[SOLVED] Back again - another BSOD - Windows 7 x64

Mr T · Jul 2, 2014

Two weeks ago you were kind enough to help me with a BSOD issue.

https://www.sysnative.com/forums/bs...17-bsods-started-windows-7-x64.html#post75199

The problem has not occurred since until last night when the pc died again. I wasn't using it as the time, but came back to find a BSOD. Today I am having more problems, with unresponsive programs - particularly Firefox

· OS - Windows 7, fully updated x64
· What was original installed OS on system this
· Is the OS an OEM version
· Age of system 18 months
· Age of OS installation 18 months

· CPU INTEL i7-2600 QUAD CORE
· Video Card Intel (integrated) HD Graphics 3000
· MotherBoard ASUS P8Z77-V LX
· Power Supply - Tagan 1200w
· System Manufacturer Clone

View attachment 8456

Patrick · Jul 2, 2014

Hello again, Roger!

The attached DMP file is of the PAGE_FAULT_IN_NONPAGED_AREA (50) bug check.

This indicates that invalid system memory has been referenced.

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

Another common cause is the installation of a faulty system service.

Antivirus software can also trigger this error, as can a corrupted NTFS volume.

Code:

4: kd> k
Child-SP          RetAddr           Call Site
fffff880`0a5e4d58 fffff800`04b4653b nt!KeBugCheckEx
fffff880`0a5e4d60 fffff800`04ac7cee nt! ?? ::FNODOBFM::`string'+0x43781
fffff880`0a5e4ec0 fffff800`04bd0f7c nt!KiPageFault+0x16e
fffff880`0a5e5050 fffff800`04b34292 nt!MiLogPageAccess+0xdc
fffff880`0a5e50a0 fffff800`04ddc5ed nt! ?? ::FNODOBFM::`string'+0x2b82f
fffff880`0a5e5380 fffff800`04aec67b nt!CcUnmapVacb+0x5d
fffff880`0a5e53c0 fffff800`04adf039 nt!CcUnmapVacbArray+0x1bb
fffff880`0a5e5450 fffff800`04db3fb2 nt!CcGetVirtualAddress+0x38a
fffff880`0a5e54e0 fffff880`0164d4f0 nt!CcCopyRead+0x132
fffff880`0a5e55a0 fffff880`0164efd3 Ntfs!NtfsCachedRead+0x180
fffff880`0a5e5600 fffff880`0164f398 Ntfs!NtfsCommonRead+0x19ea
fffff880`0a5e5770 fffff880`0117ebcf Ntfs!NtfsFsdRead+0x1b8
fffff880`0a5e5820 fffff880`0117d6df fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0a5e58b0 fffff800`04dd3c3b fltmgr!FltpDispatch+0xcf
fffff880`0a5e5910 fffff800`04db3d53 nt!IopSynchronousServiceTail+0xfb
fffff880`0a5e5980 fffff800`04ac8e53 nt!NtReadFile+0x631
fffff880`0a5e5a70 00000000`74fe2e09 nt!KiSystemServiceCopyEnd+0x13
00000000`0265e9f8 00000000`00000000 0x74fe2e09

It looks like when the file system is attempting to go through its journaling, we reference invalid memory. Likely 3rd party software that's working with the file system causing conflicts. With this said I took a look at your loaded modules list and saw you had three security softwares running (ESET, Malwarebytes, and Aladdin).

1. Remove and replace ESET, Malwarebytes, and Aladdin with MSE ASAP for temporary troubleshooting purposes as they are very likely causing file system conflicts:

ESET removal - How do I uninstall or reinstall ESET Smart Security/ESET NOD32 Antivirus? - ESET Knowledgebase

MSE - Microsoft Security Essentials - Microsoft Windows

One of the biggest problems as far as security software goes in terms of conflicts, is if there is more than one antivirus or anti-malware suite installed on the system. In the most basic example, I will use AVG and Norton. Let's say you have both installed and running, this is not a good scenario at all. Why? Most/if not all modern day antivirus suites are allowed direct access (come and go, whenever they want) to the kernel because an antivirus installs interceptors of system events within the kernel code, which passes intercepted data to the antivirus engine for analysis. This data is network packets, files, and other various critical data. You can imagine how having three different pieces of software all doing this at once can be a problem.

