Page Fault in Non Paged Area

Status
Not open for further replies.
Hi Nancy,

The stack trace of most of your minidumps shows that the failing is caused by instruction address Ntfs+0x28c37. This instruction branch to invalid address and crash windows. It may be caused by hardware error or the storage overlaid. In order to confirm whether it is a hardware error. Can you issue windbg command 'u ntfs+0x28c37 l4' and attach the output here? The problem may be related to hardware but it is needed more evidence. BTW it is worthwhille to install ramtest and test your RAM. www.memtest86.org

LAST_CONTROL_TRANSFER: from f7b7ac37 to f7b86f68

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b5cd5674 f7b7ac37 8833dcf0 89807008 898071bc Ntfs+0x34f68
b5cd58c8 f7b77f64 8833dcf0 89807008 b5cd5920 Ntfs+0x28c37 <-----
b5cd59a8 804e3d77 89882020 89807008 898b10d8 Ntfs+0x25f64
b5cd5a04 804e3d77 898b10d8 00000005 898071e0 nt+0xcd77
b5cd5a2c f77a7ff1 8855caf0 8855cba8 804e3d77 nt+0xcd77
b5cd5b3c 8056386c 89885900 00000000 882ced30 avg7rsxp+0xff1
b5cd5bc4 80567c63 00000000 b5cd5c04 00000040 nt+0x8c86c
b5cd5c18 80571477 00000000 00000000 563f4201 nt+0x90c63
b5cd5c94 80571546 005d6f2c 00000183 00c5f88c nt+0x9a477
b5cd5cf0 8057167c 005d6f2c 00000183 00c5f88c nt+0x9a546
b5cd5d30 804df06b 005d6f2c 00000183 00c5f88c nt+0x9a67c
b5cd5d64 7c90eb94 badb0d00 00c5f854 b5cd5d98 nt+0x806b
00c5f8e8 00000000 00000000 00000000 00000000 0x7c90eb94
 
I tested my RAM and it all passed, and ran disk checking utilities from my HDD manufacturer it says its fine :S

This is the output from my last crash log.

kd> u ntfs+0x28c37 l4
Ntfs!NtfsCommonCreate+0x12ce:
f7b7ac37 8945e0 mov [ebp-0x20],eax
f7b7ac3a 834de402 or dword ptr [ebp-0x1c],0x2
f7b7ac3e e945b4ffff jmp Ntfs!NtfsCommonCreate+0x146b (f7b76088)
f7b7ac43 56 push esi
 
Hi Nancy,

Thanks for your information. ntfs+0x28c37 is not a transfer instruction. Would you try "u ntfs+0x28c20 l40" and attach the output here. As you pass memtest and I think your mother board or CPU may have hardware problem and this is reason your PC crashes so frequently.

