BSOD - error PAGE_FAULT_IN_NONPAGED_AREA - vuhub.sys - 473db7c1

mariec23 · 30 Jun 2014

My system has BSOD'ed at least six or seven times each day. I have uninstalled almost everything that I'd installed in the last month or so, and yet it keeps happening. (I have to keep the update of Adobe Air, because it's required for HipChat, my company's chosen IM system.)

I am my wits-end trying to solve this, and meanwhile my day (and whatever I was working on at the time) is disrupted multiple times a day! I've attached the whole file created by the DM Log Collector, as indicated in this forum. I've also attached a copy of one of the many photos I've managed to snag of this BS.

p.s. It seems fitting to refer to it as BS....

koolkat77 · 01 Jul 2014

Welcome to the forum.

Reduce items at start-up. Nothing except anti-virus is required plus improves the time for logging in windows.

Startup Programs - Change

Code:

EPLTarget\P0000000000000000	c:\windows\system32\spool\drivers\x64\3\e_yatijhe.exe /ept "epltarget\p0000000000000000" /m "wf-3540 series"	NT AUTHORITY\SYSTEM	HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sidebar	%programfiles%\windows sidebar\sidebar.exe /autorun	NT AUTHORITY\LOCAL SERVICE	HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sidebar	%programfiles%\windows sidebar\sidebar.exe /autorun	NT AUTHORITY\NETWORK SERVICE	HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Dropbox	dropbox.lnk	MARIEC-LT6\MARIE	Startup
Pandora	pandora.lnk	MARIEC-LT6\MARIE	Startup
ApplePhotoStreams	c:\program files (x86)\common files\apple\internet services\applephotostreams.exe	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
com.apple.dav.bookmarks.daemon	c:\program files (x86)\common files\apple\internet services\bookmarkdav_client.exe	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LinkPointAssist	"c:\users\marie\appdata\roaming\linkpoint360\bin\linkpointassist.exe" /minimize	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DeskSave	c:\users\marie\desktop\desksave\desksave.exe	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PTIM.exe	c:\program files (x86)\webex\productivity tools\ptim.exe	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ISUSPM	c:\programdata\flexnet\connect\11\isuspm.exe -scheduler	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Dashlane	"c:\users\marie\appdata\roaming\dashlane\dashlane.exe" autolaunchatstartup	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
GarminExpressTrayApp	"c:\program files (x86)\garmin\express tray\expresstray.exe"	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Google+ Auto Backup	"c:\users\marie\appdata\local\programs\google\google+ auto backup\google+ auto backup.exe" /autostart	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
iCloudServices	c:\program files (x86)\common files\apple\internet services\icloudservices.exe	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Google Update	"c:\users\marie\appdata\local\google\update\googleupdate.exe" /c	MARIEC-LT6\MARIE	HKU\S-1-5-21-3721018327-1454780770-2276786147-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
EPLTarget\P0000000000000000	c:\windows\system32\spool\drivers\x64\3\e_yatijhe.exe /ept "epltarget\p0000000000000000" /m "wf-3540 series"	.DEFAULT	HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Bluetooth	c:\progra~1\widcomm\blueto~1\bttray.exe	Public	Common Startup
McAfee Security Scan Plus	c:\progra~1\mcafee~1\385c9a~1.150\sssche~1.exe	Public	Common Startup
Salesforce for Outlook		Public	Common Startup
Apoint	c:\program files\delltpad\apoint.exe	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TdmNotify	c:\program files\dell\dell data protection\access\advanced\wave\trusted drive manager\tdmnotify.exe	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DFEPApplication	c:\program files\dell\feature enhancement pack\dfepapplication.exe	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LogMeIn GUI	"c:\program files (x86)\logmein\x64\logmeinsystray.exe"	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Syncplicity	c:\program files\syncplicity\syncplicity.exe	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IgfxTray	c:\windows\system32\igfxtray.exe	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HotKeysCmds	c:\windows\system32\hkcmd.exe	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Persistence	c:\windows\system32\igfxpers.exe	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SysTrayApp	c:\program files\idt\wdm\sttray64.exe	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Perform a clean boot:

Troubleshoot Application Conflicts by Performing a Clean Startup

Please update the drivers below:

vuhub.sys Fri Nov 16 21:31:13 2007 (473DB7C1)
Eltima Software USB to Ethernet Connector Driver
Driver Reference Table - vuhub.sys

PBADRV.sys Tue Jan 8 01:12:13 2008 (4782798D)
PBA Support Driver from Dell
Driver Reference Table - PBADRV.sys

LMIRfsDriver.sys Mon Jul 14 22:26:56 2008 (487B7E50)
RemotelyAnywhere Mirror Miniport Driver or LogMeIn Mirror Miniport Driver
Driver Reference Table - LMIRfsDriver.sys

dne64x.sys Tue Nov 11 07:01:24 2008 (4918D964)
Citrix Deterministic Network Enhancer Miniport or Cisco Systems VPN Client
Driver Reference Table - dne64x.sys

Upgrading drivers for pre-existing device

Open Driver Install - Device Manager
In the Device Manager locate the device you wish to update the drivers for/look for a
Right-click the device and click Properties.
In the Properties window click the Driver tab.
Click the Update Driver button.
In the Hardware Update Wizard point Windows to the location of the updated drivers on your hard drive

Once drivers have been installed reboot.

