BSOD shortly after boot: ntoskrnl.exe, PAGE_FAULT_IN_NONPAGED_AREA

[Harsalan]

I just finished assembling a new computer on Friday (re-using most of the components from my old one, but new case, CPU and graphics card). The problem started on Tuesday evening.

Windows boots as normal, but less than 5 minutes in, it bluescreens, showing the message "PAGE_FAULT_IN_NONPAGED_AREA". I see a reference to mpfilter.sys on the bluescreen, but looking at it now in BlueScreenView, it says ntoskrnl.exe is the culprit.

CPU is an AMD FX6350, graphics card EVGA GTX 960 2GB and motherboard M5A78L-M/USB3 in case any of that is relevant.

I'm currently in safe mode with networking and it's been running fine for about half an hour after boot.

 

[Boozad]

There are three dumps in your logs, all 0x50 and none are showing anything I can see that's pointing to the issue. The best bet here would be to test the RAM to rule it out.

:arownload and run MemTest86+ to test your RAM. http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

   Note

Run MemTest86+ for at least 8 passes. Ideally set it off before you go to bed and leave it overnight, we're looking for zero errors here. A single error will show something's going bad with your RAM.

:ar: Uninstall Daemon Tools, a proven cause of BSODs.

1. Uninstall Daemon Tools via Add/Remove Programs.
2. Download the SPTD standalone installer and perform the following steps.
3. Double click the executable to open it.
4. Click the button shown below.

   Information

If the button it is grayed out as shown in the image, there is no more SPTD installation on your system and you can just close the window.

:ar: Free up the Startup. All you need starting with Windows is your AV, 26 programs in Startup is ridiculous. They can all be started on demand as and when needed.

Dropbox                                                  Dropbox.lnk                                                                                    NAKUL-PC\Sanjay               
Monitor Ink Alerts - HP Deskjet 2540 series              Monitor Ink Alerts - HP Deskjet 2540 series.lnk                                                NAKUL-PC\Sanjay               
VirtuaWin                                                VirtuaWin.lnk                                                                                  NAKUL-PC\Sanjay               
Unified Remote v2                                        C:\Program Files (x86)\Unified Remote\RemoteServer.exe                                         NAKUL-PC\Sanjay               
NVIDIA nTune                                             "C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" clear                           NAKUL-PC\Sanjay               
OfficeSyncProcess                                        "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"                                 NAKUL-PC\Sanjay               
DAEMON Tools Lite                                        "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun                                 NAKUL-PC\Sanjay               
Google Update                                            "C:\Users\Sanjay\AppData\Local\Google\Update\GoogleUpdate.exe" /c                              NAKUL-PC\Sanjay               
OscarEditor                                              "C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe" Minimum                                  NAKUL-PC\Sanjay               
Steam                                                    "C:\Games\Steam\steam.exe" -silent                                                             NAKUL-PC\Sanjay               
f.lux                                                    "C:\Users\Sanjay\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow                             NAKUL-PC\Sanjay               
GoogleChromeAutoLaunch_46F487751C872C83E0C7704C160A2C55  "C:\Users\Sanjay\AppData\Local\Google\Chrome\Application\chrome.exe" --no-startup-window       NAKUL-PC\Sanjay               
AdobeBridge                                                                                                                                             NAKUL-PC\Sanjay               
Skype                                                    "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun                              NAKUL-PC\Sanjay               
ApacheTomcatMonitor7.0_Tomcat7                           "C:\Program Files (x86)\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7w.exe" //MS//Tomcat7  NAKUL-PC\Sanjay               
TWC.Win7                                                 C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exe                        NAKUL-PC\Sanjay               
Dropbox Update                                           "C:\Users\Sanjay\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c                            NAKUL-PC\Sanjay               
GalaxyClient                                             C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe /launchViaAutoStart                       NAKUL-PC\Sanjay               
TP-LINK Wireless Configuration Utility                   C:\PROGRA~2\TP-LINK\TP-LIN~1\TWCU.exe -nogui                                                   Public                        
MSC                                                      "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey                         Public                        
IntelliType Pro                                          "c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe"                               Public                        
IntelliPoint                                             "c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe"                              Public                        
XboxStat                                                 "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun                       Public                        
AdobeAAMUpdater-1.0                                      "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"           Public                        
NvBackend                                                "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"                          Public                        
ShadowPlay                                               C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart     Public

 

[Harsalan]

I've removed Daemon Tools and significantly cut down the number of startup programs.

I'll try rebooting into normal mode and I'll give Memtest a try if it bluescreens again.

 

[Boozad]

Try MemTest86+ as soon as you can, ruling out the RAM will go a long way to solving the BSOD.

 

[Harsalan]

Alright, it's running now and it looks like it'll take a while, so I guess I'll leave it on overnight.

In the meantime: I posted about this on Reddit earlier and they mentioned that sometimes an OS reinstall can solve problems that arise after a CPU replacement. Seeing as this only started occurring four days after the upgrade, do you think that could be the problem?

 

[eross]

I believe it's related to mpfilter.sys (a driver of Microsoft security essentials). I have the same BSOD, only it happens every 7 minutes, on 2 computers on the network. I first uninstalled MSE, and verified that there are no more BSOD. I then reinstalled MSE - and so far no BSOD, but it's too early to tell yet. If it continues I'll have to find a new AV program.