cpc2003
 
kd> u ntfs+0x28c20 l40
Ntfs!NtfsCommonCreate+0x12b7:
f7b7ac20 7004 jo Ntfs!NtfsCommonCreate+0x12bd (f7b7ac26)
f7b7ac22 ff30 push dword ptr [eax]
f7b7ac24 ffb568ffffff push dword ptr [ebp-0x98]
f7b7ac2a ff75b0 push dword ptr [ebp-0x50]
f7b7ac2d 56 push esi
f7b7ac2e ff750c push dword ptr [ebp+0xc]
f7b7ac31 57 push edi
f7b7ac32 e8654c0000 call Ntfs!NtfsCreateNewFile (f7b7f89c)
f7b7ac37 8945e0 mov [ebp-0x20],eax
f7b7ac3a 834de402 or dword ptr [ebp-0x1c],0x2
f7b7ac3e e945b4ffff jmp Ntfs!NtfsCommonCreate+0x146b (f7b76088)
f7b7ac43 56 push esi
f7b7ac44 ffb568ffffff push dword ptr [ebp-0x98]
f7b7ac4a ff155c9eb6f7 call dword ptr [Ntfs!_imp__ExFreePoolWithTag (f7b69e5c)]
f7b7ac50 e9f9b8ffff jmp Ntfs!NtfsCommonCreate+0x1563 (f7b7654e)
f7b7ac55 ff75ac push dword ptr [ebp-0x54]
f7b7ac58 57 push edi
f7b7ac59 e848e4ffff call Ntfs!NtfsCleanupIndexContext (f7b790a6)
f7b7ac5e e9dfb8ffff jmp Ntfs!NtfsCommonCreate+0x154e (f7b76542)
f7b7ac63 90 nop
f7b7ac64 90 nop
f7b7ac65 90 nop
f7b7ac66 90 nop
f7b7ac67 90 nop
Ntfs!NtfsFindIndexEntry:
f7b7ac68 6a14 push 0x14
f7b7ac6a 6890b0b6f7 push 0xf7b6b090
f7b7ac6f e82c77fdff call Ntfs!_SEH_prolog (f7b523a0)
f7b7ac74 33db xor ebx,ebx
f7b7ac76 885de7 mov [ebp-0x19],bl
f7b7ac79 8b7524 mov esi,[ebp+0x24]
f7b7ac7c 3bf3 cmp esi,ebx
f7b7ac7e 0f84f9c80000 je Ntfs!NtfsFindIndexEntry+0x1d (f7b8757d)
f7b7ac84 8975e0 mov [ebp-0x20],esi
f7b7ac87 895dfc mov [ebp-0x4],ebx
f7b7ac8a 56 push esi
f7b7ac8b ff7510 push dword ptr [ebp+0x10]
f7b7ac8e 8b7d0c mov edi,[ebp+0xc]
f7b7ac91 57 push edi
f7b7ac92 ff7508 push dword ptr [ebp+0x8]
f7b7ac95 e873e9ffff call Ntfs!FindFirstIndexEntry (f7b7960d)
f7b7ac9a 53 push ebx
f7b7ac9b 53 push ebx
f7b7ac9c 56 push esi
f7b7ac9d ff7514 push dword ptr [ebp+0x14]
f7b7aca0 53 push ebx
f7b7aca1 ff7510 push dword ptr [ebp+0x10]
f7b7aca4 57 push edi
f7b7aca5 ff7508 push dword ptr [ebp+0x8]
f7b7aca8 e84be8ffff call Ntfs!FindNextIndexEntry (f7b794f8)
f7b7acad 84c0 test al,al
f7b7acaf 0f85ec940000 jne Ntfs!NtfsFindIndexEntry+0x5f (f7b841a1)
f7b7acb5 885de7 mov [ebp-0x19],bl
f7b7acb8 834dfcff or dword ptr [ebp-0x4],0xffffffff
f7b7acbc e813000000 call Ntfs!NtfsFindIndexEntry+0xf4 (f7b7acd4)
f7b7acc1 8a45e7 mov al,[ebp-0x19]
f7b7acc4 8d65d0 lea esp,[ebp-0x30]
f7b7acc7 e8b476fdff call Ntfs!_SEH_epilog (f7b52380)
f7b7accc c22000 ret 0x20
f7b7accf 90 nop
f7b7acd0 90 nop
f7b7acd1 90 nop
f7b7acd2 90 nop
f7b7acd3 90 nop
f7b7acd4 395d24 cmp [ebp+0x24],ebx
 
Hi Nancy,

The system crashes after ntfsCreatwNewFile. Maybe somthing related to harddisk. Run sfc /scannow. If your PC still crashes, it is hardware error at the mother board or CPU.

f7b7ac32 e8654c0000 call Ntfs!NtfsCreateNewFile (f7b7f89c) <----
 
I ran that scan thing but I'm still getting crashes, had 2 in the time it took me to have a shower. first one was ntfs.sys the second one was memory corruption, which I dont understand if my RAM passed the test...
Well thanks for all your help, I'm just going to have to learn to live with it because I cant afford to replace my Mobo and/or CPU :(

Just fwiw, in your expert opinion, could it be related to low power supply?

My PC is 2 and a half years old and the PSU is either 240 or 300w I cant remember which, I tried to change my power management settings in my bios but then my PC wouldnt start :(
 
I don't think it is ram problem as your PC get nstatus code 0xc000001d which is hardware problem at CPU or motheboard. RAMTEST is not reliable tool to test memory. Install Prime 95 to stress test your CPU.
http://www.mersenne.org/freesoft.htm

The last resort is re-install windows to XP SP1 and don't install SP2. A lot of driver is incomaptible with SP2. If it still fails, your problem is related to hardware.
 
Been running the stress test for about 9 hours now and now errors so far, going to leave it on while I'm at work and hope for the best.

