BSOD playing Heroes of Newerth error: Page fault in nonpaged area

pugmastaflex · Feb 8, 2012

Hi there,

I just joined this forum (like many others) to get some expert help. Thanks in advance for taking your time as it is only with your generosity that we get solutions.

I am running a week old computer (self-built) with a week old Windows 7 Home Premium 64-bit Retail version (initial installation). I have attached the BSOD information required in the instructions given...

I got the BSOD error "Page fault in non paged area"
And the error reads as such:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 50
BCP1: FFFFFA8308CB5DA8
BCP2: 0000000000000000
BCP3: FFFFF80002E5442B
BCP4: 0000000000000005
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\020812-10639-01.dmp
C:\Users\Eddie\AppData\Local\Temp\WER-19796-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

I appreciate any help you may give. Thanks again.

Cheers,
Eddie

JMH · Feb 8, 2012

* Kaspersky is a frequent cause of BSOD's.
I would remove and replace it with Microsoft Security Essentials AT LEAST TO TEST.

http://support.kaspersky.com/downloads/utils/kavremover10.zip

Microsoft Security Essentials - Free Antivirus for Windows

* Your crashes were caused by memory corruption/exception (probably a driver).
Please run these two tests to verify your memory and find which driver is causing the problem.

If you are overclocking anything reset to default before running these tests.
In other words STOP!!!

If you have raid > update its Driver.

Memtest.

*Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Memtest86+ - Advanced Memory Diagnostic Tool

*Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.

Any errors are indicative of a memory problem.

If a known good stick fails in a motherboard slot it is probably the slot.

Click to expand...

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Driver verifier

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Special Pool", "Force Pending I/O Requests" and "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.
If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Click to expand...

Using Driver Verifier to identify issues with Windows drivers for advanced users

pugmastaflex · Feb 27, 2012

Hey, thanks so much for your reply. I did the memtest...no dice (no errors).
Also took out the Kaspersky...
Do you have any other suggestions? Also, is there any other information that I can provide that may lead on to something? Thanks so much.

writhziden · Feb 27, 2012

Please provide the latest crash reports. They may reveal new information as to what is causing the crashes.

pugmastaflex · Feb 27, 2012

Hey, here is the latest zip of all the information. Thanks again.

writhziden · Feb 27, 2012

Problem devices:

Code:

Not Available	USB\VID_0CF3&PID_3000\6&DF2EE03&0&7	The drivers for this device are not installed.
Ethernet Controller	PCI\VEN_8086&DEV_1503&SUBSYS_849C1043&REV_05\3&11583659&0&C8	The drivers for this device are not installed.

antivirus software:

Code:

avp.exe	c:\program files (x86)\kaspersky lab\kaspersky internet security 2012\avp.exe	1900	8	200	1380	2/27/2012 7:55 AM	12.0.0.374	197.55 KB (202,296 bytes)	4/25/2011 12:15 AM
avp.exe	c:\program files (x86)\kaspersky lab\kaspersky internet security 2012\avp.exe	2064	8	200	1380	2/27/2012 5:48 PM	12.0.0.374	197.55 KB (202,296 bytes)	4/25/2011 12:15 AM
klwtblfs.exe	c:\program files (x86)\kaspersky lab\kaspersky internet security 2012\x64\klwtblfs.exe	5580	8	200	1380	2/27/2012 5:48 PM	12.0.0.374	168.39 KB (172,432 bytes)	4/25/2011 12:14 AM

Code:

[list=1][*]
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\pugmastaflex\Windows_NT6_BSOD_jcgriff2\022612-10062-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e4d000 PsLoadedModuleList = 0xfffff800`03092670
Debug session time: Sun Feb 26 21:25:42.284 2012 (UTC - 7:00)
System Uptime: 0 days 6:11:28.111
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5003, fffff70001080000, 4e9e, 4ea000009d45}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+46f0d )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 0000000000004e9e
Arg4: 00004ea000009d45

