Windows 8.1 "PAGE_FAULT_IN_NONPAGED_AREA" Blue Screen of Death

armanition

Honorable
Jul 25, 2012
24
0
10,510
(Hopefully I put this in the right category!)

Hey everyone,

I have an HP Envy m6-1205dx running Windows 8.1 (Upgraded from 8 via the Store app). I have no issues putting this laptop to sleep, hibernating it, shutting it down, or rebooting it (from Windows). Though, if I leave it in any of these states for an extended period of time, I get a BSOD whenever I try to wake it, or cold boot it. Like the title says, it's a memory-related issue. As a lot of you know, Windows 8 (and 8.1) tries to make BSOD's more user-friendly by collecting error information for future troubleshooting. Whenever this happens in my case, it does reach 100%, though it hangs indefinitely from then on. Upon hard-resetting it, it boots normally afterwards (albeit a bit slower than it should), after which Windows operates without issues.

This occurs every time I try to wake it from sleep, hibernation, or cold-booting. Reboots via Windows are fine.

I tried poking around online (to little avail) about the issue. Some forum threads suggested that AMD CCC was the culprit. Just in case, I did do a clean uninstall of any and all AMD drivers, and re-installed the latest version (I also tried older versions, as well as the latest betas). This didn't help anything whatsoever.

I've tried BlueScreenViewer, and narrowed the causes down to "tm.sys" and "ntoskrnl.exe".

On a side note, I wondered if simply replacing those two files (which I couldn't find anywhere) would solve it...

I have Windows set to create a full memory dump, not just a minidump. For experiment's sake, I did have Windows create a minidump, which I can share if need be. (I'd share the full dump, but it's ~5.5GB!)

If that link is broken for whatever reason, I'll be glad to e-mail the file directly.

I've tried the following:
- Startup repair (took about an hour to *attempt* repairs, then failed)
- Uninstalling applications that may use non-paged memory (using IOBit Uninstaller, just to be sure)
- Using CCleaner to remove any unused/empty registry keys
- Updating various drivers via Device Manager
- Removing and reinstalling RAM

I don't have any system restore points that go back far enough.

If I can help it, I would really rather not do a clean install/factory reset.

If it matters any, this laptop's specifications are as follows:

CPU: AMD A10-4600M
GPU: AMD Radeon HD 7660G
RAM: 6GB (2GB + 4GB, @ 1600MHz)
HDD: 750GB, 5400RPM
OS: Windows 8.1 (Upgraded from 8 via the Store, as I said previously)

I'm out of ideas here, so any and all help is greatly appreciated!
 
Solution
-Cool, that would explain it. bridge was bound to two cards, the first card attempted to delete the memory buffer but the second card still had a binding to the bridge so the deletion failed and you got the bugcheck.

-If you have configuration control in the router you are using you can turn off the routers
access point isolation (AP isolation) to allow the wired Ethernet section of the router to talk to the wireless Ethernet side of the router and you would not have to bridge between the adapters on your local machine.

these are system files, if you think they are corrupt you can use the system file checker to fix them.
start command as a admin
(windows key+x, then type A)

sfc.exe /scannow <----------this will check the system files for corruption and repair any found

if you get a message indicating that it can not be repaired, run this command
dism.exe /online /cleanup-image /restorehealth

I would not wipe the system, it is just too easy to fix problems like this
If the above command do not find and fix a corrupt file then you might want
to configure your system to save the memory dump file, then place it on a public server like skydrive with public access and someone can take a quick look at the memory dump for you.
 

armanition

Honorable
Jul 25, 2012
24
0
10,510


I forgot to list that I had already tried sfc /scannow, which had failed as well. With DISM, that did finish successfully, though the issue still remains.

