Solved Constant BSODs, usually Page_Fault_in_Non_paged_Area

[SikSlayer]

I've updated motherboard and GPU drivers, don't get any video errors, and have run the Microsoft AND Memtest86 memory testers. Will run memtest86 again while I'm at work (9AM-4PM EST). Also ran Malwarebytes, combofix, and a few others.

Dump files are attached. Hope you can help.

 

[Vir Gnarus]

Two crashes related to font retrieval and loading. Either some maligned font managed to get into your system, some malware is using fonts as a security vulnerability (they do that a lot) and is messing up with it, or something else is interfering with font rendering, which most likely is your GPU or your graphics drivers. I'm leaning on the bad drivers part. When you updated them, did you do a clean install update? I recommend you do that - uninstall current drivers then install latest.

 

[SikSlayer]

..............I'm leaning on the bad drivers part. When you updated them, did you do a clean install update? I recommend you do that - uninstall current drivers then install latest.

I updated the drivers in response to the recent BSODs. I've uninstalled and then reinstalled clean the latest WHQL drivers and will test.

Update: I think you hit the nail on the head with fonts. if I navigate to C:\Windows\Fonts in Windows Explorer, its an instant BSOD, even in safe mode. How can I find the font(s) at fault and get rid of them?

 

[Vir Gnarus]

Whoa, now that is unusual behavior! Try doing a CHKDSK /R followed by SFC /SCANNOW to see if there's any filesystem corruption that took place.

After that, the only way I can see to peruse the fonts for a potential bad one is to use another OS, like a liveCD environment like Parted Magic to navigate to the font folder and look at its contents.

Oh, and there's also the chance your system is infected. Make sure to check with something like Kaspersky's Virus Removal Tool as well as TDSSKiller for any potential rootkits. It's best not to let either software clean up the infection itself if it discovers any, but to provide us the results.

Again, this could be the GPU/graphics drivers messing up. When opening the fonts folder by default the thumbnails for the fonts will render the font for each one listed to display examples. It may be that through doing that the GPU is bugging out.

 

[SikSlayer]

Whoa, now that is unusual behavior! Try doing a CHKDSK /R followed by SFC /SCANNOW to see if there's any filesystem corruption that took place.

......Oh, and there's also the chance your system is infected. Make sure to check with something like Kaspersky's Virus Removal Tool as well as TDSSKiller for any potential rootkits. It's best not to let either software clean up the infection itself if it discovers any, but to provide us the results.

Unusual indeed. I've run Malwarebytes, and CHKDSK /r numerous times, even before finding these forums. I used HiRen's BootCD to get to the Windows\Fonts folder and delete some recent fonts with capital names, and I was able to then navigate to restore the default windows fonts in Safe Mode. I haven't seen a BSOD since!

I'm downloading Kaspersky's Virus Removal Tool currently, and will try it, and then TDSSKiller.

 

[Vir Gnarus]

Alright, good to hear! Also, for future reference, we normally don't recommend Hiren's BootCD because, as nice as it is, it does include licensed software that are not allowed for such distribution, some of which is also not even free and has been hacked to include them in the BootCD. If you want a legit, guilt-free alternative, the UBCD is your best bet.

Btw, do you recall the names of any of these fonts?

 

[SikSlayer]

Btw, do you recall the names of any of these fonts?

I don't. However, they were all capital letters, often with a non-english word, like "PLD____.TTF". I noticed what I assumed to be the 'default' Windows fonts were all of a similar date, so I had sorted out the files by date, and the 'out of place' files were all about 2 weeks old or less. So I just erased the whole group of them.

When I rebooted into Safe Mode, I was able to navigate to the folder without issue, and I knew I was on the right track. Haven't had a BSOD since.

 

[Vir Gnarus]

Hmm, do you remember installing any Windows updates or any software in the last 2 weeks? Having fonts installed on your system isn't something that's done frequently, so I'm worried they may be malware related.

 

[SikSlayer]

Hmm, do you remember installing any Windows updates or any software in the last 2 weeks? Having fonts installed on your system isn't something that's done frequently, so I'm worried they may be malware related.

Only the typical Windows Updates, of which were just released before I started having issues.

I did encounter an infected site prior, which I DO suspect was the cause, but I can't confirm. Nor do I wish to out the site, as it's owned and operated by a friend, and was merely the victim of a script kiddie. I will confer with this friend and see if I can get more info.

 

[Vir Gnarus]

If he can figure what malware was being released from the site, it will give you a better start on researching it to see if its payload matches up with the font files you've found. If it uses font files, then there's little doubt that your system was/is also infected. Have you ran TDSSKiller and that Kaspersky virus removal tool yet?

 

[SikSlayer]

Yeah, no hits from either. Which is odd.
Maybe the fonts themselves had the payload?

 

[Vir Gnarus]

Well something would have to load said fonts, which typically would not happen in regular system activity, otherwise it would be crashing your system consistently.

The only way to really tell if they were bad is if you ran them through virustotal.com, which would've scanned the font file through a whole variety of AV engines. If it came up clean for all of em, then it would be deemed clean. Unfortunately, you don't have access to any of them now, so it's all just speculation for what we can guess they may have been.