Bsod page_fault_in_nonpaged_area

[gkouk]

Hello, Please find below my system info:

OS: Windows 7 Ultimate x64 SP1
CPU: Intel i7 2600
RAM: Corsair 8GB DUAL (2x4GB)
MB: GA Z68A-D3H-B3
HDD: OCZ AGILITY 3 SSD 60GB
VGA: EVGA 512MB 9800 GTX+

I purchased this computer about 2 weeks ago and it was giving me randomly BSOD. I chose to let the technicians of the store that i bought the computer to perform the connection and installation of the hardware and the OS installation. But a week after having bought the computer i couldnt even install windows updates. So i decided to format the computer and make a fresh clean installation of everything myself.

Since the format on Monday i only had 2 BSOD which can be found in the attached rar file. Last night i run memtest and left it throughout the night, today i found that it had done 11 passes, and no errors were found. Please help me find the root of this problem.

 

[JMH]

These crashes were caused by memory corruption/exception (Cx05) probably a driver.
As you have run Memtest it is recommended you run Driver Verifier

* If you are overclocking anything reset to default before running this test.
In other words STOP!!!

* If you have a Raid update its Driver.


Driver Verifier

Using Driver Verifier is an iffy proposition.
Most times it'll crash and it'll tell you what the driver is.
But sometimes it'll crash and won't tell you the driver.
Other times it'll crash before you can log in to Windows.
If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise.
Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

In Windows 7 you can make a Startup Repair disk by going to Start....All Programs...Maintenance...Create a System Repair Disc - with Windows Vista you'll have to use your installation disk or the "Repair your computer" option at the top of the Safe Mode menu .

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like.
From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

If you are using win 8 add these
- Concurrency Stress Test
- DDI compliance checking

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.
If it doesn't crash for you, then let it run for at least 36 hours of continuous operation

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.


If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Thanks to JGriff2 & Usasma.

Using Driver Verifier to identify issues with Windows drivers for advanced users

Driver Verifier

Using Driver Verifier (Windows Drivers)

 

[gkouk]

Ok, i used driver verifier (as in the post, without the low resource simulation). Windows were crashing right before loading my desktop. I booted again in normal mode, just to make sure that it will crash again, and it did. After the second crash, i booted in safe mode, and disabled driver verifier. Attached you will find all the info again, as well as the two dump files that were created with these crashes.

 

[zigzag3143]

2 driver verified crashes Related to gdrv.sys Microsoft Register Server. Its date is a bit odd so the first thing I would suggest is to download Malwarebytes and run it

Please download the free version of Malwarebytes.
Update it immediately.
Do a full system scan
Let us know the results at the end.

Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!


Then if clean run a system file check to verify the OS driver.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7

 

[gkouk]

Ok, here are the actions i performed and the results:

1) Downloaded and updated Malwarebytes, did a scan, but no problems were found
2) I run scf and it found some errors it could not fix
3) I run scf again, and it found some errors it could not fix
4) I run scf again, and got a blue screen for memory management
5) Rebooted in normal mode, i run scf again, and it found some errors it could not fix

Attached is the rar with the new crash, the log from malwarebytes and the logs from scf (CBS and scf details).

Btw, from what i read in other forums gdrv.sys has something to do with a utility from Gigabyte. Maybe i should try uninstalling this utility, and then repair windows through the installation DVD?

I won't take any actions yet, i will wait for your feedback.

 

[zigzag3143]

Ok, here are the actions i performed and the results:

1) Downloaded and updated Malwarebytes, did a scan, but no problems were found
2) I run scf and it found some errors it could not fix
3) I run scf again, and it found some errors it could not fix
4) I run scf again, and got a blue screen for memory management
5) Rebooted in normal mode, i run scf again, and it found some errors it could not fix

Attached is the rar with the new crash, the log from malwarebytes and the logs from scf (CBS and scf details).

Btw, from what i read in other forums gdrv.sys has something to do with a utility from Gigabyte. Maybe i should try uninstalling this utility, and then repair windows through the installation DVD?

I won't take any actions yet, i will wait for your feedback.

If SFC found errors it could not fix it is time for a repair install.

GDRV.SYS isnt the gigabyte utility

 

[gkouk]

Hello again,

So, I just finished repairing Windows, using my installation DVD. And after that i ran the sfc command, first with the /verifyonly and then with /scannow. In both cases the only error found (which cannot be repaired) is for the wmp.dll which as i see has something to do with the windows media player. I tried updating it but it seems that i am already running the latest edition and no updates are found. Next move? Shall i try the driver verifier again? (attached are the logs from sfc).

 

[gkouk]

No need for driver verifier... It did a BSOD again, without apparent reason... And this time no dump file was created...

 

[event3horizon]

kalispera!

download and run the gigabyte charger on/off utility and turn the charging utility OFF! http://download.gigabyte.us/FileList/Utility/mb_utility_onoffchargesetup-intel-7series.exe

 

[zigzag3143]

Hello again,

So, I just finished repairing Windows, using my installation DVD. And after that i ran the sfc command, first with the /verifyonly and then with /scannow. In both cases the only error found (which cannot be repaired) is for the wmp.dll which as i see has something to do with the windows media player. I tried updating it but it seems that i am already running the latest edition and no updates are found. Next move? Shall i try the driver verifier again? (attached are the logs from sfc).

If repair install cannot fix the problem it is time for a clean install. You should not install anything that doesnt come off the Win 7 dvd (except perhaps malware) until you see if you are still crashing.

 

[gkouk]

thank you for your help, but i'm starting to believe it's a hardware problem and not software... If you check my initial post, i have already formatted once the computer and performed a very thorough and clean setup (installing only windows updates and driver updates at first), and i had 2 BSOD... I will take it back to the store and ask them to check all hardware components... Thank you for your time

 

[JMH]

Thank you for keeping us updated.
Good luck.

