BSOD upon initial boot

Insaneyoshi · 06 Oct 2014

I built my computer last November and have been getting BSODs which include Page_Fault_In_Nonpaged_Area and Memory_Management. These blue screens occur shortly after my initial start up and once they have passed they don't occur again until I shut down the computer completely or hibernate the computer. I have run all sorts of antivirus, run memory tests, and checked the registry all with no success. So i'm at a bit of a loss.

koolkat77 · 08 Oct 2014

Welcome to the forum.

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\Compressed\ED-PC-Mon_10_06_2014__25116_62\100614-15912-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03203000 PsLoadedModuleList = 0xfffff800`03446890
Debug session time: Mon Oct  6 11:10:43.293 2014 (UTC + 6:00)
System Uptime: 0 days 0:00:34.324
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa80160aac00, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
	contains the address of the PFN for the corrupted page table page.
	On a 32 bit OS, parameter 2 contains a pointer to the number of used
	PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa80160aac00
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  audiodg.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800032e9d50 to fffff80003278bc0

STACK_TEXT:  
fffff880`192644e8 fffff800`032e9d50 : 00000000`0000001a 00000000`00041790 fffffa80`160aac00 00000000`0000ffff : nt!KeBugCheckEx
fffff880`192644f0 fffff800`032653df : fffffa80`00000000 00000000`0287ffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`192646b0 fffff800`03277e53 : ffffffff`ffffffff fffff880`19264988 fffff880`19264998 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`192647b0 fffff800`03274410 : fffff800`0354e0aa fffffa80`1e1d6b50 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`19264948 fffff800`0354e0aa : fffffa80`1e1d6b50 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
fffff880`19264950 fffff800`0354e431 : fffff880`00000000 00000000`0287f700 000007ff`fffa0000 00000000`00000000 : nt!PspExitThread+0x5ba
fffff880`19264a50 fffff800`0354e539 : fffffa80`1e1d6b50 00000000`00000000 fffffa80`1e1d6b50 00000000`00000000 : nt!PspTerminateThreadByPointer+0x4d
fffff880`19264aa0 fffff800`03277e53 : 00000000`00000001 fffff880`19264b60 00000000`00000000 000007ff`fffd5000 : nt!NtTerminateThread+0x45
fffff880`19264ae0 00000000`76e717ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0287f788 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e717ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+35084
fffff800`032e9d50 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+35084

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

Followup: MachineOwner
---------

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\Compressed\ED-PC-Mon_10_06_2014__25116_62\100614-15085-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03215000 PsLoadedModuleList = 0xfffff800`03458890
Debug session time: Mon Oct  6 11:09:05.636 2014 (UTC + 6:00)
System Uptime: 0 days 0:01:41.667
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffffbffffff7f, 0, fffff80003391a7c, 5}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiEmptyPageAccessLog+dc )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffbffffff7f, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80003391a7c, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c2100
GetUlongFromAddress: unable to read from fffff800034c21c0
 fffffffbffffff7f 

FAULTING_IP: 
nt!MiEmptyPageAccessLog+dc
fffff800`03391a7c 488b08          mov     rcx,qword ptr [rax]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  sidebar.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880153d4c70 -- (.trap 0xfffff880153d4c70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffffbffffff7f rbx=0000000000000000 rcx=00000000000000c8
rdx=fffff8a0022c2568 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003391a7c rsp=fffff880153d4e00 rbp=fffffa80195f1000
 r8=fffffa8019030003  r9=fffffa80195ed048 r10=fffffa801cfee1c0
r11=fffffa801a660b00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!MiEmptyPageAccessLog+0xdc:
fffff800`03391a7c 488b08          mov     rcx,qword ptr [rax] ds:fffffffb`ffffff7f=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800033075b3 to fffff8000328abc0

STACK_TEXT:  
fffff880`153d4b08 fffff800`033075b3 : 00000000`00000050 fffffffb`ffffff7f 00000000`00000000 fffff880`153d4c70 : nt!KeBugCheckEx
fffff880`153d4b10 fffff800`03288cee : 00000000`00000000 fffffffb`ffffff7f 00000000`00001000 00000000`0151a403 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`153d4c70 fffff800`03391a7c : 00000000`00000000 fffffa80`1cfee200 00000000`00000000 fffff880`048f39c6 : nt!KiPageFault+0x16e
fffff880`153d4e00 fffff800`03391ce0 : fffffa80`1903d060 00000003`00000000 00000000`0151a403 fffffffb`ffffff7f : nt!MiEmptyPageAccessLog+0xdc
fffff880`153d4e70 fffff800`03391ee6 : fffffa80`193fa000 fffff683`ff787e40 fffff683`ff787e40 fffff880`048c9231 : nt!MiAllocateAccessLog+0x80
fffff880`153d4ea0 fffff800`032fbdcd : 00000003`00000000 1e700007`a1399025 fffff700`010893c0 fffff683`ff787e40 : nt!MiLogPageAccess+0x46
fffff880`153d4ef0 fffff800`0325b892 : fffffa80`1903d060 fffffa80`00000006 fffff8a0`00000459 fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x350fd
fffff880`153d57a0 fffff800`0356005a : fffff8a0`0347d9c0 fffff880`153d5ae0 00000000`00000000 fffffa80`192cdb50 : nt!MmCleanProcessAddressSpace+0x96
fffff880`153d57f0 fffff800`03544b7d : 00000000`c0000005 00000000`c0000001 000007ff`fffae000 fffffa80`19275640 : nt!PspExitThread+0x56a
fffff880`153d58f0 fffff800`0327d6fa : 00000000`00000100 fffffa80`192cdc10 00000000`00000001 fffff800`032807fd : nt!PsExitSpecialApc+0x1d
fffff880`153d5920 fffff800`0327da40 : 00000000`00000000 fffff880`153d59a0 fffff800`03544af0 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`153d59a0 fffff800`03289ef7 : fffffa80`192cdb50 00000000`ffffffff 00000000`00000000 fffffa80`1925f140 : nt!KiInitiateUserApc+0x70
fffff880`153d5ae0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiEmptyPageAccessLog+dc
fffff800`03391a7c 488b08          mov     rcx,qword ptr [rax]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiEmptyPageAccessLog+dc

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiEmptyPageAccessLog+dc

BUCKET_ID:  X64_0x50_nt!MiEmptyPageAccessLog+dc

Followup: MachineOwner
---------

Looks like RAM problem to me. Please run memtest - again in the following manner.

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Information

Errors are sometimes found after 8 passes.

Tip

Memtest should be done overnight.