System suddenly crashes - Page Fault in Non Paged Area

Status
Not open for further replies.

leapbrother

Posts: 12   +0
Hi..

I wonder if you can help. I saw a thread http://tinyurl.com/78csd where several answers were given by cpc2004, but I don’t know how to do the analysis to find out what my problem is.

Simply, my system has started from time to time to shut down, like a power cut and always with the same error code (1003). It also always shuts down when I try to burn a DVD, but I will come to that later. It’s a long post, so please bear with me. System details are as follows.

XP Pro (SP2)
P4 2.26gb
768Mb Ram
Pioneer DVD-Rom (slave)
NEC DVD_RW 3540A (master – newly fitted to replace Hitachi CDRW)
Internal 60gb drive partitioned to drive c: (OS and programmes) and drive E: (data)
Internal 200gb hard drive (newly fitted, same time as DVD-RW and to replace E: for data storage
External drive H: (back up of data)
Floppy
nVidia GeFroce 6600 (driving two LCD’s) driver version 7.1.8.9

I followed some advice and have the following information. I “turned on” the Blue Screen of Death to get this error report after it had crashed.



A problem has been detected and windows has been shut down to prevent damage to your computer.

The problem seems to be caused by the following file: ntfs.sys

PAGE_FAULT_IN_NONPAGED_AREA

If this is the first time you have seen this stop error screen, restart your computer. If this screen appears again, follow threes steps

Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows updates you might need.

If problems continue, disable or remove any news installed hardware or software. Disable BIOS memory options such as cashing or shadowing. If you need to use safe mode to recover or disable components, restart your computer , press F* to select advanced start-up options, and then select safe mode.

Technical information:

*** STOP: 0x00000050 (0xDCE1549B, 0x00000000, 0xF73D2257, 0x000000000)


*** ntfs.sys – Address F73D2257 base at F73D1000, datestamp 41107ee

Beginning dump of physical memory
Physical memory dump complete
Contact your system administrator or technical support group for further assistance.



Following the advice given by cpc2004 in an earlier thread https://www.techspot.com/vb/topic17691-pg2.html I have also produced this information

My software (taken from msinfo32) can be found here www.remarked.net/softwarelist.txt

And then the error information from system events can be found here www.remarked.net/wtf/wtf5.jpg

Again following the advice given I installed and ran pstat.exe. The log from this can be found here www.remarked.net/wtf/pstat.txt

Now, I only recently fitted the DVD-RW and at the same time the HD. I had experienced this problem occasionally before but what I have found it is that when I try to burn a DVD (using Nero Burning Rom 6.6.0.3) to back up some files – hence why I replaced the CDRW with the DVD-RW and bought a bigger drive as I was running out of storage that just after I press for Nero to burn, it crashes with the same error code. All the time

HELP Please.. this is driving me nuts.

Massive thanks.
 
When Windows crashes with blue screen, it writes a system event 1001 and a minidump to the folder \windows\minidump. Check system event 1001 and it has the content of the blue screen

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001. Copy the content and paste it back here

Zip 4 to 6 minidumps and attach the zip files here.
 
Two of your minidumps has 4 bytes memory corruption at ntoskrnl. Faulty RAM is the culprit. If you have only one memory stick, buy a new memory stick.

If you have two memory stick, you have to determine which memory stick is in error. You can memtest to test the ram. If memtest reports hardware error, the RAM is faulty. Vice versa if memtest does not detect any error, it does not mean the memory is good as some faulty ram can pass memtest.
If you have more than one memory stick, take out a memory stick. If BSOD dose not occur, that memory stick is faulty.


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
[ ad 94 58 80:88 de ea 82 ]
4 errors : !nt (804e2724-804e2727)

MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
STACK_COMMAND: .trap fffffffff1b0b38c ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
 
still no joy..

Hi cpc2004,

Thanks for that info. I have two memory sticks, one 256k and one 512k. This morning I took one out, booted Nero and tried to burn a data DVD. My system crashed, same fault code as before. I swapped memory sticks and tried again, and again my system crashed, and again same error code.

