Utimately it crashed with double fault. I don't know why the storage is overlaid. Most likely it is overlaid by nero but I can't prove it. As you know the windows dump is only a snapshot of the memory when the error occurs. The storage overlaid may occurs a while ago.

    The reason why it is misaligned may be related to software or hardware error. Because the BSOD always occurs when you use Nero to burn DVD.

    I suggest you should upgrade Nero 6.6.0.3 to 6.6.0.5 or higher level. If it crashes at Nero, attach the minidump here.


    BugCheck 7F, {8, 80042000, 0, 0}

    STACK_TEXT:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f1f5d507 3fc967f1 7b1e00f7 ffffffe1 ffffffff nero+0x2c0062
    f5d5ffff 00000000 00000000 00000000 00000000 0x3fc967f1

    MISALIGNED_IP:
    nero+2c0062
    006c0062 08894df4742d or [ecx+0x2d74f44d],cl

    kd> u 6c0050 l20
    nero+0x2c0050:
    006c0050 8bc7 mov eax,edi
    006c0052 8b4dfc mov ecx,[ebp-0x4]
    006c0055 6bc03c imul eax,eax,0x3c
    006c0058 03c8 add ecx,eax
    006c005a 894d10 mov [ebp+0x10],ecx
    006c005d 8b4b08 mov ecx,[ebx+0x8] <--
    006c0060 394d08 cmp [ebp+0x8],ecx <--
    006c0063 894df4 mov [ebp-0xc],ecx <--
    006c0066 742d jz nero+0x2c0095 (006c0095)
    006c0068 8b5510 mov edx,[ebp+0x10]
    006c006b 2bd0 sub edx,eax
    006c006d 2b55fc sub edx,[ebp-0x4]
    006c0070 035508 add edx,[ebp+0x8]
    006c0073 837d1000 cmp dword ptr [ebp+0x10],0x0
    006c0077 7410 jz nero+0x2c0089 (006c0089)
    006c0079 8b7d10 mov edi,[ebp+0x10]
    006c007c 6a0f push 0xf
    006c007e 59 pop ecx
    006c007f 8bf2 mov esi,edx
  17. leapbrother

    leapbrother Newcomer, in training Topic Starter

    Hi cpc2004,

    Folowed your advice and upgraded my Nero to latest version 6.6.0.14 as given off the Nero website.

    Went to burn a DVD and the usual still happened. Just at caching crash and BSOD. Mini dump is here www.remarked.net/wtf/Mini061405-01.dmp

    I know this has gone on for a while but please be aware I am very thankfull for your help with this. I may not understand all you are saying, but I do at least feel as though we may get to the bottom of this problem and without your support, that just would not happen. I owe you a beer or three...

    Cheers
  18. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Your problem have two different scenario. The first one is Bugcheck code 7F and other one is bugcheck 50. It doesn't look like it is a hardware error as the failing instruction address is consistent. Usually hardware error occurs randomly. If it is a hardware error, I will expect you will have various bugecheck code with different failing instruction address. Attach the fulll dump of your crash if you want to pursue the root cause of the problem. The problem maybe related to software errror within XP and not nero. As the system service is overlaid at the fix location. I have to figure out how to set a storage alternation trap when the system service table is corrupt and catch the culprit on the spot.

    Run chkdsk /r to make sure that your hard disk is healthy.
  19. leapbrother

    leapbrother Newcomer, in training Topic Starter

    Hi cpc2004,

    Sorry, do you mean a full memory dump? I have changed my settings to produce another full memory dump, fresh this morning again forced on my system after trying to use Nero. This can be found here:

    http://s48.yousendit.com/d.aspx?id=06KYZH3BP7ZUN035XF5O9S1ARK

    I will run chkdsk on all my HD’s and get this back to you.