2. Uninstall Crypkey.

3. Uninstall Asus Ai Boost/any and all other Asus bloatware ASAP.

Regards,

Patrick

Mr T · Jul 2, 2014

Thanks Patrick.

I don't set CrypKey, Aladdin or Asus AI anywhere. I don't even know what Aladdin is?

Patrick · Jul 2, 2014

Aladdin appears to be a part of Safenet from a Google search.

SafeNet - The Data Protection Company

Here's CrypKey - Software Licensing for Windows, with piracy software protection and Secure Licensing Management Service from Leading Global Provider of Copy Protection Software

Asus AI may be bundled with any of Asus' software. Do you have anything from Asus installed?

Regards,

Patrick

Mr T · Jul 2, 2014

I've disabled the Crypkey service - I can't find anything using Aladdin and I didn't install any Asus progs at all

Mr T · Jul 2, 2014

Uninstalled ESET & MBAM. FF still crashes though

Patrick · Jul 2, 2014

FF still crashes though

How so, does it just hang (i.e not responding) until you have to close it, or does it force-close?

Regards,

Patrick

Mr T · Jul 2, 2014

It crashes and the crash reporter lists:

Accessibility: Active
AdapterDeviceID: 0x0122
AdapterVendorID: 0x8086
Add-ons: %7B27c60876-b5c9-4335-b4f3-52b26782220c%7D:0.9.4,%7B91aa5abe-9de4-4347-b7b5-322c38dd9271%7D:4.1,%7B097d3191-e6fa-4728-9826-b533d755359d%7D:0.7.22,web2pdfextension%40web2pdf.adobedotcom:2.0,zotero%40chnm.gmu.edu:4.0.21.5,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:30.0,en-gb%40flyingtophat.co.uk:1.19.5,firefox%40ghostery.com:5.3.1,langpack-en-GB%40firefox.mozilla.org:30.0,%7B22119944-ED35-4ab1-910B-E619EA06A115%7D:7.9.7.5,%7B82AF8DCA-6DE9-405D-BD5E-43525BDAD38A%7D:7.2.15747.10003
AvailablePageFile: 37672067072
AvailablePhysicalMemory: 12991270912
AvailableVirtualMemory: 3478384640
BIOS_Manufacturer: American Megatrends Inc.
BlockedDllList:
BreakpadReserveAddress: 45940736
BreakpadReserveSize: 37748736
BuildID: 20140605174243
CrashTime: 1404297417
EMCheckCompatibility: true
FramePoisonBase: 00000000f0de0000
FramePoisonSize: 65536
InstallTime: 1403180661
Notes: AdapterVendorID: 0x8086, AdapterDeviceID: 0x0122, AdapterSubsysID: 00000000, AdapterDriverVersion: 9.17.10.3517
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ WebGL? EGL? EGL+ GL Context? GL Context+ WebGL+
ProductID: {ec8030f7-c20a-464f-9b0e-13a3a9e97384}
ProductName: Firefox
ReleaseChannel: release
SecondsSinceLastCrash: 3463
StartupTime: 1404296870
SystemMemoryUsePercentage: 22
Theme: classic/1.0
Throttleable: 1
TotalPageFile: 42132803584
TotalPhysicalMemory: 16854593536
TotalVirtualMemory: 4294836224
URL: https://www.sysnative.com/forums/bs...-back-again-another-blue-screen-of-death.html
Vendor: Mozilla
Version: 30.0
Winsock_LSP: MSAFD Tcpip [TCP/IPv6] : 2 : 1 : %SystemRoot%\system32\mswsock.dll
MSAFD Tcpip [UDP/IPv6] : 2 : 2 :
MSAFD Tcpip [RAW/IPv6] : 2 : 3 : %SystemRoot%\system32\mswsock.dll
MSAFD Tcpip [TCP/IP] : 2 : 1 :
MSAFD Tcpip [UDP/IP] : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD Tcpip [RAW/IP] : 2 : 3 :
RSVP TCPv6 Service Provider : 2 : 1 : %SystemRoot%\system32\mswsock.dll
RSVP TCP Service Provider : 2 : 1 :
RSVP UDPv6 Service Provider : 2 : 2 : %SystemRoot%\system32\mswsock.dll
RSVP UDP Service Provider : 2 : 2 :
useragent_locale: en-GB

This report also contains technical information about the state of the application when it crashed.

