BSOD just before log-in "Page Fault in non page area"

tys · 03 Jul 2012

Hi all,

I'm new here, been browsing this forum for a while now and impressed! So I thought I would join, and hopefully help some people out :) But to start I have my own problem...

It Think it might be problem with the Symantec Endpoint Protection client. But I'm gonna try the RAM first.

I keep getting a BSOD with the error "page fault in non page area" aswell it says "SRTSPL C64.SYS" from a Windows 7 Professional x64 laptop. Just before I'm able to log-in. I am able to boot to Safe mode.

Had a look at the event viewer, with a few things I've found:
Event 1001, Bugchecker - "The computer has rebooted from a bugcheck"
Event 4 SRTSP - "Error loading virus definitions" thought this might be linked in with what was on the BSOD.

I'm unable to upload all the dump files as one is 400Mbs....

So what I've done already:

My first bet is that it's a RAM error, but I ran MEMtest86 for around 30 minutes and it didn't say I had an error..
Also tried a system restore with no success.
Tried most of the advanced options with no success (apart from Safe mode)
Tried SFC /scannow but didn't find anything.
Cleaned out the keyboard with compressed air, just no luck... So now I'm waiting for a RAM stick to hopefully resolve the problem.

Any help?

Thanks
Damian

yowanvista · 03 Jul 2012

The cause here is your Symantec Endpoint protection security suit. You should either remove it or upgrade to the latest build/version.
Run MemTest86+ for at least 7 Passes & post back with your results.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8000382407c, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8800927cd83, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

OVERLAPPED_MODULE: Address regions for 'SYMEVENT64x86' and 'SRTSP64.SYS' overlap

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003302100
 fffff8000382407c 

FAULTING_IP: 
SRTSPL64+27d83
fffff880`0927cd83 420fb60c08      movzx   ecx,byte ptr [rax+r9]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880033cb480 -- (.trap 0xfffff880033cb480)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880092cd390 rbx=0000000000000000 rcx=000000000000007c
rdx=0000000000000050 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800927cd83 rsp=fffff880033cb610 rbp=0000000000000001
 r8=0000000000000440  r9=ffffff7ffa556cec r10=fffff80003587028
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
SRTSPL64+0x27d83:
fffff880`0927cd83 420fb60c08      movzx   ecx,byte ptr [rax+r9] ds:edf0:fffff800`0382407c=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003079f40 to fffff800030d31c0

STACK_TEXT:  
fffff880`033cb318 fffff800`03079f40 : 00000000`00000050 fffff800`0382407c 00000000`00000000 fffff880`033cb480 : nt!KeBugCheckEx
fffff880`033cb320 fffff800`030d12ee : 00000000`00000000 fffff800`0382407c 00000000`00000000 fffff800`03054000 : nt! ?? ::FNODOBFM::`string'+0x43d86
fffff880`033cb480 fffff880`0927cd83 : fffff800`03054000 00000000`00000001 ffffffff`00000040 fffff800`030cea10 : nt!KiPageFault+0x16e
fffff880`033cb610 fffff800`03054000 : 00000000`00000001 ffffffff`00000040 fffff800`030cea10 00000000`00000440 : SRTSPL64+0x27d83
fffff880`033cb618 00000000`00000001 : ffffffff`00000040 fffff800`030cea10 00000000`00000440 00000000`00000086 : nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`033cb620 ffffffff`00000040 : fffff800`030cea10 00000000`00000440 00000000`00000086 ffffffff`80001b00 : 0x1
fffff880`033cb628 fffff800`030cea0f : 00000000`00000440 00000000`00000086 ffffffff`80001b00 fffff8a0`031e6df0 : 0xffffffff`00000040
fffff880`033cb630 00000000`00000440 : 00000000`00000086 ffffffff`80001b00 fffff8a0`031e6df0 fffff8a0`030f2fe0 : nt!KiIdleLoop+0x15f
fffff880`033cb638 00000000`00000086 : ffffffff`80001b00 fffff8a0`031e6df0 fffff8a0`030f2fe0 fffff880`0927ef49 : 0x440
fffff880`033cb640 ffffffff`80001b00 : fffff8a0`031e6df0 fffff8a0`030f2fe0 fffff880`0927ef49 00000000`00000001 : 0x86
fffff880`033cb648 fffff8a0`031e6df0 : fffff8a0`030f2fe0 fffff880`0927ef49 00000000`00000001 00000000`00000001 : 0xffffffff`80001b00
fffff880`033cb650 fffff8a0`030f2fe0 : fffff880`0927ef49 00000000`00000001 00000000`00000001 00000000`00000842 : 0xfffff8a0`031e6df0
fffff880`033cb658 fffff880`0927ef49 : 00000000`00000001 00000000`00000001 00000000`00000842 fffffa80`00000000 : 0xfffff8a0`030f2fe0
fffff880`033cb660 00000000`00000001 : 00000000`00000001 00000000`00000842 fffffa80`00000000 00000006`00000001 : SRTSPL64+0x29f49
fffff880`033cb668 00000000`00000001 : 00000000`00000842 fffffa80`00000000 00000006`00000001 00000000`00000001 : 0x1
fffff880`033cb670 00000000`00000842 : fffffa80`00000000 00000006`00000001 00000000`00000001 fffffa80`000000b8 : 0x1
fffff880`033cb678 fffffa80`00000000 : 00000006`00000001 00000000`00000001 fffffa80`000000b8 00000000`00000000 : 0x842
fffff880`033cb680 00000006`00000001 : 00000000`00000001 fffffa80`000000b8 00000000`00000000 00000000`00000000 : 0xfffffa80`00000000
fffff880`033cb688 00000000`00000001 : fffffa80`000000b8 00000000`00000000 00000000`00000000 fffff800`03054000 : 0x6`00000001
fffff880`033cb690 fffffa80`000000b8 : 00000000`00000000 00000000`00000000 fffff800`03054000 08004000`005e8000 : 0x1
fffff880`033cb698 00000000`00000000 : 00000000`00000000 fffff800`03054000 08004000`005e8000 00150089`00000000 : 0xfffffa80`000000b8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
SRTSPL64+27d83
fffff880`0927cd83 420fb60c08      movzx   ecx,byte ptr [rax+r9]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  SRTSPL64+27d83

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SRTSPL64

IMAGE_NAME:  SRTSPL64.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a80e58a

FAILURE_BUCKET_ID:  X64_0x50_SRTSPL64+27d83

BUCKET_ID:  X64_0x50_SRTSPL64+27d83

Followup: MachineOwner
---------

tys · 03 Jul 2012

Hi yowanvista,

I have changed the RAM of the laptop and still the same problem.

I can only get into Safe-mode. Therefore i can't uninstall the program because of "windows installer" not starting because of being in Safe mode. Tried to use the program "Cleanwipe" but i have to restart my computer for that to work and therefore have to restart in safe mode and it doenst complete properly.

I've just downloaded the program "BlueScreenView" and has showed me the results... see attachment

Does the filename in the pink show that there is a problem with "ntoskrnl.exe"? This is the same for all of the dump files.

Thank you for your help.

yowanvista · 03 Jul 2012

The fact that you can boot into Safe Mode indicates that the likely cause is a faulting driver, here it's most likely SRTSPL64.SYS. You can either delete/rename that driver while in Safe Mode. Doing so will prevent it from loading while Windows is loading normally. Or you could use Revo Uninstaller to remove the product (Using the advanced/deep scan which will remove any leftovers) Revo Uninstaller Pro - Uninstall Software, Remove Programs easily, Forced Uninstall

Navigate to "C:\Windows\System32\Drivers\", locate "SRTSPL64.SYS" and rename it to "SRTSPL64.SYS.OLD"

ntoskrnl.exe is part of the Windows Kernel, it is usually blamed when debuggers can't list other drivers as possible causes.

tys · 03 Jul 2012

Lovely, thank you. The Revo Unistaller worked a treat. I was able to uninstall the program and start up fine. Bit of a wait on the logging-in screen now, but all is well :)
I tried renaming that file via "Safe-Mode with command prompt" but didn't work, so it allowed me to change it.

Thank you once again ! :)

yowanvista · 03 Jul 2012

Glad to see the system is working fine, Post back if any BSOD(s) appear. :)