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  avp.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800483a580 -- (.trap 0xfffff8800483a580)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000000f545000
rdx=000000000f550000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031e05c6 rsp=fffff8800483a710 rbp=fffffa800eb634c0
 r8=0000000000000000  r9=000000000f540000 r10=0000000000010000
r11=0000000000000006 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!ProbeForWrite+0x36:
fffff800`031e05c6 0fb601          movzx   eax,byte ptr [rcx] ds:00000000`0f545000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e5d74c to fffff80002ec9c40

STACK_TEXT:  
fffff880`0483a418 fffff800`02e5d74c : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`00004e9e : nt!KeBugCheckEx
fffff880`0483a420 fffff800`02ec7d6e : 00000000`00000000 00000000`0f545000 fffffa80`0e649700 00000000`00010000 : nt! ?? ::FNODOBFM::`string'+0x46f0d
fffff880`0483a580 fffff800`031e05c6 : 00000000`0f530001 fffffa80`0cf8f870 fffff880`0483a808 00000000`00010000 : nt!KiPageFault+0x16e
fffff880`0483a710 fffff880`0109c937 : 00000000`00000000 fffffa80`0eb634c0 00000000`00000203 fffff800`02ee94d3 : nt!ProbeForWrite+0x36
fffff880`0483a740 fffff880`010c289c : fffff880`0483a840 00000000`0f540001 fffffa80`1037e470 00000000`00000024 : fltmgr!FltpFilterMessage+0x77
fffff880`0483a790 fffff880`010c6ca2 : fffffa80`1037e470 00000000`1200e4e0 00000000`0f540000 fffff800`02ef27d6 : fltmgr!FltpMsgDeviceControl+0xdc
fffff880`0483a7f0 fffff880`0109b99f : fffffa80`0cadb520 fffff880`0483ab60 fffffa80`0eb634c0 00000000`00000000 : fltmgr!FltpMsgDispatch+0xd2
fffff880`0483a870 fffff800`031e4a97 : fffffa80`0eb634c0 fffff880`0483ab60 fffffa80`1037e588 fffffa80`1037e470 : fltmgr! ?? ::FNODOBFM::`string'+0x2e80
fffff880`0483a8d0 fffff800`031e52f6 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0483aa00 fffff800`02ec8ed3 : ffffffff`ffffffff 00000000`1172e7f8 00000000`00000010 00000000`1172e7f0 : nt!NtDeviceIoControlFile+0x56
fffff880`0483aa70 00000000`74832e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1172f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74832e09


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+46f0d
fffff800`02e5d74c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+46f0d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+46f0d

BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+46f0d

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\pugmastaflex\Windows_NT6_BSOD_jcgriff2\022512-9484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e61000 PsLoadedModuleList = 0xfffff800`030a6670
Debug session time: Fri Feb 24 23:03:53.483 2012 (UTC - 7:00)
System Uptime: 0 days 7:16:08.311
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c00df4b8, 0, fffff9600063dcd0, 0}

Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys

Could not read faulting driver name
Probably caused by : cdd.dll ( cdd!CddBitmapHw::Release+b0 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c00df4b8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600063dcd0, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003110100
 fffff900c00df4b8 

FAULTING_IP: 
cdd!CddBitmapHw::Release+b0
fffff960`0063dcd0 488b9898140000  mov     rbx,qword ptr [rax+1498h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880097a2640 -- (.trap 0xfffff880097a2640)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c00de020 rbx=0000000000000000 rcx=fffff900c4095030
rdx=fffffa80102c0b60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600063dcd0 rsp=fffff880097a27d0 rbp=0000000000000001
 r8=000000000000000b  r9=fffff96000351c38 r10=0000000000000000
r11=fffff880097a28d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cdd!CddBitmapHw::Release+0xb0:
fffff960`0063dcd0 488b9898140000  mov     rbx,qword ptr [rax+1498h] ds:0b60:fffff900`c00df4b8=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e899fc to fffff80002eddc40