Here's a link to the minidump:
https://app.box.com/s/x7mqq2af3jne9w52ku32
 
Ijust looked at your bugcheck, it was in the network stack for tcpip
I would suspect this file

\SystemRoot\system32\DRIVERS\teamviewervpn.sys
- you might want to confirm you intended this to run. it is very old (2007) If you actually want this program you will want to find a update, otherwise uninstall it.
- you might also want to scan your system with malwarebytes
you might want to check for a update to


I would also remove
\??\C:\WINDOWS\system32\drivers\iPodDrv.sys Thu Apr 09 21:07:40 2009
and
C:\WINDOWS\SysWOW64\speedfan.sys Sat Dec 29 12:59:35 2012

update (Check for updated from motherboard vendor web site)
Image path: \SystemRoot\system32\DRIVERS\usbfilter.sys Tue Jun 19 04:07:40 2012

you might want to check for a update to
\SystemRoot\system32\DRIVERS\Accelerometer.sys Thu Aug 16 15:33:53 2012
SystemRoot\system32\DRIVERS\CLVirtualDrive.sys Mon Dec 26 05:26:47 2011
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys Thu May 03 12:56:17 2012
\SystemRoot\system32\DRIVERS\hpdskflt.sys Thu Aug 16 15:35:40 2012


BugCheck 50, {fffff6fb40000000, 0, 0, 6}
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff6fb40000000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: 0000000000000000, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000006, (reserved)


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8018fd5c150
GetUlongFromAddress: unable to read from fffff8018fd5c208
fffff6fb40000000

2: kd> kc
Call Site
nt!KeBugCheckEx
nt! ?? ::FNODOBFM::`string'
nt!MmAccessFault
nt!KiPageFault
nt!ExFreeLargePool
nt!ExFreePoolWithTag
tcpip!RssDeleteBinding
tcpip!RssControlDeleteInterface
tcpip!OlmNotifyDeleteInterface
tcpip!IppNotifyInterfaceChangeToNlClients
tcpip!IpFlcDeleteInterface
tcpip!FlpDeleteInterface
tcpip!FlUnbindAdapter
ndis!ndisInvokeUnbindAdapter
ndis!ndisUnbindProtocolOpen
ndis!ndisUnbindEachProtocolOpenOnMiniport
ndis!Ndis::BindEngine::Iterate
ndis!Ndis::BindEngine::UpdateBindings
ndis!Ndis::BindEngine::DispatchPendingWork
ndis!Ndis::BindEngine::ApplyBindChanges
ndis!ndisMSetMiniportReadyForBinding
ndis!ndisPnPRemoveDevice
ndis!ndisPnPRemoveDeviceEx
ndis!ndisPnPIrpSurpriseRemovalInner
nt!ExpWorkerThread
nt!PspSystemThreadStartup
nt!KiStartSystemThread





debug info
Vendor Insyde
BIOS Version F.35
BIOS Starting Address Segment e000
BIOS Release Date 09/23/2013

Manufacturer Hewlett-Packard
Product Name HP ENVY m6 Notebook PC
Product 18A6
Version 74.80
Processor Version AMD A10-4600M APU with Radeon(tm) HD Graphics
Processor Voltage 8ah - 1.0V
External Clock 100MHz
Max Speed 2300MHz
Current Speed 2300MHz


memory SODIMM
channel A 4096MB 800MHz Micron Technology Part Number 8KTF51264HZ-1G6E1
CHANNEL B 2048MB 800MHz A-DATA Technology Part Number AM1U16BC2P1-B1AH








2: kd> lmvm teamviewervpn
start end module name
fffff800`01665000 fffff800`01672000 teamviewervpn (deferred)
Image path: \SystemRoot\system32\DRIVERS\teamviewervpn.sys
Image name: teamviewervpn.sys
Timestamp: Thu Dec 13 01:22:09 2007 (4760F9C1)
CheckSum: 00017C81
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4


 
edit: I think you might be able to isolate the problem down by going into your adapter bindings ad delete them one at a time(wait maybe 30 seconds between each deletion). I think when you hit the one that has a bug, you should get a bugcheck in the system. In the end, the only work around would be to uninstall the drivers for the card and re-install them.

check bindings on your ethernet adapter
control panel->network and internet-> network and sharing center
click on ethernet, slelect properties and see what protocols are bound to the card.
(and you can disable them there)
you can select the configure button to get to the power management tab and maybe disable
power saving for the device to see if your device has a sleep state issue. (the listings available will depend on the device)

My card has a EEE setting (Energy Efficient Ethernet which allows the device to enter a low power states)


=====================
Ok, I am not sure as to what is going on. It looks like a network device is being removed from the system like a USB wireless card but when it
does its cleanup routines, it ends up attempting to free a bad memory reference.
Is this a removable device? It could be a problem in a driver related to sleep modes or hibernation. or a protocol binding to a the card. Maybe even Internet connection sharing related issue (not sure)


is this even a USB device? is it being turned off and on by a switch? All i can think to do would be to update the driver but I think you have the one from the HP site. I guess you could change the power setting for the wireless card so that it never powers down. Maybe change your system not to enter hibernation.