I have attached the windows dump logs here www.remarked.net/wtf/Minidump2.zip (both dated 12/06) along with a 3rd when my system crashed on it’s own last night (dated 11/06). Hope this helps.

And again, a huge thanks for your support with this. I do very much appreciate it.
 
LeapBrother,

One minidump crashed with one bit corruption, one minidump crashed with 4 bytes corruption and other crashed with bugcheck code 50. As you've taken out one memory stick and the culprit is the L2 cache memory of the CPU or cache memnory of the M/B. If you can get a same CPU , replace the CPU. If it doesn't crashed, CPU is the culprit.
 
try again - just to be sure..

Hi cpc2004,

Just to be sure, I tried again. The first time using my 256mb memory stick. I loaded Nero and went to burn and system went down – the dump file for this crash is Mini061205-03.dmp

I then removed the 256mb and replaced it with my 512mb, same slor, again loaded Nero and tried to burn, and once more it crashed. The dump for this crash is Mini061205-04.dmp. Both files can be found here www.remarked.net/wtf/minidump3.zip

If it helps any, I filmed it for you so you can see at what point it crashes. It is always at the same point when it is going to cache the files that I want to burn. The movie can be found here www.remarked.net/wtf/crash.mpg

Hope this helps..

Thanks..
 
As it is a hardware error, I expect your XP has a huge DrWatson logs. As hardware error occurs at usermode, the application crashes and writes the dump to DrWatson. If hardware error occurs at kernel mode, XP crashes with blue screen.

Attach the following files here.
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp
 
I've examined your DrWatson log and it does not have a lot of entries and it doesn't look like it is a hardware error. You have three memory corruption and they are corrupt at the same location nt!KiServiceTable+7c and the overlaid value is different

If it is a hardware error, I expect the corrupt location is random. Your problem is not related to hardware. It is a sofware error, Nero maybe the culprit.

Mini061005-02.dmp 1000007F (00000008, 80042000, 00000000, 00000000)
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
[ ad 94 58 80:88 de ea 82 ]
original value:current value
Mini061205-01.dmp 1000007F (00000008, 80042000, 00000000, 00000000)
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
[ ad 94 58 80:28 26 18 81 ]
original value:current value
Mini060805-02.dmp 1000007F (00000008, 80042000, 00000000, 00000000)
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
[ ad 94 58 80:38 38 d6 82 ]
original value:current value

There have 7 crashes with bugcheck 50 at Ntfs!LfsReleaseLch+0x9. I've searched google and there has no known hit for Ntfs!LfsReleaseLch. I am sidetrack by the memory corruption as usually memory corruption is caused by hardware. However kernel mode state can change storage within kernel. Y your poblem may be related to storage overlay by a faulty device driver. One of my MPG card driver at my PC screwed up the kernel storage and cause various system crash. Your symptom is very consistent (ie either bugcheck 50 or 7F) and my case the bugcheck code is random.

Are you using the latest version of Nero Burn?

I need a full memory dump to diagnostic your dump. You have to change the dump option to full dump. When the BSOD occurs, upload your full dump at any webspace, paste the url here and I will download the dump to find out who screw up your XP.
 
Hi cpc2004,

Yes I am using the latest version of Nero, version 6.6.0.3. It is part of the Nero Reloaded package and is a full original version.

I'm sorry, I'm not sure how to change my computer to produce a full memory dump. Could you please advise.


As always, thanks
 
Control Panel --> System --> Advance --> Startup and Recovery --> Write debugging information --> Change minidump to full dump
 
Hi cpc2004,

I just tried to use Nero to get it to crash, which of course it did. I had changed the settings and the memory dump is now around 800mb. Is that what you want..? Can I send it to you using www.yousedit.com and if so to what email?

Cheers
 
Obviously the problem is related to Nero. If you are license user, you can send the full dump to Nero for further investigation. If you can attach the dump at any webspace, I will download the dump and confirm it is Nero problem.
 