STACK_TEXT:  
fffff880`097a24d8 fffff800`02e899fc : 00000000`00000050 fffff900`c00df4b8 00000000`00000000 fffff880`097a2640 : nt!KeBugCheckEx
fffff880`097a24e0 fffff800`02edbd6e : 00000000`00000000 fffff900`c00df4b8 00000000`00000000 fffff900`c00c0010 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`097a2640 fffff960`0063dcd0 : 00000000`00000000 fffff960`0022a810 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`097a27d0 fffff960`001664a0 : fffff900`c00c0010 fffff900`c00c0010 00000000`00000001 fffff900`c40b2670 : cdd!CddBitmapHw::Release+0xb0
fffff880`097a2810 fffff900`c00c0010 : fffff900`c00c0010 00000000`00000001 fffff900`c40b2670 00000000`00000001 : win32k+0xc64a0
fffff880`097a2818 fffff900`c00c0010 : 00000000`00000001 fffff900`c40b2670 00000000`00000001 00000000`03cb82d0 : 0xfffff900`c00c0010
fffff880`097a2820 00000000`00000001 : fffff900`c40b2670 00000000`00000001 00000000`03cb82d0 00000000`00000000 : 0xfffff900`c00c0010
fffff880`097a2828 fffff900`c40b2670 : 00000000`00000001 00000000`03cb82d0 00000000`00000000 00000000`00000000 : 0x1
fffff880`097a2830 00000000`00000001 : 00000000`03cb82d0 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff900`c40b2670
fffff880`097a2838 00000000`03cb82d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x1
fffff880`097a2840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x3cb82d0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cdd!CddBitmapHw::Release+b0
fffff960`0063dcd0 488b9898140000  mov     rbx,qword ptr [rax+1498h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  cdd!CddBitmapHw::Release+b0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cdd

IMAGE_NAME:  cdd.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7c546

FAILURE_BUCKET_ID:  X64_0x50_cdd!CddBitmapHw::Release+b0

BUCKET_ID:  X64_0x50_cdd!CddBitmapHw::Release+b0

Followup: MachineOwner
---------

[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\pugmastaflex\Windows_NT6_BSOD_jcgriff2\022012-9921-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e55000 PsLoadedModuleList = 0xfffff800`0309a670
Debug session time: Mon Feb 20 09:33:27.056 2012 (UTC - 7:00)
System Uptime: 0 days 0:15:57.884
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa800846bf40, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa800846bf40
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  kldw.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f41150 to fffff80002ed1c40

STACK_TEXT:  
fffff880`099046e8 fffff800`02f41150 : 00000000`0000001a 00000000`00041790 fffffa80`0846bf40 00000000`0000ffff : nt!KeBugCheckEx
fffff880`099046f0 fffff800`02f05569 : fffffa80`00000000 00000000`0161cfff fffffa80`00000000 fffff880`00961000 : nt! ?? ::FNODOBFM::`string'+0x36024
fffff880`099048b0 fffff800`031e9221 : fffffa80`0f7b5c10 00000000`00000000 fffffa80`10395f90 fffffa80`10395f90 : nt!MiRemoveMappedView+0xd9
fffff880`099049d0 fffff800`031e9623 : 0000007f`00000000 00000000`01530000 fffffa80`00000001 00000000`0008ec01 : nt!MiUnmapViewOfSection+0x1b1
fffff880`09904a90 fffff800`02ed0ed3 : 00000000`00000000 00000000`01530000 fffffa80`0f858540 00000000`00020238 : nt!NtUnmapViewOfSection+0x5f
fffff880`09904ae0 00000000`773615ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e318 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773615ba


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+36024
fffff800`02f41150 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+36024

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

Followup: MachineOwner
---------


[/list]

Caused by avp.exe: Kaspersky
Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Drivers...
Caused by kldw.exe: Kaspersky

You may need to run Memtest86+ again (we'll consider it after all Kaspersky remnants are gone), though I think it is fairly likely the crashes were caused by Kaspersky. Did you use the removal tool for Kaspersky lab products to remove the product?

pugmastaflex · Feb 27, 2012

I just used the uninstall button. I will definitely get back to you tomorrow after using the remove kit. Do you have any suggestions for a preferred Anti-Virus (I do not mind the subscription ones) softwares that do not cause problems?

Thanks

writhziden · Feb 27, 2012

I use the http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 I have not had any problems with it. I also use safe browsing techniques to avoid questionable websites, although WOT included in that security setup helps with this, as well.