 

[event3horizon]

umm.. is anyone listening to me? This is your problem!!

applecharger.sys is bluescreening your PC

download and run the gigabyte charger on/off utility and turn the charging utility OFF! http://download.gigabyte.us/FileList...el-7series.exe

 

[zigzag3143]

umm.. is anyone listening to me? This is your problem!!

applecharger.sys is bluescreening your PC

download and run the gigabyte charger on/off utility and turn the charging utility OFF! http://download.gigabyte.us/FileList...el-7series.exe

And your proof is? What tool did you use to find this? You cant just throw out "this is your problem" unless you can back it up.

Perhaps that is why now one is listening.

 

[event3horizon]

umm.. is anyone listening to me? This is your problem!!

applecharger.sys is bluescreening your PC

download and run the gigabyte charger on/off utility and turn the charging utility OFF! http://download.gigabyte.us/FileList...el-7series.exe

And your proof is? What tool did you use to find this? You cant just throw out "this is your problem" unless you can back it up.

Perhaps that is why now one is listening.

Proof is dump file.

Could not read faulting driver name
Probably caused by : AppleCharger.sys ( AppleCharger+1a93 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffd0, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002ceae4c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f13100
ffffffffffffffd0

FAULTING_IP:
nt!ObfDereferenceObject+2c
fffff800`02ceae4c f0480fc11f lock xadd qword ptr [rdi],rbx

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 0

TRAP_FRAME: fffff880033857a0 -- (.trap 0xfffff880033857a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000c0000034 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ceae4c rsp=fffff88003385930 rbp=0000000000000020
r8=fffffa8009103680 r9=fffffa8006a01248 r10=fffffa8006a355b0
r11=fffff88003385980 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!ObfDereferenceObject+0x2c:
fffff800`02ceae4c f0480fc11f lock xadd qword ptr [rdi],rbx ds:0010:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002c8e25c to fffff80002ce1c80

STACK_TEXT:
fffff880`03385638 fffff800`02c8e25c : 00000000`00000050 ffffffff`ffffffd0 00000000`00000001 fffff880`033857a0 : nt!KeBugCheckEx
fffff880`03385640 fffff800`02cdfdae : 00000000`00000001 ffffffff`ffffffd0 fffff6fb`7ea00200 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x456cf
fffff880`033857a0 fffff800`02ceae4c : fffff8a0`07c0ee50 fffff880`03385b40 fffff880`03385a98 fffff800`00000030 : nt!KiPageFault+0x16e
fffff880`03385930 fffff880`041a7a93 : 00000000`00000020 fffff880`03385a98 00000000`001f01ff fffff880`041a91c0 : nt!ObfDereferenceObject+0x2c
fffff880`03385990 00000000`00000020 : fffff880`03385a98 00000000`001f01ff fffff880`041a91c0 fffff800`031ab7c0 : AppleCharger+0x1a93
fffff880`03385998 fffff880`03385a98 : 00000000`001f01ff fffff880`041a91c0 fffff800`031ab7c0 fffff8a0`0054c9d0 : 0x20
fffff880`033859a0 00000000`001f01ff : fffff880`041a91c0 fffff800`031ab7c0 fffff8a0`0054c9d0 00000000`00000000 : 0xfffff880`03385a98
fffff880`033859a8 fffff880`041a91c0 : fffff800`031ab7c0 fffff8a0`0054c9d0 00000000`00000000 00000000`00000000 : 0x1f01ff
fffff880`033859b0 fffff800`031ab7c0 : fffff8a0`0054c9d0 00000000`00000000 00000000`00000000 fffff880`03385a90 : AppleCharger+0x31c0
fffff880`033859b8 fffff8a0`0054c9d0 : 00000000`00000000 00000000`00000000 fffff880`03385a90 fffff800`02f4b89c : nt!PnpDeviceClassNotifyList+0xa0
fffff880`033859c0 00000000`00000000 : 00000000`00000000 fffff880`03385a90 fffff800`02f4b89c 00000000`00000202 : 0xfffff8a0`0054c9d0


STACK_COMMAND: kb

FOLLOWUP_IP:
AppleCharger+1a93
fffff880`041a7a93 ?? ???

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: AppleCharger+1a93

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: AppleCharger

IMAGE_NAME: AppleCharger.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4d2ad809

FAILURE_BUCKET_ID: X64_0x50_AppleCharger+1a93

BUCKET_ID: X64_0x50_AppleCharger+1a93

Followup: MachineOwner

 

[gkouk]

thank you for trying to help, but just to be safe, i will return it to them and ask for a full hardware and software check...

 

[JMH]

thank you for trying to help, but just to be safe, i will return it to them and ask for a full hardware and software check...

You are welcome.
Good luck.
Would be interesting to know the result.

 

[zigzag3143]

event3horizon

Of the 4 DMPS three were driver verified and pointed elsewhere, one mentions Applecharger and says "could not read faulting driver name".

Which would you believe?

Since Applecharger is only mentioned in one as "probably caused by" and since the others (which were verified and in the stack at the right point) I would tend to believe the latter.

One offs (especially non verified ones) happen all the time and are usually discounted.

Thanks for posting the info but please add the top of the DMPS in the future so we know what DMP you have read without having to WDB all of them.

If I could rep, I would rep you on this.

 

[event3horizon]

Ok I appreciate it thanks. I will back up my analysis next time. I didn't know the "probably caused" wasn't counted but I'd rather have some clue than no clue if I had those bsod's.

 

[zigzag3143]

Good Job anyway. Its always good to have another set of eyes and welcome to BSOD.