BSOD playing Heroes of Newerth error: Page fault in nonpaged area

pugmastaflex · 19 Mar 2012

Here it is! Thanks again...it actually BSOD'ed on me as I was doing this the first time 5 minutes ago.

writhziden · 19 Mar 2012

Problem Devices:

Code:

Not Available	USB\VID_0CF3&PID_3000\6&DF2EE03&0&7	The drivers for this device are not installed.
Ethernet Controller	PCI\VEN_8086&DEV_1503&SUBSYS_849C1043&REV_05\3&11583659&0&C8	The drivers for this device are not installed.

Security Software:

Code:

msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	956	8	200	1380	3/19/2012 6:09 PM	3.0.8402.0	12.48 KB (12,784 bytes)	4/27/2011 5:21 PM
nissrv.exe	c:\program files\microsoft security client\antimalware\nissrv.exe	2540	8	200	1380	3/19/2012 6:09 PM	3.0.8402.0	281.52 KB (288,272 bytes)	4/27/2011 5:21 PM
msseces.exe	c:\program files\microsoft security client\msseces.exe	1380	8	200	1380	3/19/2012 6:09 PM	2.1.1116.0	1.37 MB (1,436,736 bytes)	6/15/2011 2:35 PM

Code:


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\pugmastaflex\Windows_NT6_BSOD_jcgriff2\031912-10030-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e08000 PsLoadedModuleList = 0xfffff800`0304c650
Debug session time: Mon Mar 19 16:08:51.494 2012 (UTC - 6:00)
System Uptime: 0 days 0:10:50.322
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa800846bf70, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+355d4 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa800846bf70
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ef3610 to fffff80002e84d40

STACK_TEXT:  
fffff880`060a5818 fffff800`02ef3610 : 00000000`0000001a 00000000`00041790 fffffa80`0846bf70 00000000`0000ffff : nt!KeBugCheckEx
fffff880`060a5820 fffff800`02e714bf : fffffa80`00000000 00000000`0fbd6fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x355d4
fffff880`060a59e0 fffff800`02e83fd3 : ffffffff`ffffffff 00000000`04aad670 00000000`04aad638 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`060a5ae0 00000000`776214fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`04aad5a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776214fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+355d4
fffff800`02ef3610 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+355d4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+355d4

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+355d4

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\pugmastaflex\Windows_NT6_BSOD_jcgriff2\031112-9360-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e68000 PsLoadedModuleList = 0xfffff800`030ad670
Debug session time: Sat Mar 10 23:30:29.125 2012 (UTC - 6:00)
System Uptime: 0 days 3:05:22.953
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960001563ac, fffff88007e68ec0, 0}

Probably caused by : win32k.sys ( win32k+c63ac )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960001563ac, Address of the instruction which caused the bugcheck
Arg3: fffff88007e68ec0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k+c63ac
fffff960`001563ac 396908          cmp     dword ptr [rcx+8],ebp

CONTEXT:  fffff88007e68ec0 -- (.cxr 0xfffff88007e68ec0)
rax=fffff900c0200000 rbx=fffff900c00c006c rcx=00000000000007eb
rdx=fffffa800ec1bb60 rsi=fffff900c1dbd000 rdi=0000000000000000
rip=fffff960001563ac rsp=fffff88007e698a0 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000000 r10=000000000000390c
r11=fffff88007e69880 r12=fffff900c1dbd238 r13=0000000000000000
r14=0000000000000000 r15=00000000000000fd
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
win32k+0xc63ac:
fffff960`001563ac 396908          cmp     dword ptr [rcx+8],ebp ds:002b:00000000`000007f3=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  hon.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff960001563ac

STACK_TEXT:  
fffff880`07e698a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k+0xc63ac


FOLLOWUP_IP: 
win32k+c63ac
fffff960`001563ac 396908          cmp     dword ptr [rcx+8],ebp