Do you still need troubleshooting?

pugmastaflex · Mar 19, 2012

Still BSODs

Actually, yes, I use that anti-virus now, Kaspersky is 100% gone...still getting BSODs...I will attach the zip files of the crashlogs when I get home. Thanks for following up. I feel really grateful for all the help.

writhziden · Mar 19, 2012

No problem. I'll keep an eye out for the crash reports.

pugmastaflex · Mar 19, 2012

Here it is! Thanks again...it actually BSOD'ed on me as I was doing this the first time 5 minutes ago.

writhziden · Mar 19, 2012

Problem Devices:

Code:

Not Available	USB\VID_0CF3&PID_3000\6&DF2EE03&0&7	The drivers for this device are not installed.
Ethernet Controller	PCI\VEN_8086&DEV_1503&SUBSYS_849C1043&REV_05\3&11583659&0&C8	The drivers for this device are not installed.

Security Software:

Code:

msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	956	8	200	1380	3/19/2012 6:09 PM	3.0.8402.0	12.48 KB (12,784 bytes)	4/27/2011 5:21 PM
nissrv.exe	c:\program files\microsoft security client\antimalware\nissrv.exe	2540	8	200	1380	3/19/2012 6:09 PM	3.0.8402.0	281.52 KB (288,272 bytes)	4/27/2011 5:21 PM
msseces.exe	c:\program files\microsoft security client\msseces.exe	1380	8	200	1380	3/19/2012 6:09 PM	2.1.1116.0	1.37 MB (1,436,736 bytes)	6/15/2011 2:35 PM

Code:

[list=1][*]
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\pugmastaflex\Windows_NT6_BSOD_jcgriff2\031912-10030-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e08000 PsLoadedModuleList = 0xfffff800`0304c650
Debug session time: Mon Mar 19 16:08:51.494 2012 (UTC - 6:00)
System Uptime: 0 days 0:10:50.322
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa800846bf70, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+355d4 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa800846bf70
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ef3610 to fffff80002e84d40

STACK_TEXT:  
fffff880`060a5818 fffff800`02ef3610 : 00000000`0000001a 00000000`00041790 fffffa80`0846bf70 00000000`0000ffff : nt!KeBugCheckEx
fffff880`060a5820 fffff800`02e714bf : fffffa80`00000000 00000000`0fbd6fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x355d4
fffff880`060a59e0 fffff800`02e83fd3 : ffffffff`ffffffff 00000000`04aad670 00000000`04aad638 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`060a5ae0 00000000`776214fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`04aad5a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776214fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+355d4
fffff800`02ef3610 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+355d4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+355d4

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+355d4

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\pugmastaflex\Windows_NT6_BSOD_jcgriff2\031112-9360-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e68000 PsLoadedModuleList = 0xfffff800`030ad670
Debug session time: Sat Mar 10 23:30:29.125 2012 (UTC - 6:00)
System Uptime: 0 days 3:05:22.953
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960001563ac, fffff88007e68ec0, 0}

Probably caused by : win32k.sys ( win32k+c63ac )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960001563ac, Address of the instruction which caused the bugcheck
Arg3: fffff88007e68ec0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k+c63ac
fffff960`001563ac 396908          cmp     dword ptr [rcx+8],ebp

CONTEXT:  fffff88007e68ec0 -- (.cxr 0xfffff88007e68ec0)
rax=fffff900c0200000 rbx=fffff900c00c006c rcx=00000000000007eb
rdx=fffffa800ec1bb60 rsi=fffff900c1dbd000 rdi=0000000000000000
rip=fffff960001563ac rsp=fffff88007e698a0 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000000 r10=000000000000390c
r11=fffff88007e69880 r12=fffff900c1dbd238 r13=0000000000000000
r14=0000000000000000 r15=00000000000000fd
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
win32k+0xc63ac:
fffff960`001563ac 396908          cmp     dword ptr [rcx+8],ebp ds:002b:00000000`000007f3=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  hon.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff960001563ac

STACK_TEXT:  
fffff880`07e698a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k+0xc63ac