I dread reinstalling windows, the copy I have is very pre security updates, last time I did it it took every XP attacking worm and virus swarmed to my machine while I was still trying to get firewalled, virus shielded and security updated. Nightmare!
 
IRQ_NOT_LESS_OR_EQUAL is normally due to a problem with SOMETHING hardware.. pci card/bus are the normal culprits (ie the second network card that seemed to alleviate the problem much much earlier). Odds are that your motherboard is failing though and as a stop-gap you can remove EVERYTHING that is slotted (not ram) and see if you still get the crash.
 
To HP_Compaq_Tech:

Bugcheck 0A may be related to hardware or software problem. There have a lot of software known bug which caused bugcheck 0A. Search google using keyword bugcheck 0A and you will find a lot of hits relating to software error. If bugcheck 0A only stood for hardware error, debug bugcheck code 0A would be much easier.
 
More Issues With STOP Errors

right, i've got some major problems too. and i know, it serves me right. but im poor. okay, so here's what i've got
p4 3.0 w/ HT
512 ddr3200 ram from Veritech
asrock p4vt8+
radeon9800xt (saving grace)
80 gig maxtor

with this plugged in my computer runs, but poorly. i just recently spent a lot of money to get my power supply upgraded (new coolermaster case + psu).

I get lots of BSOD's while im gaming, or just trying to use my machine. issues. i get mainly the ones listed here in this article: (wont let me post so it's a microsoft support article with the following number:271955, basically it says that if these four STOPs keep occuring you've got a bad ram stick.)

ie, 50, 1a, 4e, 0a

i got the new memtest, and it runs through and gives me errors on test #7, yea, #7. and it does this with my ram and my buddies ram also. no other errors on other tests just 7. i just recently sent my ram off to the manf. for RMA and they say it is fine (and also that thye're going to charge me another 35 bucks to get it sent back - they didnt tell me that before i sent it isnt that rude/ illegal? in any case). I've gone thru about 3 HD formats, tried XP and Server 2k3, and still nothing gets rid of the bsods. i think it may be my CPU or mobo? i used to have a gigabyte mobo but it doesnt work anymore. how shoul di go about getting this fixed? I am thinking about taking the machine into the shop and having them look at it part by part, but that will be expensive. im a poor uni student i cant do this much longer. memtest says it might be the ram, microsoft says it might be the ram (that was enough for me i sent it off for rma) but it's not. please please help me. this is like hell! hehe. cheers.


Will
 
The hardware maybe at the cache memory at CPU or motherboard. If you attach all the system event 1001 here. I can identify whether it is hardware error or not.

When Windows crashes, it writes a system event 1001 and a minidump to the folder \windows\minidump. Check system event 1001 and it has the content of the blue screen

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001. Copy the content of all the system event and paste it back here
 
Note: I have tried everything. I installed/uninstalled various drivers. Updated bios. Clean install of XP.

System:
Prescot P4 processor
1024 mb RAM(2x512 PNY DDR 400)
Asus p4c800 e deluxe motherboard
Nvidia 5900 driver 61.71
Audigy 2ZS Gamer Edition

It seems I can leave this on all day and never have a problem sometimes. Then other times, I get IRQ errors or Page Fault errors nonstop.

Added Info: Hmm... since I've done the clean install, the only things I've installed are drivers and software associated with my hardware. I did install The Matrix Online and I've noticed that it seems to only crash as it is updating, unlike before the reinstall where I crashed for no apparent reason. Before I head off to class, I'm going to start running memtest, though when I did the usual of taking out one stick and running the comp and putting in the other later still didn't change anything.

Here are errors from 3 different instances(from latest to earliest)

1. Error code 1000000a, parameter1 00000004, parameter2 00000002, parameter3 00000000, parameter4 804e85f5.

2. Error code 10000050, parameter1 e36a4010, parameter2 00000001, parameter3 f76cbece, parameter4 00000001.

3. Error code 1000007e, parameter1 c0000005, parameter2 804da0f1, parameter3 f7c7a750, parameter4 f7c7a44c.

Zip has minidumps for all 3 instances I believe.


Update: I think I figured out the problem. My CPU is overheating and using some utilities it looks like my CPU is running at 76-78 oC idle!!! Just ordered a new fan and heatsink, so hopefully that will fix the problem.
 
