Windows 7: BSOD mostly on wakeup (PAGE_FAULT_IN_NONPAGE_AREA)

jlmwrite · 06 Nov 2012

Hi,

I've been having random BSODs on my new-ish HP dv7 laptop for the past few weeks. After updating all the drivers recommended by the HP support site, the random crashes seem to have gone away.

However, I still get a BSOD almost every time the computer wakes up. I've done MemTest with no reported issues, completed chkdsk, have been running verifier for a while without a crash, and done sfc, etc, etc. It's time I admit I need expert help!

Attached is the SF diag tool zip as directed. Thanks!

Arc · 06 Nov 2012

Hello jlmwrite.

It is crashed by HP Mobile Data Protection System Disk Filter.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa810cb1b290, 0, fffff80002e9af90, 2}

*** WARNING: Unable to verify timestamp for hpdskflt.sys
*** ERROR: Module load completed but symbols could not be loaded for hpdskflt.sys

Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : hpdskflt.sys ( hpdskflt+14c2 )

Followup: MachineOwner
---------

I would suggest you to get rid of this.
Clean Up Factory Bloatware

If you want, you may update it, from http://h20000.www2.hp.com/bizsupport...riesId=1847703

Also there is another thing contributing in the crash, Intel RST (Rapid Storage Technology) Filter driver.

Code:

fffff880`039b7548  fffff880`01bbd116Unable to load image \SystemRoot\system32\DRIVERS\iaStorF.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStorF.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStorF.sys
 iaStorF+0x7116

Get rid of intel rapid storage.

Right click on "my computer" icon and click "manage" on the context menu.
It will open the "computer management" window.
Select "Device Manager" in the left pane, It will list all the existing devices up.
Expand "Disc Drives" by clicking on the triangle in front of it.
Select one item under it, right click, uninstall.
Continue the process for all items under "Disc Drives"
Now restart the computer. At restart, windows will auto configure the appropriate system driver, msahci.sys.

If you want to update RST, http://downloadcenter.intel.com/Default.aspx

Let us know the results.

jlmwrite · 06 Nov 2012

Amazingly fast reply!

I updated the HP Driveguard utility rather than removing it to see what happens. I also got rid of RST as advised.

Two reboots later and 6 wake-ups after varying periods of time, and so far I'm still crash-free! Here's hoping it stays that way.

And thanks again for the help.

Arc · 07 Nov 2012

Wait and see ... it there are further issues, let us know.

jlmwrite · 19 Nov 2012

Hi,

The forum recently solved a BSOD issue for me, and after a Windows Update plus a printer driver install from windows, I'm again getting BSODs every time the computer wakes up (page fault in non paginated area).

I've used System Restore to roll things back before the last Windows Update, but the BSODs are still occurring. Attached is the SF zip file.

Thanks again!

Arc · 20 Nov 2012

Well, it is the same thing, HP Mobile Data Protection System Disk Filter.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa810d34e1c0, 0, fffff80002e96f90, 5}

*** WARNING: Unable to verify timestamp for hpdskflt.sys
*** ERROR: Module load completed but symbols could not be loaded for hpdskflt.sys

Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : hpdskflt.sys ( hpdskflt+14c2 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa810d34e1c0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002e96f90, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c4100
GetUlongFromAddress: unable to read from fffff800030c41c0
 fffffa810d34e1c0 Nonpaged pool

FAULTING_IP: 
nt!RtlCompareMemory+80
fffff800`02e96f90 f3a6            repe cmps byte ptr [rsi],byte ptr [rdi]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003ba2220 -- (.trap 0xfffff88003ba2220)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000005
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e96f90 rsp=fffff88003ba23b8 rbp=fffffa80082d5d10
 r8=0000000000000005  r9=0000000000000030 r10=fffff88003989ac0
r11=fffffa80079b7120 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!RtlCompareMemory+0x80:
fffff800`02e96f90 f3a6            repe cmps byte ptr [rsi],byte ptr [rdi]
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e3b8af to fffff80002e94fc0

