Page Fault in NonPaged Area

Dear all,

I've bought a new system (it's an Intel I7 with 16GB RAM) and I've just installed Windows 7 64bits Professional Edition.

I'm trying to copy a large amount of data (180GB aprox) from another PC by using a external USB disc and the machine keeps panicing with the page fault in nonpaged area error.

I've tried to disable USB 3.0 support in the motherboard (which is a Gigabyte GA-Z68AP-D model), removed and old Hauppage TV tuner I took from the old PC just in case... but the problem persists.

Motherboard drivers are all uptodated, since I installed them from the manufacturer web site.

I'm really upset and totally clueless, more +20 years in IT industry and never had such a problem. :-(

Please find enclosed the BSOD zip file.

System Specs:
Microsoft Windows 7 Professional 64 bits 7601 Multiprocessor Free Service Pack 1
Gigabyte Technology Co., Ltd. Z68AP-D3
Award Modular BIOS v6.00PG
16,00 GB
(1) ST31000524AS ATA Device (2) ST3500630AS ATA Device (3) Generic Storage Device USB Device (4) Hitachi HDP725050GLA360 USB Device
(1) NVIDIA High Definition Audio (2) NVIDIA High Definition Audio (3) NVIDIA High Definition Audio (4) NVIDIA High Definition Audio (5) Realtek High Definition Audio
NVIDIA GeForce GT 440


Many thanks in advance for your valuable help!

Susan

Just an update:

I'm now trying the copy from the other PC using the internal LAN and now I get another BSOD with the cache_error error...

TIA,

Susan

Security software: ??? Recommend either of the following two options:

• Microsoft Security Essentials - Free Antivirus for Windows
  
  
• Good and Free system security combination.

After updating your security software, run full scans of the system for malware/viruses.


Possible out of date drivers:

Code:

GVTDrv64	fffff880`06d5f000	fffff880`06d69000	Tue Sep 05 01:10:02 2006 (44fd22ca)	00014d8a		GVTDrv64.sys
gdrv	fffff880`06d25000	fffff880`06d2e000	Thu Mar 12 21:22:29 2009 (49b9d175)	000105ce		gdrv.sys

GVTDrv.sys: Part of Gigabyte Easy Tune 6 (known issues w/Win7)
gdrv.sys: Gigabyte Easy Saver - mobo power utility (known issues with some system)
Remove the two programs listed above.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\susantita\Windows_NT6_BSOD_jcgriff2\040512-32885-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03012000 PsLoadedModuleList = 0xfffff800`03256650
Debug session time: Wed Apr  4 18:44:14.380 2012 (UTC - 6:00)
System Uptime: 0 days 0:08:25.208
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffffa800c9ef490, fffffa800c9ef490, ffffff800c9ef490}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a53 )

Followup: Pool_corruption
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa800c9ef490, the pool entry being checked.
Arg3: fffffa800c9ef490, the read back flink freelist value (should be the same as 2).
Arg4: ffffff800c9ef490, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  FreeFileSync_x

CURRENT_IRQL:  1

LAST_CONTROL_TRANSFER:  from fffff800031bb4b3 to fffff8000308ed40

STACK_TEXT:  
fffff880`07c3f148 fffff800`031bb4b3 : 00000000`00000019 00000000`00000003 fffffa80`0c9ef490 fffffa80`0c9ef490 : nt!KeBugCheckEx
fffff880`07c3f150 fffff880`012e64b5 : fffff8a0`00000002 00000000`000000b2 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0xa53
fffff880`07c3f240 fffff880`012a32b4 : fffffa80`0ded2010 fffff8a0`14e5eb40 fffff8a0`14e67140 00000000`00000000 : Ntfs!NtfsPostUsnChangeWithOverrideOption+0x2d9
fffff880`07c3f310 fffff880`012c7af3 : fffff8a0`12f21010 fffff880`07c3f8a0 00000000`0000000a 00000000`00000701 : Ntfs!NtfsSetRenameInfo+0x520
fffff880`07c3f700 fffff880`01239574 : fffffa80`0ded2010 fffffa80`1213cc10 fffff880`07c3f801 fffff880`07c3f800 : Ntfs!NtfsCommonSetInformation+0x7e3
fffff880`07c3f7e0 fffff880`010debcf : fffffa80`1213cfb0 fffffa80`1213cc10 fffffa80`0ded2010 fffff880`07c3f808 : Ntfs!NtfsFsdSetInformation+0x11c
fffff880`07c3f860 fffff880`010dd6df : fffffa80`0e0639e0 fffffa80`1213cc10 fffffa80`0e063900 fffffa80`1213cc10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`07c3f8f0 fffff800`0336cd63 : 00000000`00000120 fffff880`07c3fb60 00000000`00000000 fffffa80`119bf3a0 : fltmgr!FltpDispatch+0xcf
fffff880`07c3f950 fffff800`0308dfd3 : 00000000`00000328 fffffa80`0ffcab60 00000000`0015c1f8 fffff800`00000120 : nt!NtSetInformationFile+0x91f
fffff880`07c3fa70 00000000`76e5158a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0015c1d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e5158a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+a53
fffff800`031bb4b3 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExDeferredFreePool+a53

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+a53

BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+a53

Followup: Pool_corruption
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\susantita\Windows_NT6_BSOD_jcgriff2\040512-28236-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03052000 PsLoadedModuleList = 0xfffff800`03296650
Debug session time: Wed Apr  4 18:33:21.362 2012 (UTC - 6:00)
System Uptime: 0 days 0:12:53.190
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa80138b74e0, 0, fffff800030fa2f5, 2}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MmCopyToCachedPage+215 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80138b74e0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800030fa2f5, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003300100
 fffffa80138b74e0 

FAULTING_IP: 
nt!MmCopyToCachedPage+215
fffff800`030fa2f5 488b07          mov     rax,qword ptr [rdi]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  FreeFileSync_x

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88007f99130 -- (.trap 0xfffff88007f99130)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000fffffffff
rdx=fffff80003052000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030fa2f5 rsp=fffff88007f992c0 rbp=fffff88007f99300
 r8=0000098000000000  r9=000000000b2ae440 r10=0000058000000000
r11=0000007ffffffff8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!MmCopyToCachedPage+0x215:
fffff800`030fa2f5 488b07          mov     rax,qword ptr [rdi] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003079c50 to fffff800030ced40

STACK_TEXT:  
fffff880`07f98fc8 fffff800`03079c50 : 00000000`00000050 fffffa80`138b74e0 00000000`00000000 fffff880`07f99130 : nt!KeBugCheckEx
fffff880`07f98fd0 fffff800`030cce6e : 00000000`00000000 fffffa80`138b74e0 fa8011cf`a8a00400 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x43d76
fffff880`07f99130 fffff800`030fa2f5 : 00000000`00000002 ffffffff`ffffffff 00000000`00000002 ffffffff`ffffffff : nt!KiPageFault+0x16e
fffff880`07f992c0 fffff800`030f739e : fffff980`b3c38000 00000000`0b2ae440 fffff880`00000000 00000000`00001000 : nt!MmCopyToCachedPage+0x215
fffff880`07f994b0 fffff800`030f7954 : fffffa80`115fb8b0 00000000`0b2ae440 fffff880`07f995f0 fffff880`00000000 : nt!CcMapAndCopyInToCache+0x20e
fffff880`07f995a0 fffff880`012d1c18 : 00000000`001c0000 fffffa80`11c1d400 fffff880`07f99690 fffffa80`00010000 : nt!CcCopyWrite+0x194
fffff880`07f99630 fffff880`010b8102 : fffffa80`11c1d4d0 fffff880`010bb4f2 00000000`00010000 00000000`00010001 : Ntfs!NtfsCopyWriteA+0x208
fffff880`07f99830 fffff880`010bb8ba : fffff880`07f99900 fffffa80`11cd7788 00000000`0b2a6400 00000000`00010000 : fltmgr!FltpPerformFastIoCall+0xf2
fffff880`07f99890 fffff880`010d983e : 00000000`00010000 00000000`00000000 fffffa80`11c1d4d0 fffff880`07f99a00 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`07f998d0 fffff800`033e07be : fffffa80`11c1d544 fffffa80`00000002 fffffa80`0cae5570 fffffa80`11c1d544 : fltmgr!FltpFastIoWrite+0x1ce
fffff880`07f99970 fffff800`030cdfd3 : fffffa80`0fd88701 00000000`00000504 00000000`00000000 00000000`06cf5808 : nt!NtWriteFile+0x5ad
fffff880`07f99a70 00000000`7744139a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0028ada8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7744139a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MmCopyToCachedPage+215
fffff800`030fa2f5 488b07          mov     rax,qword ptr [rdi]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MmCopyToCachedPage+215

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MmCopyToCachedPage+215

BUCKET_ID:  X64_0x50_nt!MmCopyToCachedPage+215

Followup: MachineOwner
---------

1. Typically caused by drivers or memory problems. Yours is pointing to possible hard disk data corruption.
2. Crash report blames memory corruption. Other possible causes are Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Antivirus Software... Drivers...

Do the following steps to determine the cause of your crashes.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
  For any drives that do not give the message:
  Windows has checked the file system and found no problems
  run disk check again as above. In other words, if it says:
  Windows has made corrections to the file system
  after running the disk check, run the disk check again.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  
  Once these steps have been followed, it is safe to remove and replace components within your computer.

Hello,

I've completeley reinstalled the machine from scratch.

Installed only the network driver from the motherboard's manufacturer CD, for the rest went to intel homepage and install the intel chipset driver.

I've also updated the BIOS version of the Gigabyte motherboard (GA-Z68AP-D3)

It's been working quite well the whole day until I launched last version of VirtualBox, on starting a virtual machine it crashed again.

Please find enclosed another diags file.

Any suggestions based on the new situation would be greatly appreciated.

Thanks a lot in advance for your great advice... and patience

Susan Tita

PS: passed twice the checkdisk without errors.
PPS: Antivirus software is on its way, but I have to fix first of all this crashing problem..

Hello again,

I've been running the Memtest 86+ tool as you suggested.

Tests #1, #2 and #3 finished with about 1million errors!

The system is equipped with 16GB and all the errors came from the range 2048-3320MB as I noticed in Memtest.

Is that proof enough that the computer store should replace the defective memory bank? I'd suppose it would be that easy than replacing the 1st. bank with a new one.

Please shed some light on this.

TIA,

Susan tita

You will want to go through Part 3 of the RAM - Test with Memtest86+ tutorial I provided to determine which module is bad. Avoid Static Damage to Your PC when swapping modules.

Thanks for your promptly reply.

Since the machine is a brand new PC, I'd rather bring it to the store and have the memory replaced.

I suppose bringing the system and my pen-drive with memtest it should be enought to proof something is bad with 1st. memory bank.

What do you think?

TIA,

Susan

As long as you can replicate the problem. I think if you provide the crash reports, that may also be sufficient.

Just to let you know that after going with my defective PC (ie one memory bank) and the wonderful memtest86 (That I wasn't aware of until I found your wonderful forum), the store replaced all 4 memory banks, I reinstalled everything and now the machine is running like a charm...

Thanks a lot for your valuable help and support.

Best regards,

Susan Tita

You're welcome. Glad it was resolved. Feel free to mark the thread solved now. :)