PROCESS 8255f7c8 SessionId: 0 Cid: 0f20 Peb: 7ffd7000 ParentCid: 024c
DirBase: 1ede0000 ObjectTable: e39173e0 HandleCount: 297.
Image: nero.exe
VadRoot 826238b8 Vads 197 Clone 0 Private 2362. Modified 1832. Locked 0.
DeviceMap e19ab5e8
Token e11253a8
ElapsedTime 0:02:27.0562
UserTime 0:00:02.0125
KernelTime 0:00:03.0781
kd> !chkimg -lo 50 -d !nt
804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
[ ad 94 58 80:20 9a d4 82 ]

There have 4 bytes overlaid at the same location. The crash is at nero+2c0062 because the instruction is misaligned. Windows recovery is taken control and it encounters recursive abend loop because there have 4 bytes overlaid at nt!KiServiceTable+7c. Finally the stack is overflowed. Utimately it crashed with double fault. I don't know why the storage is overlaid. Most likely it is overlaid by nero but I can't prove it. As you know the windows dump is only a snapshot of the memory when the error occurs. The storage overlaid may occurs a while ago.

The reason why it is misaligned may be related to software or hardware error. Because the BSOD always occurs when you use Nero to burn DVD.

I suggest you should upgrade Nero 6.6.0.3 to 6.6.0.5 or higher level. If it crashes at Nero, attach the minidump here.


BugCheck 7F, {8, 80042000, 0, 0}

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f1f5d507 3fc967f1 7b1e00f7 ffffffe1 ffffffff nero+0x2c0062
f5d5ffff 00000000 00000000 00000000 00000000 0x3fc967f1

MISALIGNED_IP:
nero+2c0062
006c0062 08894df4742d or [ecx+0x2d74f44d],cl

kd> u 6c0050 l20
nero+0x2c0050:
006c0050 8bc7 mov eax,edi
006c0052 8b4dfc mov ecx,[ebp-0x4]
006c0055 6bc03c imul eax,eax,0x3c
006c0058 03c8 add ecx,eax
006c005a 894d10 mov [ebp+0x10],ecx
006c005d 8b4b08 mov ecx,[ebx+0x8] <--
006c0060 394d08 cmp [ebp+0x8],ecx <--
006c0063 894df4 mov [ebp-0xc],ecx <--
006c0066 742d jz nero+0x2c0095 (006c0095)
006c0068 8b5510 mov edx,[ebp+0x10]
006c006b 2bd0 sub edx,eax
006c006d 2b55fc sub edx,[ebp-0x4]
006c0070 035508 add edx,[ebp+0x8]
006c0073 837d1000 cmp dword ptr [ebp+0x10],0x0
006c0077 7410 jz nero+0x2c0089 (006c0089)
006c0079 8b7d10 mov edi,[ebp+0x10]
006c007c 6a0f push 0xf
006c007e 59 pop ecx
006c007f 8bf2 mov esi,edx
 
Hi cpc2004,

Folowed your advice and upgraded my Nero to latest version 6.6.0.14 as given off the Nero website.

Went to burn a DVD and the usual still happened. Just at caching crash and BSOD. Mini dump is here www.remarked.net/wtf/Mini061405-01.dmp

I know this has gone on for a while but please be aware I am very thankfull for your help with this. I may not understand all you are saying, but I do at least feel as though we may get to the bottom of this problem and without your support, that just would not happen. I owe you a beer or three...

Cheers
 
Your problem have two different scenario. The first one is Bugcheck code 7F and other one is bugcheck 50. It doesn't look like it is a hardware error as the failing instruction address is consistent. Usually hardware error occurs randomly. If it is a hardware error, I will expect you will have various bugecheck code with different failing instruction address. Attach the fulll dump of your crash if you want to pursue the root cause of the problem. The problem maybe related to software errror within XP and not nero. As the system service is overlaid at the fix location. I have to figure out how to set a storage alternation trap when the system service table is corrupt and catch the culprit on the spot.

Run chkdsk /r to make sure that your hard disk is healthy.
 