STACK_TEXT:  
fffff880`03ba20b8 fffff800`02e3b8af : 00000000`00000050 fffffa81`0d34e1c0 00000000`00000000 fffff880`03ba2220 : nt!KeBugCheckEx
fffff880`03ba20c0 fffff800`02e930ee : 00000000`00000000 fffffa81`0d34e1c0 fffff880`03ba2200 fffffa80`0d34e740 : nt! ?? ::FNODOBFM::`string'+0x437c1
fffff880`03ba2220 fffff800`02e96f90 : fffffa80`07a90c20 fffffa80`07bb15f0 fffff880`01e014c2 fffffa80`082d5d10 : nt!KiPageFault+0x16e
fffff880`03ba23b8 fffff880`01e014c2 : fffffa80`082d5d10 00000000`00000000 fffffa80`07a90c20 00000000`00000000 : nt!RtlCompareMemory+0x80
fffff880`03ba23d0 fffffa80`082d5d10 : 00000000`00000000 fffffa80`07a90c20 00000000`00000000 00000000`00000000 : hpdskflt+0x14c2
fffff880`03ba23d8 00000000`00000000 : fffffa80`07a90c20 00000000`00000000 00000000`00000000 fffff880`03ba2420 : 0xfffffa80`082d5d10


STACK_COMMAND:  kb

FOLLOWUP_IP: 
hpdskflt+14c2
fffff880`01e014c2 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  hpdskflt+14c2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hpdskflt

IMAGE_NAME:  hpdskflt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4dcd7ca6

FAILURE_BUCKET_ID:  X64_0x50_hpdskflt+14c2

BUCKET_ID:  X64_0x50_hpdskflt+14c2

Followup: MachineOwner
---------

7: kd> lmvm hpdskflt
start             end                 module name
fffff880`01e00000 fffff880`01e0a000   hpdskflt T (no symbols)           
    Loaded symbol image file: hpdskflt.sys
    Image path: \SystemRoot\system32\drivers\hpdskflt.sys
    Image name: hpdskflt.sys
    Timestamp:        Sat May 14 00:17:02 2011 (4DCD7CA6)
    CheckSum:         0000E6A7
    ImageSize:        0000A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

And, that is why I suggested earlier to not use it.

Free up the startup.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus.
Apply > OK
Accept the restart.

At least, dont keep this entry in startup at all.

Code:

IgfxTray    c:\windows\system32\igfxtray.exe    Public    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Now decide what to do.

jlmwrite · 21 Nov 2012

Hi,

So I've unloaded everything from startup, but am now having intermittent crashes all the time, not just on wakeup.

SF zip file attached again; thanks in advance for all you do here to help!

jlmwrite · 22 Nov 2012

I did a little bit of digging on my own using the debug tool, and have come to the conclusion that once again hpdskflt.sys is still to blame.

However...

I had uninstalled HP Mobile Data Protection some time ago. Experimented by deleting hpdskflt from the drivers directory, and Windows refused to start. Did a system restore, booted into Windows just fine, and hpdskflt is back.

I'm more confused than ever - and back to just getting crashes on wakeup. Any ideas?

gregrocker · 22 Nov 2012

Most tech enthusiasts would never run the HP factory preinstall which has the worst load of factory crapware in the industry. Instead consider doing a Clean Reinstall - Factory OEM Windows 7 to experience Windows 7 in it's native feather-light state. If you stick with the tools and methods in the tutorial you'll have a perfect install. We'll be here to help you make sure of that.

jlmwrite · 22 Nov 2012

gregrocker, you may be right about the only way to fix my problem is with a clean Windows 7 reload.

I did find an old post of yours stating that the HP Driveguard is the one HP utility that you would/do keep on your system. However, I see after several hours of research that a lot of people have BSODs relating to Driveguard - and that there is apparently no way to permanently disable it!

Doesn't matter how many ways you try to stop it from loading, including deleting/disabling hpdskflt, it always comes back. I can't find a single post anywhere in which a user was able to completely disable it. Some people on older systems fixed their problem with an upgrade, some by blocking a Windows Update for it (which I don't have installed), but the only real fix seems to be a clean, non-bloatware Windows install.

If you -- or anyone else -- has any further ideas on how to completely block or uninstall, I'd be most interested.

Windows 7: BSOD mostly on wakeup (PAGE_FAULT_IN_NONPAGE_AREA)

BSOD mostly on wakeup (PAGE_FAULT_IN_NONPAGE_AREA) problems?