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k+c63ac

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f10ff25

STACK_COMMAND:  .cxr 0xfffff88007e68ec0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k+c63ac

BUCKET_ID:  X64_0x3B_win32k+c63ac

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\pugmastaflex\Windows_NT6_BSOD_jcgriff2\030512-9640-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e1e000 PsLoadedModuleList = 0xfffff800`03063670
Debug session time: Mon Mar  5 21:09:19.101 2012 (UTC - 6:00)
System Uptime: 0 days 2:30:07.929
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {e000000, 1, 6af6ca34, 8}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+468e5 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 000000000e000000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: 000000006af6ca34, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000008, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030cd100
 000000000e000000 

FAULTING_IP: 
+3030636264323833
00000000`6af6ca34 ??              ???

MM_INTERNAL_CODE:  8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  Reckoning.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002e2e17b to fffff80002e9ac40

STACK_TEXT:  
fffff880`07152978 fffff800`02e2e17b : 00000000`00000050 00000000`0e000000 00000000`00000001 fffff880`07152ae0 : nt!KeBugCheckEx
fffff880`07152980 fffff800`02e98d6e : 00000000`00000001 00000000`0e000000 00000000`0c7bf701 00000000`070add10 : nt! ?? ::FNODOBFM::`string'+0x468e5
fffff880`07152ae0 00000000`6af6ca34 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0adae7d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6af6ca34


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+468e5
fffff800`02e2e17b cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+468e5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+468e5

BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+468e5

Followup: MachineOwner
---------

Possible causes are Memory problems... Drivers...
Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Antivirus Software... Drivers...

Thanks to Dave76 for help understanding possible causes.

The good news is that if you have a paid subscription to Kaspersky, you are welcome to re-install it once we determine the true cause of your crashes. Kaspersky and other antivirus programs: the developers have been working to have the software cause less problems with Windows 7, so now when antivirus software is blamed, it is usually an underlying problem. Unfortunately, the antivirus software sometimes must be removed so that Windows stops blaming it for the crashes. Once we narrow down the true cause, you can put Kaspersky back on your system if you wish.

We will start with the common problems first (see bold possible causes). Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.

If you are overclocking any hardware, please stop.
I have a suspicion that the crashes may be related to an application or service conflict. Troubleshoot Application Conflicts by Performing a Clean Startup
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:

a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier and in step 3, only select Standard settings. Do not select the other two settings in the red boxes.

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

pugmastaflex · 19 Mar 2012

Okay, I've done the memtest86 already, going to run the extended memtest to see if this uncovers anything. Will update you here.

At least we know Kaspersky is out of the question now...But what could it be...

writhziden · 19 Mar 2012

Could be memory, application conflicts, drivers, Windows brokenness, etc. Have to rule things out one step at a time starting with the most likely.

pugmastaflex · 19 Mar 2012

Here it is as a txt file. It said no errors.

pugmastaflex · 19 Mar 2012

Crashed again! Should I be attaching more crashlogs or is that unnecessary...thanks!

writhziden · 19 Mar 2012

See how things go checking for application conflicts.

Also, please fill out your system specs using System Info - See Your System Specs as a guide.

pugmastaflex · 19 Mar 2012

Got it...I will fill out the specs. Just an update though. The driver verifier worked and basically cut off my router. It would connect to the router, but not the internet. It started working again when I turned the verifier off. Those two 'unidentified' ethernet controllers are probably the cause. So it looks like we have narrowed it down a bit....

Just don't know how to fix those drivers...without cutting off the internet.

writhziden · 19 Mar 2012

The controller appears to be an Intel Ethernet Controller. Intel® Driver Update Utility

pugmastaflex · 07 Apr 2012

It seems to have bugged out again! Ah...Including all drivers being there now...(including the ethernet one. Though it blue screens much less often. I'll attach the new logs here. Thanks so much for everything again...

I hope we can get to the bottom of this.

BSOD playing Heroes of Newerth error: Page fault in nonpaged area

Hey