I was running 61.77, at least I thought I was. I installed the driver anyways, and my CPU is still running at high temps. In fact, I ran MxO patcher and watched my cpu's temp raise dramatically. I installed a few other games as well and noticed the same thing. I think I had more problems before I reinstalled windows though, because it was sooo much more unstable before.

I think the thermal material "died" and is preventing the fan from cooling the cpu. So, hopefully, once I reinstall a new fan, all will be better. Then I'll clean up the old fan and put the thermal pads I ordered away for the future in case the new one does the same thing.
 
in 4 days the system produced apprx 60 of the 1001 errors. my (stupid) firewall at uni wont let me attach zips so bear with me. i am going to post just a few properties up: (and chopped cause you know the details)

Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: 1/19/2005
Time: 8:49:11 PM
User: N/A
Computer: MOOSER
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a (0x00000401, 0xc01d9854, 0x1ae81025, 0x0006ba04). A dump was saved in: C:\WINDOWS\Minidump\Mini011905-03.dmp.


Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x10000050 (0xe5d3cabc, 0x00000000, 0xbf81799f, 0x00000002). A dump was saved in: C:\WINDOWS\Minidump\Mini012105-06.dmp.

Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000de (0x00000002, 0xe12ab1a4, 0xe10bd7a4, 0x12e898c6). A dump was saved in: C:\WINDOWS\Minidump\Mini012105-11.dmp.


Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000004e (0x00000099, 0x00013e93, 0x00000000, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini012105-02.dmp.


Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000ea (0x82060a80, 0x82139d50, 0x823a63e8, 0x00000001). A dump was saved in: C:\WINDOWS\Minidump\Mini012205-13.dmp.


Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x1000008e (0xc0000005, 0x805aec37, 0xba787bc8, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini012205-12.dmp.


Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a (0x00041785, 0xc0c00000, 0x0001add3, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini012205-04.dmp.

Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x10000050 (0xe51fe684, 0x00000000, 0xbfb1e50a, 0x00000002). A dump was saved in: C:\WINDOWS\Minidump\Mini012105-07.dmp.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.





cpc2004 said:
The hardware maybe at the cache memory at CPU or motherboard. If you attach all the system event 1001 here. I can identify whether it is hardware error or not.

When Windows crashes, it writes a system event 1001 and a minidump to the folder \windows\minidump. Check system event 1001 and it has the content of the blue screen

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001. Copy the content of all the system event and paste it back here
Click to expand...
 
it just crashed once more with a stick of my friends' ram: giving this:


Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: 1/29/2005
Time: 4:11:19 PM
User: N/A
Computer: MOOSER
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x10000050 (0xe5d6a01c, 0x00000000, 0xbfb1e50a, 0x00000002). A dump was saved in: C:\WINDOWS\Minidump\Mini012905-01.dmp.
 
To Tchiseen,

Are you using nVidia Display Card Driver? As the bugcheck EA and 8E may be caused by the faulty nVidia Display Card Driver? If not attach a minidump here, change the file extension of the minidump from *.dmp to *.txt and you can attach a minidump here.

Help it can help you
 
For about the last month or so I have been getting Page Falut in Non Paged Area, with increasing frequency. It usally seems to occur when I try to log onto AOL, but not always.

I am attaching the last minidump. Would appreciate any help in resolving this issue.
I have changed the file extension to ".txt" to upload.
 
Wow, this thread is great!
I have been having problems with blue screens for a while now and can't figure out why. There are several error messages I get, and different files are shown with them (win32k.sys, pci.sys, nv4disp.dll are the ones I can remember now)...
Most of the time they occur when booting XP. There are even messages that say that SYSTEM (registry) is damaged and I should try the repair option on the XP installation CD. The strange thing is: I just reboot and it works, so the file is NOT damaged.

cpc2004, would you mind having a look at my last 4 minidumps? I'm really desperate as most of the parts of my PC are new - except the psu, soundcard, network card, hdd and, well, the case ; )
I' ve had some problems with my old PC, so it might be the PSU??? Is there a chance the minidumps can hint to this root of all evil?
Well, then I've heard that the SB Live! soundcard (which I have) can make problems, too....