FOLLOWUP_IP: 
win32k+c63ac
fffff960`001563ac 396908          cmp     dword ptr [rcx+8],ebp

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k+c63ac

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f10ff25

STACK_COMMAND:  .cxr 0xfffff88007e68ec0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k+c63ac

BUCKET_ID:  X64_0x3B_win32k+c63ac

Followup: MachineOwner
---------

[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\pugmastaflex\Windows_NT6_BSOD_jcgriff2\030512-9640-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e1e000 PsLoadedModuleList = 0xfffff800`03063670
Debug session time: Mon Mar  5 21:09:19.101 2012 (UTC - 6:00)
System Uptime: 0 days 2:30:07.929
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {e000000, 1, 6af6ca34, 8}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+468e5 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 000000000e000000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: 000000006af6ca34, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000008, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030cd100
 000000000e000000 

FAULTING_IP: 
+3030636264323833
00000000`6af6ca34 ??              ???

MM_INTERNAL_CODE:  8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  Reckoning.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002e2e17b to fffff80002e9ac40

STACK_TEXT:  
fffff880`07152978 fffff800`02e2e17b : 00000000`00000050 00000000`0e000000 00000000`00000001 fffff880`07152ae0 : nt!KeBugCheckEx
fffff880`07152980 fffff800`02e98d6e : 00000000`00000001 00000000`0e000000 00000000`0c7bf701 00000000`070add10 : nt! ?? ::FNODOBFM::`string'+0x468e5
fffff880`07152ae0 00000000`6af6ca34 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0adae7d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6af6ca34


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+468e5
fffff800`02e2e17b cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+468e5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+468e5

BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+468e5

Followup: MachineOwner
---------


[/list]

Possible causes are Memory problems... Drivers...
Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Antivirus Software... Drivers...

Thanks to Dave76 for help understanding possible causes.

The good news is that if you have a paid subscription to Kaspersky, you are welcome to re-install it once we determine the true cause of your crashes. Kaspersky and other antivirus programs: the developers have been working to have the software cause less problems with Windows 7, so now when antivirus software is blamed, it is usually an underlying problem. Unfortunately, the antivirus software sometimes must be removed so that Windows stops blaming it for the crashes. Once we narrow down the true cause, you can put Kaspersky back on your system if you wish.

We will start with the common problems first (see bold possible causes). Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.

If you are overclocking any hardware, please stop.
I have a suspicion that the crashes may be related to an application or service conflict. http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:

a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier and in step 3, only select Standard settings. Do not select the other two settings in the red boxes.

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

pugmastaflex · Mar 19, 2012

Okay, I've done the memtest86 already, going to run the extended memtest to see if this uncovers anything. Will update you here.

At least we know Kaspersky is out of the question now...But what could it be...:huh:

writhziden · Mar 19, 2012

Could be memory, application conflicts, drivers, Windows brokenness, etc. Have to rule things out one step at a time starting with the most likely.

pugmastaflex · Mar 19, 2012

Here it is as a txt file. It said no errors.

pugmastaflex · Mar 19, 2012

Crashed again! Should I be attaching more crashlogs or is that unnecessary...thanks!

writhziden · Mar 19, 2012

See how things go checking for application conflicts.

Also, please fill out your system specs using http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html as a guide.

pugmastaflex · Mar 19, 2012

Got it...I will fill out the specs. Just an update though. The driver verifier worked and basically cut off my router. It would connect to the router, but not the internet. It started working again when I turned the verifier off. Those two 'unidentified' ethernet controllers are probably the cause. So it looks like we have narrowed it down a bit....

Just don't know how to fix those drivers...without cutting off the internet.

writhziden · Mar 19, 2012

The controller appears to be an Intel Ethernet Controller. Intel® Driver Update Utility

pugmastaflex · Apr 7, 2012

Hey

It seems to have bugged out again! Ah...Including all drivers being there now...(including the ethernet one. Though it blue screens much less often. I'll attach the new logs here. Thanks so much for everything again...

I hope we can get to the bottom of this.

BSOD playing Heroes of Newerth error: Page fault in nonpaged area

New member

My Computer My Computer

At a glance

Banned

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer