Constant BSODs, usually Page_Fault_in_Non_paged_Area

Page 1 of 2 12 LastLast

  1. Posts : 6
    Win 7 32bit
       #1

    Constant BSODs, usually Page_Fault_in_Non_paged_Area


    I've updated motherboard and GPU drivers, don't get any video errors, and have run the Microsoft AND Memtest86 memory testers. Will run memtest86 again while I'm at work (9AM-4PM EST). Also ran Malwarebytes, combofix, and a few others.

    Dump files are attached. Hope you can help.
      My Computer


  2. Posts : 1,314
    Windows 7 64-bit
       #2

    Two crashes related to font retrieval and loading. Either some maligned font managed to get into your system, some malware is using fonts as a security vulnerability (they do that a lot) and is messing up with it, or something else is interfering with font rendering, which most likely is your GPU or your graphics drivers. I'm leaning on the bad drivers part. When you updated them, did you do a clean install update? I recommend you do that - uninstall current drivers then install latest.
      My Computer


  3. Posts : 6
    Win 7 32bit
    Thread Starter
       #3

    Vir Gnarus said:
    ..............I'm leaning on the bad drivers part. When you updated them, did you do a clean install update? I recommend you do that - uninstall current drivers then install latest.
    I updated the drivers in response to the recent BSODs. I've uninstalled and then reinstalled clean the latest WHQL drivers and will test.

    Update: I think you hit the nail on the head with fonts. if I navigate to C:\Windows\Fonts in Windows Explorer, its an instant BSOD, even in safe mode. How can I find the font(s) at fault and get rid of them?
    Last edited by SikSlayer; 15 Aug 2013 at 18:56.
      My Computer


  4. Posts : 1,314
    Windows 7 64-bit
       #4

    Whoa, now that is unusual behavior! Try doing a CHKDSK /R followed by SFC /SCANNOW to see if there's any filesystem corruption that took place.

    After that, the only way I can see to peruse the fonts for a potential bad one is to use another OS, like a liveCD environment like Parted Magic to navigate to the font folder and look at its contents.

    Oh, and there's also the chance your system is infected. Make sure to check with something like Kaspersky's Virus Removal Tool as well as TDSSKiller for any potential rootkits. It's best not to let either software clean up the infection itself if it discovers any, but to provide us the results.

    Again, this could be the GPU/graphics drivers messing up. When opening the fonts folder by default the thumbnails for the fonts will render the font for each one listed to display examples. It may be that through doing that the GPU is bugging out.
      My Computer


  5. Posts : 6
    Win 7 32bit
    Thread Starter
       #5

    Vir Gnarus said:
    Whoa, now that is unusual behavior! Try doing a CHKDSK /R followed by SFC /SCANNOW to see if there's any filesystem corruption that took place.

    ......Oh, and there's also the chance your system is infected. Make sure to check with something like Kaspersky's Virus Removal Tool as well as TDSSKiller for any potential rootkits. It's best not to let either software clean up the infection itself if it discovers any, but to provide us the results.
    Unusual indeed. I've run Malwarebytes, and CHKDSK /r numerous times, even before finding these forums. I used HiRen's BootCD to get to the Windows\Fonts folder and delete some recent fonts with capital names, and I was able to then navigate to restore the default windows fonts in Safe Mode. I haven't seen a BSOD since!

    I'm downloading Kaspersky's Virus Removal Tool currently, and will try it, and then TDSSKiller.
    Last edited by SikSlayer; 18 Aug 2013 at 06:06.
      My Computer


  6. Posts : 1,314
    Windows 7 64-bit
       #6

    Alright, good to hear! Also, for future reference, we normally don't recommend Hiren's BootCD because, as nice as it is, it does include licensed software that are not allowed for such distribution, some of which is also not even free and has been hacked to include them in the BootCD. If you want a legit, guilt-free alternative, the UBCD is your best bet.

    Btw, do you recall the names of any of these fonts?
      My Computer


  7. Posts : 6
    Win 7 32bit
    Thread Starter
       #7

    Vir Gnarus said:
    Btw, do you recall the names of any of these fonts?
    I don't. However, they were all capital letters, often with a non-english word, like "PLD____.TTF". I noticed what I assumed to be the 'default' Windows fonts were all of a similar date, so I had sorted out the files by date, and the 'out of place' files were all about 2 weeks old or less. So I just erased the whole group of them.

    When I rebooted into Safe Mode, I was able to navigate to the folder without issue, and I knew I was on the right track. Haven't had a BSOD since.
      My Computer


  8. Posts : 1,314
    Windows 7 64-bit
       #8

    Hmm, do you remember installing any Windows updates or any software in the last 2 weeks? Having fonts installed on your system isn't something that's done frequently, so I'm worried they may be malware related.
      My Computer


  9. Posts : 6
    Win 7 32bit
    Thread Starter
       #9

    Vir Gnarus said:
    Hmm, do you remember installing any Windows updates or any software in the last 2 weeks? Having fonts installed on your system isn't something that's done frequently, so I'm worried they may be malware related.
    Only the typical Windows Updates, of which were just released before I started having issues.

    I did encounter an infected site prior, which I DO suspect was the cause, but I can't confirm. Nor do I wish to out the site, as it's owned and operated by a friend, and was merely the victim of a script kiddie. I will confer with this friend and see if I can get more info.
      My Computer


  10. Posts : 1,314
    Windows 7 64-bit
       #10

    If he can figure what malware was being released from the site, it will give you a better start on researching it to see if its payload matches up with the font files you've found. If it uses font files, then there's little doubt that your system was/is also infected. Have you ran TDSSKiller and that Kaspersky virus removal tool yet?
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 15:16.
Find Us