The corresponding entries in the system protocol are (they are in german):

"Der Computer ist nach einem schwerwiegenden Fehler neu gestartet. Der Fehlercode war: 0x1000008e (0xc000001d, 0xbf92a321, 0xf32afc7c, 0x00000000). Ein volles Abbild wurde gespeichert in: C:\WINDOWS\Minidump\Mini011905-01.dmp."

"Der Computer ist nach einem schwerwiegenden Fehler neu gestartet. Der Fehlercode war: 0x00000050 (0xa6d3a6e3, 0x00000000, 0xbf929ebf, 0x00000000). Ein volles Abbild wurde gespeichert in: C:\WINDOWS\Minidump\Mini012405-01.dmp."

"Der Computer ist nach einem schwerwiegenden Fehler neu gestartet. Der Fehlercode war: 0x00000050 (0xf5c73cf4, 0x00000000, 0xbf92a0e1, 0x00000000). Ein volles Abbild wurde gespeichert in: C:\WINDOWS\Minidump\Mini012705-01.dmp."

"Der Computer ist nach einem schwerwiegenden Fehler neu gestartet. Der Fehlercode war: 0x00000050 (0xe2246020, 0x00000000, 0xbfa55544, 0x00000001). Ein volles Abbild wurde gespeichert in: C:\WINDOWS\Minidump\Mini013005-01.dmp."

Thanks a lot if you find the time to have a look at my problem...

PS: Oh, and I have had the 66.93 NVIDIA driver installed at the time those crashes happened, I just reverted back to the version you recommended.
Oh, and memtest86+ runs a lot of passes (~9hrs) without any errors.
 
To Yarden,


I've processed your minidump. nVidia Display Card driver 66.93 is the culprit. Install nVidia Display Card Driver Version 61.77 which resolve the problem. http://www.nvidia.com/object/winxp_2k_61.77.html

Mini013005-01_50.dmp
BugCheck 50, {e2246020, 0, bfa55544, 1}
Probably caused by : nv4_disp.dll ( nv4_disp+c2544 )

Hope it can help you
cpc2004
 
To Chcpe,

Your windows failed at module ATWPKT2 and I have no idea what it is. The problem may be related to faulty ram as the failing operation is write operation. You are using W2k FP4. According to my experience, half of the W2k Crash is related to hardware and 25% of XP crashes are related to hardware.

Suggestion
1. De-install ATWPKT2 or upgrade the latest patch to ATWKT2
2. Run memtest and make sure no hardware error. http://www.memtest86.com
3. Attach all the system event 1001 so I can analyse the error pattern to determine whether it is hardware or software problem


PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: f7836100, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: eb6e8bba, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

FAULTING_IP: ATWPKT2+bba eb6e8bba
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
ba99bb5c 006e006c f7875f28 f97efac8 00000000 ATWPKT2+0xbba
ba99bb90 eb6e8c92 ba99bbac ba99bba4 84053d28 0x6e006c
ba99bbc0 eb6e8f44 ff37e628 ff37e628 ff3c2880 ATWPKT2+0xc92
ba99bc00 8041d1af f7875470 f97efac8 f97efac8 ATWPKT2+0xf44
ba99bc14 804acc16 ff37e658 00000000 f97efac8 nt!IopfCallDriver+0x35
ba99bc28 804ada80 f7875470 f97efac8 84053d28 nt!IopSynchronousServiceTail+0x60
ba99bd00 804a5632 000003c4 00000000 00000000 nt!IopXxxControlFile+0x5e4
ba99bd34 80463f64 000003c4 00000000 00000000 nt!NtDeviceIoControlFile+0x28
ba99bd34 77f82ca0 000003c4 00000000 00000000 nt!KiSystemService+0xc4
02c239ac 00000000 00000000 00000000 00000000 0x77f82ca0


Hope it can help you
 
CPC2004:

I did a search and found that ATWKT2 is related to AOL. I don't have my floppy drive with we so I can't do the memory check until tomorrow.

I am attaching some more minidumps.

Thanks so much for your help. You are a peach!
 
Status
Not open for further replies.

Similar threads

M
Front Page Cache Issues?
Replies
13
Views
513
BbN48
B
AGenericFool
Help - Valid Windows 10 Licenses deactivate after two days?!
Replies
1
Views
309
Nelson28
N
J
The machine starts with no screen signal
Replies
1
Views
577
bazz2004
B

Latest posts

Back