Need help with page fault and other random BSOD

[Doompa]

The page faults occur mostly while playing WoW. The other ones usually just happen at random times after I walk away from the comp.

I checked the RAM with memtest and it passed with 0 errors (though I only allowed it 1 pass).


Thanks for any info you can give.

 

[Doompa]

Update: I ran memtest through 5 passes and recieved zero errors.

Any help on analyzing the dump files would be appreciated.

 

[Jonathan_King]

Welcome to SF!

Please follow these directions for enabling Driver Verifier: http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

Update these old drivers:

wanatw64.sys Mon Apr 11 18:07:10 2005
ctac32k.sys  Wed Jul 02 04:38:22 2008
gdrv.sys     Sat Oct 13 03:22:00 2007

How To Find Drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

[font=lucida console]
BugCheck 7F, {8, 80050031, 6f8, fffff800030075f4}
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck 50, {7ffe0324, 0, 7532ee15, 8}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+43057 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck 3B, {c0000005, fffff960003741d9, fffff88003ab9070, 0}
Probably caused by : win32k.sys ( win32k!DestroyUMPDHeap+d )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck 50, {fffff100123ab960, 1, fffff80002d99042, 7}
Probably caused by : ntkrnlmp.exe ( nt!NtClearEvent+32 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck 1A, {41201, fffff680002d6940, eb3000800a87e847, fffffa8009413a90}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+13bb2 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
[/font]

 

[Doompa]

Thanks.

The gdrv.sys I guess is from Gigabyte's Dynamic Energy Save. I never used the program so I went and uninstalled it and changed the name of that driver.

From what I found the ctac32k.sys is from Creative. I have a creative x-fi fatal1ty but from what I've been reading, the file is for an Audigy card which confused me quite a bit. This was a clean install of Win 7 so there should not be any other card drivers on there (along with the fact that I've never had an audigy) but I assume it was put there for a reason.

The wanatw64.sys I could find very little information on but it appears to be related to AOL

Were one of these drivers causing the crashes? I figured it was RAM or my video card.

 

[Jonathan_King]

wanatw64.sys could also be your network adapter drivers.

Old drivers can have compatibility issues, and cause a BSOD. Whether or not those drivers caused your problem is unclear, but even if not, old drivers should still be updated.

 

[Doompa]

My network adapter driver was dated from March of 2010.

I wish those dumps could have told me something about what was causing the problem. It doesn't happen too often but the page faults happen after playing World of Warcraft for a period of time so I figured it was the RAM or the vid card

 

[Jonathan_King]

The dmps point to a driver issue, most likely. Please enable driver verifier, and hopefully it will tell us which one.

http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[Doompa]

Ok i enabled it and now the comp is on the Starting Windows screen and has been for awhile. I hear the comp loading stuff so is it verifying?

 

[Jonathan_King]

It will be verifying in the background.

Leave it for maybe 30 minutes, and reboot it if it hasn't moved on. Your system may be slow and crashy until you turn it off.

 

[Doompa]

I had to do a system restore to get to windows but it seems to be working fine now.


I did the driver verification and got an immediate crash 2 times. The driver has to do with Spyware Doctor. I'm going to run the driver test without testing that driver to see if it is something else too.

 

[Doompa]

I ran it again and got two errors. One of them did not tell me what it was and was an immediate crash. The other one was another PCtools driver.

I restarted a 3rd time but the screen just stayed on the windows loading screen indefinitely again

 

[Jonathan_King]

Please remove PC Tools completely. Certainly not the first time I have seen it crash a system.

Also remove nVidia System Utilities.

[font=lucida console]
BugCheck C9, {6, 103, fffff9800779ee10, 0}
Probably caused by : nvoclk64.sys ( nvoclk64+b264 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck C4, {f6, 3ac, fffffa8008c77b30, fffff8800118e9cc}
Probably caused by : PCTCore64.sys ( PCTCore64+239cc )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
[/font]

 

[Doompa]

This is the last crash with no PCTool stuff selected.

Also, how do I remove the NVidia System Utility? It is not in the program panel. I have:


NVIdia display control panel
NVidia Drivers
NVidia PhysX
NVidia Stereoscopic 3D driver

 

[Jonathan_King]

Do you have nTune?

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp1_060110-19422-01.zip\060110-19422-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a5c000 PsLoadedModuleList = 0xfffff800`02c99e50
Debug session time: Tue Jun  1 19:41:37.594 2010 (GMT-4)
System Uptime: 0 days 0:00:10.608
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {6, 103, fffff98006deae10, 0}

Unable to load image \SystemRoot\system32\DRIVERS\nvoclk64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvoclk64.sys
*** ERROR: Module load completed but symbols could not be loaded for nvoclk64.sys
Probably caused by : nvoclk64.sys ( nvoclk64+b264 )

Followup: MachineOwner
---------

 

[Doompa]

I can't find where to uninstall that. The only thing there is are the options I listed above.

The folder is in the systemtools folder in the NVidia folder but I don't know if it's actively installed or not.

 

[Jonathan_King]

I can't find where to uninstall that. The only thing there is are the options I listed above.