 

[Harsalan]

Memtest came up completely clear.

I'd read about the problem with MSE and I disabled it at startup, and it still bluescreened. I'll try uninstalling when I get home.

 

[Boozad]

Can you upload new logs to capture the latest BSOD. I'll be extremely surprised if MSE is to blame.

 

[eross]

Mpfitler.sys belongs to MSE. After uninstalling MSE the perpetual BSOD stopped. After reinstalling it returned. I now use AVG and no BSODs. The proof is in the puding.

 

[Boozad]

I know full well what mpfilter.sys belongs to, and you've read in another thread that Windows Updates could have been to blame, not MSE itself. Uninstalling a program is not debugging the problem and proves nothing, others who encountered the problem found other avenues to explore and still have MSE running without issue. The proof is in black and white.

 

[Harsalan]

Uninstalled and no blue screens since. It seems to be a pretty common problem recently.

I attach all logs to date.

 

[Boozad]

It's to do with a recent Windows Update, I'm trying to read up and find out which are the guilty ones.

 

[Harsalan]

I updated to Windows 10 recently and the problem seems to have come back - of course, with Windows Defender (wdfilter.sys) rather than MSE. It goes away if I disable WD, but that's only temporary; it re-enables after a few days.

 

[jumanji]

^ I recently encountered the BSOD "PAGE FAULT IN NON PAGED AREA (WdFILTER.sys)" on a Windows 8.1 machine after Windows updates failed. Two minutes into Windows 8.1, it will throw up this BSOD and restart and keep repeating. Exasperating.

Finally I turned Windows Defender off and the BSOD vanished. So turn off Windows Defender and install some other AV. Turn off Windows Defender as Administrator and check whether Defender turns on again automatically. If it does then uninstall. ( Note:Since Defender is not a stand-alone but integrated into Windows 8 and upwards, once you uninstall, you will not be able to install it again.)

How To Disable, Uninstall or Remove Windows Defender:

https://www.raymond.cc/blog/how-to-disable-uninstall-or-remove-windows-defender-in-vista/

https://www.raymond.cc/blog/download/did/1984/

 

[Layback Bear]

jumanji after you uninstalled Defender can you install MSE?

 

[jumanji]

I am not sure whether one can install MSE after uninstalling Windows Defender in Windows 8 and upwards. Most probably it will not be taken.( I don't want to experiment it on my housemaid's son's HP Laptop , though I am 50% owner )

Even if it takes, if you see the OP's first post, the page fault in non-paged area mpfilter.sys relates to MSE on Windows 7 as the other user reported. So I believe the BSODs will still happen with MSE on Windows 8.

On this HP laptop, I had only turned it off as Administrator and after that - it is almost 24 hours now - the BSOD did not return.

 

[Harsalan]

I'd really rather not uninstall it. I tried Avast and it broke the entire start menu. Other AVs suck.

 

[jumanji]

You said you disabled Windows Defender but it reenables after a few days. I have told that you should disable it as administrator as explained in Raymond's blog and then watch whether it reenables.

View attachment 369343

 

[jumanji]

Update:

After I disabled Windows Defender, I could comfortably log into Windows 8.1

Installed MalwareBytes Antimalware and run it. It removed tons of PUPs and a few PUMs.

SFC Scannow was showing that it couldn't repair some corruption.

DISM said the restore operation failed. Either the repair Source was not found or the Component Store could not be repaired.

Then I went ahead updating Windows 8.1 ( My maid's son, the user, hadn't updated it for quite a while. The problem BSOD started when he was sitting upstairs and trying to update it on 15th Aug scrounging on my internet. All updates failed and then the continuous restart BSOD) Most of the 40+ updates went through with only three failing to install now.

At this point I renabled Windows Defender and now no more Page Fault BSOD.

Updated Windows Defender and ran a Scan. It found Trojan Win32/Colisi F and eliminated it..(Looking at Windows Defender History I found that from 06Aug to 14 Aug, the PC was afflicted by a number of Severe Trojans which Defender had quarantined. The only one left the Colisi F had sneeked in on 14 Aug. Perhaps an update was required for WD to eliminate it. And I don't know why MBAM failed to get it.)

Ran sfc Scannow. No integrity problems now.

Ran DISM Restorehealth again. It still said Repair source not found, or Component Store cannot be repaired but CSI Manifest Corruption had come down to 2 and CSI Payload corruption to 1. A very good reduction from the previous result.

Downloading Windows 8.1 Installation media now to show DISM the source so that it can remove any existing corruption.

The System is more or less back to normal. I was about to send it back to his hostel today - he needs it for his day to day projects in his college, but decided to do the final DISM as above before returning it..

Relieved that I need not to a REFRESH or Image Restore

As Boozad said in his post#10, the page Fault is not caused by MSE or Windows Defender per se. But stopping them enables to overcome the BSODs and allows working on the OS. It then appears that removing all malware and updating Windows resolves the BSOD problem and then one can turn on MSE/ Windows Defender. Atleast that is what happened in this case.