Sometimes drivers remain, not completely uninstalled. Follow this tutorial for complete removal of drivers of the particular program: How to Clean Left Over Driver Files with Driver Sweeper

Drivers - Clean Left over Files after Uninstalling

Use Revo Uninstaller to uninstall stubborn software. Opt for Advance Mode while uninstalling which allows you to remove leftover registry:-

Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Uninstall AVG, it contributes to BSOD's.

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-

Microsoft Security Essentials - Free Antivirus for Windows
- Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
  - Good and Free system security combination.
  - How to Scan Your Computer With Multiple Antivirus Programs - How-To Geek

Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Make scans with the following:

Kaspersky TDSSKiller:

Anti-rootkit utility TDSSKiller

ESET online scanner:

Free Online Virus Scanner | ESET

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Yusra\Downloads\Compressed\debug-MARIEC-LT6-Mon_06_30_2014_162702_43\062314-7971-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03059000 PsLoadedModuleList = 0xfffff800`0329c890
Debug session time: Tue Jun 24 00:21:08.810 2014 (UTC + 6:00)
System Uptime: 0 days 2:49:52.622
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa8012695000, 0, fffff880052e7f0a, 0}

*** WARNING: Unable to verify timestamp for vuhub.sys
*** ERROR: Module load completed but symbols could not be loaded for vuhub.sys

Could not read faulting driver name
Probably caused by : vuhub.sys ( vuhub+7f0a )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8012695000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880052e7f0a, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003306100
GetUlongFromAddress: unable to read from fffff800033061c0
 fffffa8012695000 Nonpaged pool

FAULTING_IP: 
vuhub+7f0a
fffff880`052e7f0a 4c8b540af8      mov     r10,qword ptr [rdx+rcx-8]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  UsbService64.e

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800f09d620 -- (.trap 0xfffff8800f09d620)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=4242424203010008 rbx=0000000000000000 rcx=fffffa8012369560
rdx=000000000032baa8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880052e7f0a rsp=fffff8800f09d7b8 rbp=0000000000000000
 r8=00000000000000ff  r9=0000000000000007 r10=0000006c0061006e
r11=fffffa8012369540 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
vuhub+0x7f0a:
fffff880`052e7f0a 4c8b540af8      mov     r10,qword ptr [rdx+rcx-8] ds:fffffa80`12695000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000314cbf0 to fffff800030cebc0

STACK_TEXT:  
fffff880`0f09d4b8 fffff800`0314cbf0 : 00000000`00000050 fffffa80`12695000 00000000`00000000 fffff880`0f09d620 : nt!KeBugCheckEx
fffff880`0f09d4c0 fffff800`030cccee : 00000000`00000000 fffffa80`12695000 fffff800`0325c900 fffffa80`0f5a2938 : nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`0f09d620 fffff880`052e7f0a : fffff880`052e6f74 00000000`00000000 fffffa80`1120bc40 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0f09d7b8 fffff880`052e6f74 : 00000000`00000000 fffffa80`1120bc40 00000000`00000000 00000000`00000000 : vuhub+0x7f0a
fffff880`0f09d7c0 00000000`00000000 : fffffa80`1120bc40 00000000`00000000 00000000`00000000 fffffa80`12560e10 : vuhub+0x6f74


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vuhub+7f0a
fffff880`052e7f0a 4c8b540af8      mov     r10,qword ptr [rdx+rcx-8]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  vuhub+7f0a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vuhub

IMAGE_NAME:  vuhub.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  473db7c1

FAILURE_BUCKET_ID:  X64_0x50_vuhub+7f0a

BUCKET_ID:  X64_0x50_vuhub+7f0a

Followup: MachineOwner
---------

2: kd> lmvm vuhub
start             end                 module name
fffff880`052e0000 fffff880`052ef000   vuhub    T (no symbols)           
    Loaded symbol image file: vuhub.sys
    Image path: \SystemRoot\system32\DRIVERS\vuhub.sys
    Image name: vuhub.sys
    Timestamp:        Fri Nov 16 21:31:13 2007 (473DB7C1)
    CheckSum:         0000C82F
    ImageSize:        0000F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Keep us posted.