Is this the driver you are using for your ethernet?
http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?softwareitem=ob-127161-1&cc=us&dlc=en&lc=en&os=4158&product=5312254&sw_lang=

QCA9000 Series Wireless Atheros



-well, in the end I don't know. I would start looking at why it was being removed or remove the adapter software and reinstall it on the system in the blind hope that it will help.

your bug was basically the same in both crashes, so it is not likely to be memory corruption in the machine, your debug images of the ntkernel, tcpip, and ndis were ok (not corrupted). It might be a particular setting for your ethernet adapter that caused the problem. just not sure



===============

you may want to update RtsBaStor.sys Sun Jul 29 23:08:03 2012

http://www.realtek.com.tw/Downloads/downloadsView.aspx?Langid=1&PNid=15&PFid=25&Level=4&Conn=3&DownTypeID=3&GetDown=false


 

armanition

Honorable
Jul 25, 2012
24
0
10,510


I think I've figured it out!

When I went to go remove my adapter bindings, I noticed that Windows, for whatever reason, had tried to create a network bridge from my LAN adapter to my WLAN adapter :heink:

Out of curiosity, I deleted it (seeing as how I have no need to bridge my adapters, though I understand the purpose of it) and tried triggering the BSOD again. It booted without a single hiccup! Just to make sure it really is solved, I shut it down several times, and cold-booted it a bunch of times, as well as hibernating/sleeping. Of the multiple times I tried each one, none of them have resulted in a BSOD :)
 
-Cool, that would explain it. bridge was bound to two cards, the first card attempted to delete the memory buffer but the second card still had a binding to the bridge so the deletion failed and you got the bugcheck.

-If you have configuration control in the router you are using you can turn off the routers
access point isolation (AP isolation) to allow the wired Ethernet section of the router to talk to the wireless Ethernet side of the router and you would not have to bridge between the adapters on your local machine.



 
Solution

missyoumike

Reputable
Jan 20, 2015
1
0
4,510
I had the same problem on a Surface Pro tablet. I did not add any software except for Windows updates. The problem just suddenly started. I suspect an update as the culprit, although removing updates did not solve the error. I found the network bridge as well and deleted it and solved the error PAGE_FAULT_IN_NONPAGED_AREA on startup. ( I did not get the error on restart only on sleep or shutdown)

Just wanted to add this info because this post is what helped me solve my problem.
 

AryaSt

Reputable
Apr 29, 2015
1
0
4,510





I think i have the same problem. Can you explain what is this network bridge, how to find it and delete it?
 

Lorenzo-GP GP

Reputable
Jun 12, 2015
1
0
4,510


I belive this has got to be the suloshion B/C 2 days ago I made a net work bridge and I have been seeing this MSG Bluescreen ever seence just didt put to and 2 together but now I c I have For and the anser to why I was getting that msg now in going to delete that bridge...thx cheers
 
looked at one of the minidumps, you have some adware installed you should remove it and retest.
\SystemRoot\system32\drivers\{a3f28269-ad17-41a8-b032-3e0313ef8979}Gw64.sys Thu Jan 30 16:45:30 2014
adware by Adware by ClearThink

info: http://www.carrona.org/drivers/driver.php?id=Gw64.sys

start another thread if you still get problems after you remove the adware.



 

CristianXFree

Reputable
Sep 2, 2015
15
0
4,510
I am having these same issues. I ran the "sfc.exe /scannow" and it came back with corrupt files so I ran the "dism.exe /online /cleanup-image /restorehealth" command then restarted after restarting I ran the first command again and still have corrupt files. I have had many issues with BSOD here are some dump files.
http://1drv.ms/1JG5QuC
Please help me. my warranty is going to expire in 2 months and I would like to know if there is anything I need to have done to it before it does. thank you so much!
 
you also want to confirm your processor voltage is correct, too high a voltage to the CPU can cause bit corruptions as the cpu executes code. I will look up the correct voltage for VCC i7-4790 CPU @ 3.60GHz
4th generation processor.