Hey cpc2004,

I’m guessing you are getting a bit pissed with this problem, as am I. I went to the MS site and following that advice downloaded the listed Intel tool. Sadly that didn’t work as it is not applicable for P4’s apparently – see www.remarked.net/wtf/wtf10.jpg

And from the site:

The Intel Processor Frequency ID Utility has the ability to determine the frequency of each processor in a multiprocessor system. Any multiprocessor menu or toolbar selections are disabled in platforms with operating systems other than Windows XP, or Windows 2000. The application also includes an indicator for which processor is currently being tested.
This applies to:
Intel® Celeron® Processor
Intel® Pentium® II Processor
Intel® Pentium® II Xeon™ Processor
Intel® Pentium® III Processor
Intel® Pentium® Pro Processors
Intel® Pentium® Processor
Intel® Pentium® Processor with MMX™ Technology
Intel® Processor Frequency ID Utility
Mobile Intel® Pentium® II Processors
Mobile Intel® Pentium® III Processors
Mobile Intel® Pentium® Processors




I guess we are running out of ideas with this….

But again as always, thanks
 
After further analysis, all the bugcheck 50 have the same symptom. The stack trace of third entry shift one byte to right hand side. As the kenel stack trace belongs to windows kernel and it is unlikely it is a software error. I think it is hardware error at the cache memory of the CPU. In addition your XP also crashes with bugcheck 7F because 4 bytes overlaid at system service table. The XP system service table is most active XP data area and it will be kept at cache memory to enhance performance.

The only thing I don't understand why the failing instruction address is consistent. Howeve faulty CPU is the most reasonable answer of your problem.

stack trace of Mini061005-03.dmp
f18514cc f73f1aac dce179e0 f73f1a97 e10a1648 Ntfs!LfsReleaseLch+0x9
f18514d4 f73f1a97 e10a1648 829693a0 00000000 Ntfs!LfsFlushToLsn+0xa7
f1851509 90f73fc9 ffe179e0 ffffffff 007fffff Ntfs!LfsFlushToLsn+0x97
67f18515 00000000 00000000 00000000 00000000 0x90f73fc9

I guess it should be
f1851509 f73fc9ff e179e0ff ffffff00 7fffff?? Ntfs!LfsFlushToLsn+0x97

stack trace of Mini061205-04.dmp
f8a2e4cc f83c5aac dce17514 f83c5a97 e1325688 Ntfs!LfsReleaseLch+0x9
f8a2e4d4 f83c5a97 e1325688 81b24cf8 00000000 Ntfs!LfsFlushToLsn+0xa7
f8a2e509 e0f83d09 ffe17514 ffffffff 007fffff Ntfs!LfsFlushToLsn+0x97
WARNING: Frame IP not in any known module. Following frames may be wrong.
67f8a2e5 00000000 00000000 00000000 00000000 0xe0f83d09
I guess it should
f8a2e509 f83d09ff e17514ff ffffff00 7fffff?? Ntfs!LfsFlushToLsn+0x97


stack trace of Mini061205-03.dmp
f43744cc f90efaac dce17c5d f90efa97 e36e8cc8 Ntfs!LfsReleaseLch+0x9
f43744d4 f90efa97 e36e8cc8 ff05d690 00000000 Ntfs!LfsFlushToLsn+0xa7
f4374509 78f90fa9 ffe17c5d ffffffff 007fffff Ntfs!LfsFlushToLsn+0x97
WARNING: Frame IP not in any known module. Following frames may be wrong.
67f43745 00000000 00000000 00000000 00000000 0x78f90fa9

I guess it should
f4374509 f90fa9ff e17c5dff ffffff00 7fffff?? Ntfs!LfsFlushToLsn+0x97
 
Just for fun have you gone into the bios and changed your memory speeds to something a bit slower? I was having strange BSOD's and was ready to reformat. After slowing the memory a little my problems went completely away. Just a thought. If your computer is a "brand name", you may not be able to access these settings in bios.
 
Hi...

gwhite, thanks I will check that out. cpc2004, thanks for all your help, you have been great. I'm trying to find a CPU so I can test my system, may take me a couple of weeks. I'll come back with the results..

Cheers
 
Do you have any update of the problem? I have a similar problem at another forum with 4 bytes overlaid at Windows System table which is similar to your problem but at different location.
 
Status
Not open for further replies.
Back