BSOD 0x000000FC & 0x00000050 ntoskrnl.exe (74ec0 & 76e80)+ Win32k.sys

Artofsteal · 28 Feb 2015

Greetings Seven Forums.
I've been encountering constant BSODs consisting of page fault in nonpaged area and attempted execute of non executable memory! I have run memtest for 24 hours without errors. Additionally, I am running on no overclocks. Chkdsk found no errors in my hard drive, a Western Digital, either. I have run malwarebytes and kaspersky without any reports either! Any assistance is greatly appreciated!
Using WinDBG, I get

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\022015-245514-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18717.amd64fre.win7sp1_gdr.150113-1808
Machine Name:
Kernel base = 0xfffff800`03860000 PsLoadedModuleList = 0xfffff800`03aa4890
Debug session time: Thu Feb 19 20:00:27.509 2015 (UTC - 6:00)
System Uptime: 0 days 0:16:55.306
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck FC, {fffff8a004e3c897, a1200001a65c8943, fffff8800e5d0910, 2}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+44dfc )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8a004e3c897, Virtual address for the attempted execute.
Arg2: a1200001a65c8943, PTE contents.
Arg3: fffff8800e5d0910, (reserved)
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xFC

PROCESS_NAME: chrome.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff8800e5d0910 -- (.trap 0xfffff8800e5d0910)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8009aa1060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8a004e3c897 rsp=fffff8800e5d0aa0 rbp=fffff8800e5d0b60
r8=0000000000000000 r9=0000000000000000 r10=fffff8800e5d0070
r11=fffffa8009aa1060 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
fffff8a0`04e3c897 0000 add byte ptr [rax],al ds:000f:00000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80003953b78 to fffff800038d4ec0

STACK_TEXT:
fffff880`0e5d07a8 fffff800`03953b78 : 00000000`000000fc fffff8a0`04e3c897 a1200001`a65c8943 fffff880`0e5d0910 : nt!KeBugCheckEx
fffff880`0e5d07b0 fffff800`038d2fee : 00000000`00000008 fffff8a0`04e3c897 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x44dfc
fffff880`0e5d0910 fffff8a0`04e3c897 : 00000000`00000000 00000000`0033e930 00000000`00000000 ffffffff`fff5c6d0 : nt!KiPageFault+0x16e
fffff880`0e5d0aa0 00000000`00000000 : 00000000`0033e930 00000000`00000000 ffffffff`fff5c6d0 00000000`0033fd20 : 0xfffff8a0`04e3c897

STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+44dfc
fffff800`03953b78 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+44dfc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 54b5f6ff

FAILURE_BUCKET_ID: X64_0xFC_nt!_??_::FNODOBFM::_string_+44dfc

BUCKET_ID: X64_0xFC_nt!_??_::FNODOBFM::_string_+44dfc

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8a004e3c897, Virtual address for the attempted execute.
Arg2: a1200001a65c8943, PTE contents.
Arg3: fffff8800e5d0910, (reserved)
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xFC

PROCESS_NAME: chrome.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff8800e5d0910 -- (.trap 0xfffff8800e5d0910)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8009aa1060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8a004e3c897 rsp=fffff8800e5d0aa0 rbp=fffff8800e5d0b60
r8=0000000000000000 r9=0000000000000000 r10=fffff8800e5d0070
r11=fffffa8009aa1060 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
fffff8a0`04e3c897 0000 add byte ptr [rax],al ds:000f:00000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80003953b78 to fffff800038d4ec0

STACK_TEXT:
fffff880`0e5d07a8 fffff800`03953b78 : 00000000`000000fc fffff8a0`04e3c897 a1200001`a65c8943 fffff880`0e5d0910 : nt!KeBugCheckEx
fffff880`0e5d07b0 fffff800`038d2fee : 00000000`00000008 fffff8a0`04e3c897 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x44dfc
fffff880`0e5d0910 fffff8a0`04e3c897 : 00000000`00000000 00000000`0033e930 00000000`00000000 ffffffff`fff5c6d0 : nt!KiPageFault+0x16e
fffff880`0e5d0aa0 00000000`00000000 : 00000000`0033e930 00000000`00000000 ffffffff`fff5c6d0 00000000`0033fd20 : 0xfffff8a0`04e3c897

STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+44dfc
fffff800`03953b78 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+44dfc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 54b5f6ff

FAILURE_BUCKET_ID: X64_0xFC_nt!_??_::FNODOBFM::_string_+44dfc

BUCKET_ID: X64_0xFC_nt!_??_::FNODOBFM::_string_+44dfc

Followup: MachineOwner
---------

Artofsteal · 02 Mar 2015

Just got done running memtest on each stick individually; no errors were found.

Artofsteal · 08 Mar 2015

Just got another 0x0FC BSOD that blamed nwifi.sys+ff7767b8. For some reason, BSODS prior to this,(from like 2/19 - 3/8), did not create any minidumps...
Any suggestions?

Golden · 08 Mar 2015

How many passes of MemTest86+ did you run?

Please do the following:

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.
Driver Verifier - Enable and Disable

Driver Verifier will cause your computer to run very sluggishly - this is normal. What it is trying to do is force your system to BSOD and isolate the offending driver/s. When it does, reboot, disable driver verifier, reboot as normal and upload the new dmp file/s here.

I recommend creating a system restore point before turning on driver verifier:
System Restore Point - Create

If your system fails to boot to desktop once driver verifier is enabled, turn it off by booting into Safe Mode:
Safe Mode

Artofsteal · 08 Mar 2015

Golden said:

How many passes of MemTest86+ did you run?

Please do the following:

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.
Driver Verifier - Enable and Disable

Driver Verifier will cause your computer to run very sluggishly - this is normal. What it is trying to do is force your system to BSOD and isolate the offending driver/s. When it does, reboot, disable driver verifier, reboot as normal and upload the new dmp file/s here.

I recommend creating a system restore point before turning on driver verifier:
System Restore Point - Create

If your system fails to boot to desktop once driver verifier is enabled, turn it off by booting into Safe Mode:
Safe Mode

Hello! Thanks for the reply :). I have run probably a total of 20 runs now. I run, I think, 6 per 24 hours.
I will turn on driver verifier right away!

Golden · 08 Mar 2015

We usually recommend a minimum of 8 consecutive passes, but lets see what DV spits out.

Artofsteal · 09 Mar 2015

Golden said:

We usually recommend a minimum of 8 consecutive passes, but lets see what DV spits out.

No Bsod yet. Should I enable or disable "Force Pending I/O Requests", because there is one driver verifier tutorial, which are all from sevenforums, from Jonathan_King which states I should enable, while Capt. Jack Sparrow says I should disable it.
As of now, with all but "Force Pending I/O Requests" and "Low Resource Simulation", there is no BSODS.

Golden · 10 Mar 2015

Try JKing's first. If you don't get a BSOD within 24hrs, then try Capt jack's.

Artofsteal · 10 Mar 2015

Golden said:

Try JKing's first. If you don't get a BSOD within 24hrs, then try Capt jack's.

I am still only getting faults in nonpaged areas. Probably gonna give my ram chips to a friend tomorrow to test run them and see if they cause any blue screens. They are corsair, so they is life time warranty, thankfully. Not sure if this helps, but now my computer is now getting stuck on the phase of "initializing disk for crash dump."

Golden · 11 Mar 2015

That might point to a disk issue. Test it using the DOS version of SeaTools:
SeaTools for DOS and Windows - How to Use

It might also be worth running 8 consecutive passes of MemTest86+ now.