(also confirm I picked the correct model on the dell site, lots of different versions)

the only driver I see that could really cause this looks like
: Intel RST (Rapid Storage Technology) driver
iaStorA.sys Thu Aug 01 18:39:52 2013
I would look for a update from https://downloadcenter.intel.com/
looks like dell put out a update for the file
http://www.dell.com/support/home/us/en/04/product-support/product/xps-8700/drivers/advanced
(serial ATA driver on july 29 1015)



bummer, looked at your first bugcheck. A single bit was corrupted in memory.
these are hard to find. I would start with running memtest and confirm your memory is good. You might want to move pull your memory and test one stick at a time to see if you can find a bad stick. Even moving the memory to different slots can change the timing enough to get the memory to work.

The reason it bugchecked is because the nt kernel was loaded into memory and it was corrupted by one bit. It detected the error and shutdown the system.
I can see the corruption in the kernel file. You must confirm it is ok on disk.
(most likely is ok but got corrupted somewhere between being loaded from disk into memory) That mean anything touching it can cause the corruption.
Firmware in the drive, sata hardware, sata drivers, memory in the CPU, and the actual memory itself can have problems. System was up for 11 hours.
You could also get this if the CPU overheats and a bit flips. It could also be a defect in how the memory dump was written. (the debugger shows the file corrupt in the memory dump file, not the actual memory)

Maybe I will find something useful in another memory dump.





Machine info:
BIOS Version A11
BIOS Starting Address Segment f000
BIOS Release Date 07/09/2015

Manufacturer Dell Inc.
Product Name XPS 8700
Manufacturer Dell Inc.
Product 0KWVT8
Version A03
Processor ID c3060300fffbebbf
Processor Version Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
Processor Voltage 8fh - 1.5V
External Clock 100MHz
Max Speed 3600MHz
Current Speed 3600MHz


memory:
Speed 1600MHz
Manufacturer Kingston
Serial Number
Asset Tag Number
Part Number K531R8-ETB
[


 

CristianXFree

Reputable
Sep 2, 2015
15
0
4,510
first off, thank you for helping me! I checked voltage with CPUZ and the voltage ranges from .85V to 1V the recommended VID is .8V-1.325V. So I believe I am good there. As for the update for the intel RTS i downloaded the drivers but I cannot seem to find "Intel RTS" in my device management would it be called something else? and what program would you recommend for memtest? Once again thank you for your help.
 
most people run memtest86
iaStorA.sys: in windows control panel, device manager it might show up a SATA or IDE ATA/ATAPI controller
(expand it) on my system I see two controllers under IDE ATA/ATAPI controllers
both are listed as: Standard SATA AHCI controller

In my case if I expand them both It shows that I am using the Microsoft generic driver rather than the Intel drivers.
I did not add the intel drivers because I was not using any of the special features of the chips. (raid in my case)
My system had two controllers one from intel and another faster one from another vendor. I am using the Microsoft generic driver for both.







 

CristianXFree

Reputable
Sep 2, 2015
15
0
4,510


That is exactly where it was thank you! now just need to memtest and see if anything is wrong in that! fingers crossed
 

CristianXFree

Reputable
Sep 2, 2015
15
0
4,510
Hello again, so for two weeks my computer worked with out the BSOD and I thought I was in the clear. Unfortunately I was mistaken. a few days ago it really started hitting hard. BSOD 3-4 times a day. I ran memtest last night and it came back clean (link to memtest results):
file:///L:/EFI/BOOT/MemTest86-Report-20150921-233448.html

I removed all the old minidumps from one drive and posted new ones from the past few days. IF you dont mind can you take a look at them and tell me what you see:
http://1drv.ms/1JG5QuC

I'm sorry to be bothering you again with the same issue
 
could not access your memory dump files on one drive. You might want to confirm they are marked public access.



 

CristianXFree

Reputable
Sep 2, 2015
15
0
4,510


sorry, i thought if i made the folder public it would make the files inside public

1. http://1drv.ms/1gSOfHU
2. http://1drv.ms/1KTiSci