BSOD shortly after boot: ntoskrnl.exe, PAGE_FAULT_IN_NONPAGED_AREA

Harsalan · 15 Jul 2015

I just finished assembling a new computer on Friday (re-using most of the components from my old one, but new case, CPU and graphics card). The problem started on Tuesday evening.

Windows boots as normal, but less than 5 minutes in, it bluescreens, showing the message "PAGE_FAULT_IN_NONPAGED_AREA". I see a reference to mpfilter.sys on the bluescreen, but looking at it now in BlueScreenView, it says ntoskrnl.exe is the culprit.

CPU is an AMD FX6350, graphics card EVGA GTX 960 2GB and motherboard M5A78L-M/USB3 in case any of that is relevant.

I'm currently in safe mode with networking and it's been running fine for about half an hour after boot.

Boozad · 15 Jul 2015

There are three dumps in your logs, all 0x50 and none are showing anything I can see that's pointing to the issue. The best bet here would be to test the RAM to rule it out.

Download and run MemTest86+ to test your RAM. RAM - Test with Memtest86+

Note

Run MemTest86+ for at least 8 passes. Ideally set it off before you go to bed and leave it overnight, we're looking for zero errors here. A single error will show something's going bad with your RAM.

Uninstall Daemon Tools, a proven cause of BSODs.

1. Uninstall Daemon Tools via Add/Remove Programs.
2. Download the SPTD standalone installer and perform the following steps.
3. Double click the executable to open it.
4. Click the button shown below.

Information

If the button it is grayed out as shown in the image, there is no more SPTD installation on your system and you can just close the window.

Free up the Startup. All you need starting with Windows is your AV, 26 programs in Startup is ridiculous. They can all be started on demand as and when needed.

Code:

Dropbox                                                  Dropbox.lnk                                                                                    NAKUL-PC\Sanjay               
Monitor Ink Alerts - HP Deskjet 2540 series              Monitor Ink Alerts - HP Deskjet 2540 series.lnk                                                NAKUL-PC\Sanjay               
VirtuaWin                                                VirtuaWin.lnk                                                                                  NAKUL-PC\Sanjay               
Unified Remote v2                                        C:\Program Files (x86)\Unified Remote\RemoteServer.exe                                         NAKUL-PC\Sanjay               
NVIDIA nTune                                             "C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" clear                           NAKUL-PC\Sanjay               
OfficeSyncProcess                                        "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"                                 NAKUL-PC\Sanjay               
DAEMON Tools Lite                                        "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun                                 NAKUL-PC\Sanjay               
Google Update                                            "C:\Users\Sanjay\AppData\Local\Google\Update\GoogleUpdate.exe" /c                              NAKUL-PC\Sanjay               
OscarEditor                                              "C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe" Minimum                                  NAKUL-PC\Sanjay               
Steam                                                    "C:\Games\Steam\steam.exe" -silent                                                             NAKUL-PC\Sanjay               
f.lux                                                    "C:\Users\Sanjay\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow                             NAKUL-PC\Sanjay               
GoogleChromeAutoLaunch_46F487751C872C83E0C7704C160A2C55  "C:\Users\Sanjay\AppData\Local\Google\Chrome\Application\chrome.exe" --no-startup-window       NAKUL-PC\Sanjay               
AdobeBridge                                                                                                                                             NAKUL-PC\Sanjay               
Skype                                                    "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun                              NAKUL-PC\Sanjay               
ApacheTomcatMonitor7.0_Tomcat7                           "C:\Program Files (x86)\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7w.exe" //MS//Tomcat7  NAKUL-PC\Sanjay               
TWC.Win7                                                 C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exe                        NAKUL-PC\Sanjay               
Dropbox Update                                           "C:\Users\Sanjay\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c                            NAKUL-PC\Sanjay               
GalaxyClient                                             C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe /launchViaAutoStart                       NAKUL-PC\Sanjay               
TP-LINK Wireless Configuration Utility                   C:\PROGRA~2\TP-LINK\TP-LIN~1\TWCU.exe -nogui                                                   Public                        
MSC                                                      "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey                         Public                        
IntelliType Pro                                          "c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe"                               Public                        
IntelliPoint                                             "c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe"                              Public                        
XboxStat                                                 "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun                       Public                        
AdobeAAMUpdater-1.0                                      "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"           Public                        
NvBackend                                                "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"                          Public                        
ShadowPlay                                               C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart     Public

Harsalan · 15 Jul 2015

I've removed Daemon Tools and significantly cut down the number of startup programs.

I'll try rebooting into normal mode and I'll give Memtest a try if it bluescreens again.

Boozad · 15 Jul 2015

Try MemTest86+ as soon as you can, ruling out the RAM will go a long way to solving the BSOD.

Harsalan · 15 Jul 2015

Alright, it's running now and it looks like it'll take a while, so I guess I'll leave it on overnight.

In the meantime: I posted about this on Reddit earlier and they mentioned that sometimes an OS reinstall can solve problems that arise after a CPU replacement. Seeing as this only started occurring four days after the upgrade, do you think that could be the problem?

eross · 16 Jul 2015

I believe it's related to mpfilter.sys (a driver of Microsoft security essentials). I have the same BSOD, only it happens every 7 minutes, on 2 computers on the network. I first uninstalled MSE, and verified that there are no more BSOD. I then reinstalled MSE - and so far no BSOD, but it's too early to tell yet. If it continues I'll have to find a new AV program.

Harsalan · 16 Jul 2015

Memtest came up completely clear.

I'd read about the problem with MSE and I disabled it at startup, and it still bluescreened. I'll try uninstalling when I get home.

Boozad · 16 Jul 2015

Can you upload new logs to capture the latest BSOD. I'll be extremely surprised if MSE is to blame.

eross · 16 Jul 2015

Mpfitler.sys belongs to MSE. After uninstalling MSE the perpetual BSOD stopped. After reinstalling it returned. I now use AVG and no BSODs. The proof is in the puding.

Boozad · 16 Jul 2015

I know full well what mpfilter.sys belongs to, and you've read in another thread that Windows Updates could have been to blame, not MSE itself. Uninstalling a program is not debugging the problem and proves nothing, others who encountered the problem found other avenues to explore and still have MSE running without issue. The proof is in black and white.