The folder is in the systemtools folder in the NVidia folder but I don't know if it's actively installed or not.

Remove it, and see what happens.

 

[Doompa]

Okay I deleted everything in the NTune folder. The only thing still left is the setup program.

The nvoclk64.sys file still populates the driver files in the verification. Before I deleted the folder I did another check and got an IRQ error. I have not done anything since deleting all the NTune stuff.

 

[Jonathan_King]

Please keep driver verifier enabled, stressing all third-party drivers.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp1_060110-16848-01.zip\060110-16848-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a64000 PsLoadedModuleList = 0xfffff800`02ca1e50
Debug session time: Tue Jun  1 20:23:41.755 2010 (GMT-4)
System Uptime: 0 days 0:00:08.378
Loading Kernel Symbols
...............................................................
........................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {e, 2, 1, fffff80002af431b}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000000000000e, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002af431b, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0c0e0
 000000000000000e 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+c88
fffff800`02af431b 48894108        mov     qword ptr [rcx+8],rax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

IRP_ADDRESS:  ffffffffffffff8e

TRAP_FRAME:  fffff880031bc2b0 -- (.trap 0xfffff880031bc2b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8003d09688 rbx=0000000000000000 rcx=0000000000000006
rdx=fffffa8003d09680 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002af431b rsp=fffff880031bc440 rbp=fffff880031bc590
 r8=fffff880031bc548  r9=fffff880031bc540 r10=0000000000000002
r11=fffff80002af36a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!IopCompleteRequest+0xc88:
fffff800`02af431b 48894108        mov     qword ptr [rcx+8],rax ds:0b40:00000000`0000000e=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ad3b69 to fffff80002ad4600

STACK_TEXT:  
fffff880`031bc168 fffff800`02ad3b69 : 00000000`0000000a 00000000`0000000e 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`031bc170 fffff800`02ad27e0 : 00000000`00000000 fffff980`02c78ee0 00000000`00000000 fffff800`02c60b40 : nt!KiBugCheckDispatch+0x69
fffff880`031bc2b0 fffff800`02af431b : fffff880`031bc5c0 fffff6fc`5001b018 ffff0800`00000011 fffff800`02d994c8 : nt!KiPageFault+0x260
fffff880`031bc440 fffff800`02ab0fcf : 00000000`00000006 fffff800`02ad27fd 00000000`00000000 fffffa80`00000000 : nt!IopCompleteRequest+0xc88
fffff880`031bc510 fffff800`02ab1387 : 00000000`00000007 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`031bc590 fffff800`02d9978a : fffffa80`05e98e60 fffff800`02b0720f fffff980`01afce10 fffff980`02dfcb80 : nt!KiApcInterrupt+0xd7
fffff880`031bc720 fffff800`02d99b75 : fffffa80`00000000 fffffa80`0606e190 fffff8a0`03603a30 00000000`000007ff : nt!MiParseImageSectionHeaders+0x28a
fffff880`031bc7a0 fffff800`02d990c0 : 00000000`00000000 fffffa80`060a2210 00000000`00000000 fffff880`0e19e1e8 : nt!MiBuildImageControlArea+0x365
fffff880`031bc850 fffff800`02dd0855 : fffffa80`060a2210 00000000`00000000 00000000`00000022 fffff880`031bcb00 : nt!MiCreateImageFileMap+0x3e8
fffff880`031bca80 fffff800`02dc5b83 : fffff880`031bcce0 00000000`00000000 fffff880`031bcf98 fffff880`031bccd8 : nt!MmCreateSection+0x7a9
fffff880`031bcc90 fffff800`02ad3853 : fffffa80`03d09680 fffff880`031bcf38 fffff880`031bcd28 00000000`00000000 : nt!NtCreateSection+0x162
fffff880`031bcd10 fffff800`02acfdf0 : fffff800`02eadf46 00000000`00000004 00000000`0000003c 00010004`10000001 : nt!KiSystemServiceCopyEnd+0x13
fffff880`031bcf18 fffff800`02eadf46 : 00000000`00000004 00000000`0000003c 00010004`10000001 80000000`00010000 : nt!KiServiceLinkage
fffff880`031bcf20 fffff800`02eae30c : ffffffff`8000003c 00000000`00100000 fffffa80`03c765d0 fffff800`02f68f6d : nt!MmCheckSystemImage+0x96
fffff880`031bd050 fffff800`02eae527 : ffffffff`8000003c 00001f80`00000001 fffff880`031bd338 00000000`00000000 : nt!MiCreateSectionForDriver+0xcc
fffff880`031bd100 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiObtainSectionForDriver+0xd7


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02ad27e0 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0xA_VRF_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_VRF_nt!KiPageFault+260

Followup: MachineOwner
---------

 

[Doompa]

Okay I've managed to make it to Windows with no crash yet. I have restarted the comp 3 times too and managed to make it in all 3 times.

The speakers sound horrible but I assume that's cause of the sound card drivers being stressed.

What do I do now?

 

[Jonathan_King]

Just use your computer as you normally would, and upload the new dmps when it crashes.