Patrick · Jul 2, 2014

Code:

Winsock_LSP: MSAFD Tcpip [TCP/IPv6] : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [UDP/IPv6] : 2 : 2 :  
 MSAFD Tcpip [RAW/IPv6] : 2 : 3 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [TCP/IP] : 2 : 1 :  
 MSAFD Tcpip [UDP/IP] : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [RAW/IP] : 2 : 3 :  
 RSVP TCPv6 Service Provider : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 RSVP TCP Service Provider : 2 : 1 :  
 RSVP UDPv6 Service Provider : 2 : 2 : %SystemRoot%\system32\mswsock.dll

This may be the mswsock.dll trojan.

Can you please install Malwarebytes free (not pro as you had) and run a full scan - https://www.malwarebytes.org/mwb-download/

Regards,

Patrick

Mr T · Jul 2, 2014

I'd checked the CRC and it matched the valid 6.1.7600.16385

Should I still scan?

Patrick · Jul 2, 2014

Yes, just to be sure.

Regards,

Patrick

Mr T · Jul 2, 2014

The scan is clean

Mr T · Jul 2, 2014

Just had this error message

Patrick · Jul 2, 2014

Okay, given your consistency of random app crashes, and the 0x50 bug check, I'd like to test your RAM. Please run Memtest for NO LESS than ~8 passes (several hours):

Memtest86+:

Download Memtest86+ here:

Memtest86+ - Advanced Memory Diagnostic Tool

Which should I download?

You can either download the pre-compiled ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).

Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).

How Memtest works:

Memtest86 writes a series of test patterns to most memory addresses, reads back the data written, and compares it for errors.

The default pass does 9 different tests, varying in access patterns and test data. A tenth test, bit fade, is selectable from the menu. It writes all memory with zeroes, then sleeps for 90 minutes before checking to see if bits have changed (perhaps because of refresh problems). This is repeated with all ones for a total time of 3 hours per pass.

Many chipsets can report RAM speeds and timings via SPD (Serial Presence Detect) or EPP (Enhanced Performance Profiles), and some even support changing the expected memory speed. If the expected memory speed is overclocked, Memtest86 can test that memory performance is error-free with these faster settings.

Some hardware is able to report the "PAT status" (PAT: enabled or PAT: disabled). This is a reference to Intel Performance acceleration technology; there may be BIOS settings which affect this aspect of memory timing.

This information, if available to the program, can be displayed via a menu option.

Any other questions, they can most likely be answered by reading this great guide here:

FAQ : please read before posting

Regards,

Patrick

Mr T · Jul 2, 2014

The screen turned red almost immediately. I swapped the 4 modules around and found the failing one (That'll teach me to put 2 cheap memory modules in with two premium).

It booted Windows and I used it for an hour without problem. Now I rebooted and have it back on memtest overnight.

Thanks

Patrick · Jul 2, 2014

As I suspected, faulty RAM.

Let me know how things turn out with the current module set up.

Regards,

Patrick

Jared · Jul 2, 2014

Great job Patrick :)

Mr T · Jul 3, 2014

Thanks Patrick

Ran all night without issue - fingers crossed we have it

Thanks again

Patrick · Jul 3, 2014

My pleasure, glad to hear.

Marked as solved, but as always, let me know if the issues persist.

Regards,

Patrick

[SOLVED] Back again - another BSOD - Windows 7 x64

Member

Sysnative Staff

Member

Sysnative Staff

Member

Member

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff

Member

Member

Sysnative Staff

Member

Sysnative Staff

Sysnative Staff, BSOD Kernel Dump Expert

Member

Sysnative Staff