    Anything else you need, just let me know
  20. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

  21. leapbrother

    leapbrother Newcomer, in training Topic Starter

    Hey cpc2004,

    I’m guessing you are getting a bit pissed with this problem, as am I. I went to the MS site and following that advice downloaded the listed Intel tool. Sadly that didn’t work as it is not applicable for P4’s apparently – see www.remarked.net/wtf/wtf10.jpg

    And from the site:

    The Intel Processor Frequency ID Utility has the ability to determine the frequency of each processor in a multiprocessor system. Any multiprocessor menu or toolbar selections are disabled in platforms with operating systems other than Windows XP, or Windows 2000. The application also includes an indicator for which processor is currently being tested.
    This applies to:
    Intel® Celeron® Processor
    Intel® Pentium® II Processor
    Intel® Pentium® II Xeon™ Processor
    Intel® Pentium® III Processor
    Intel® Pentium® Pro Processors
    Intel® Pentium® Processor
    Intel® Pentium® Processor with MMX™ Technology
    Intel® Processor Frequency ID Utility
    Mobile Intel® Pentium® II Processors
    Mobile Intel® Pentium® III Processors
    Mobile Intel® Pentium® Processors




    I guess we are running out of ideas with this….

    But again as always, thanks
  22. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    After further analysis, all the bugcheck 50 have the same symptom. The stack trace of third entry shift one byte to right hand side. As the kenel stack trace belongs to windows kernel and it is unlikely it is a software error. I think it is hardware error at the cache memory of the CPU. In addition your XP also crashes with bugcheck 7F because 4 bytes overlaid at system service table. The XP system service table is most active XP data area and it will be kept at cache memory to enhance performance.

    The only thing I don't understand why the failing instruction address is consistent. Howeve faulty CPU is the most reasonable answer of your problem.

    stack trace of Mini061005-03.dmp
    f18514cc f73f1aac dce179e0 f73f1a97 e10a1648 Ntfs!LfsReleaseLch+0x9
    f18514d4 f73f1a97 e10a1648 829693a0 00000000 Ntfs!LfsFlushToLsn+0xa7
    f1851509 90f73fc9 ffe179e0 ffffffff 007fffff Ntfs!LfsFlushToLsn+0x97
    67f18515 00000000 00000000 00000000 00000000 0x90f73fc9

    I guess it should be
    f1851509 f73fc9ff e179e0ff ffffff00 7fffff?? Ntfs!LfsFlushToLsn+0x97

    stack trace of Mini061205-04.dmp
    f8a2e4cc f83c5aac dce17514 f83c5a97 e1325688 Ntfs!LfsReleaseLch+0x9
    f8a2e4d4 f83c5a97 e1325688 81b24cf8 00000000 Ntfs!LfsFlushToLsn+0xa7
    f8a2e509 e0f83d09 ffe17514 ffffffff 007fffff Ntfs!LfsFlushToLsn+0x97
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    67f8a2e5 00000000 00000000 00000000 00000000 0xe0f83d09
    I guess it should
    f8a2e509 f83d09ff e17514ff ffffff00 7fffff?? Ntfs!LfsFlushToLsn+0x97


    stack trace of Mini061205-03.dmp
    f43744cc f90efaac dce17c5d f90efa97 e36e8cc8 Ntfs!LfsReleaseLch+0x9
    f43744d4 f90efa97 e36e8cc8 ff05d690 00000000 Ntfs!LfsFlushToLsn+0xa7
    f4374509 78f90fa9 ffe17c5d ffffffff 007fffff Ntfs!LfsFlushToLsn+0x97
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    67f43745 00000000 00000000 00000000 00000000 0x78f90fa9

    I guess it should
    f4374509 f90fa9ff e17c5dff ffffff00 7fffff?? Ntfs!LfsFlushToLsn+0x97
  23. gwhite

    gwhite Newcomer, in training Posts: 47

    Just for fun have you gone into the bios and changed your memory speeds to something a bit slower? I was having strange BSOD's and was ready to reformat. After slowing the memory a little my problems went completely away. Just a thought. If your computer is a "brand name", you may not be able to access these settings in bios.
  24. leapbrother

    leapbrother Newcomer, in training Topic Starter

    Hi...

    gwhite, thanks I will check that out. cpc2004, thanks for all your help, you have been great. I'm trying to find a CPU so I can test my system, may take me a couple of weeks. I'll come back with the results..

    Cheers
  25. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Do you have any update of the problem? I have a similar problem at another forum with 4 bytes overlaid at Windows System table which is similar to your problem but at different location.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.