I need a more knowledgeable set of eyes

SysWiz · Mar 17, 2021

My old faithful PC has an obnoxious issue of bluescreening when I least expect it. The most recent was an ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY crash that happened last night. I have tried various things in the past including driver verifier, but have not nailed down the culprit. Any help would be most appreciated.

http://speccy.piriform.com/results/aDV3iYQvnkfWf6Fanw1QVBR

This is a retail Win 8.1 x64 custom build desktop PC I did around 6ish years ago. The hardware specs are in the speccy link. I run Malwarebytes and ESET Endpoint Antivirus. No overclocking.

Driver verifier is disabled.

Thanks in advance!

Wrench97 · Mar 18, 2021

Why haven't you updated this system to Windows 10?

Update or remove the Asus software it has been a issue for a long time.

AsUpIO.sys Mon Aug 2 22:47:59 2010 (4C57835F)
ASUS hardware monitoring software related http://support.asus.com/download/download.aspx?SLanguage=en-us
https://www.sysnative.com/drivers/driver.php?id=AsUpIO.sys

From the 2 dmps in the upload

Code:

BugCheck FC, {ffffe000f1a3a8e6, 80000001012008e3, ffffd000364b9ef0, 3}
Probably caused by: iaStorA.sys ( iaStorA+5ae8 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 1A, {41792, fffff68052baf090, 200000000, 0}
Probably caused by: memory_corruption ( ONE_BIT )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Down load and install the Intel driver update utility (iaStorA.sys from Thu Aug 1 21:39:52 2013) is a outdated Intel storage driver.
Intel® Driver & Support Assistant

If the first 2 steps don't resolve the issue run Memtest on the ram.
MemTest86 - Official Site of the x86 Memory Testing Tool

Code:

Debug session time: Wed Mar 17 01:05:00.333 2021 (UTC - 4:00)
Loading Dump File [C:\BSOD App\SysnativeBSODApps\031621-15453-01.dmp]
Built by: 9600.19962.amd64fre.winblue_ltsb_escrow.210208-1933
System Uptime: 3 days 7:28:56.146
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: ffffe000f1a3a8e6, Virtual address for the attempted execute.
Arg2: 80000001012008e3, PTE contents.
Arg3: ffffd000364b9ef0, (reserved)
Arg4: 0000000000000003, (reserved)
*** WARNING: Unable to verify timestamp for iaStorA.sys
PROCESS_NAME:  csrss.exe
Probably caused by: iaStorA.sys ( iaStorA+5ae8 )
FAILURE_BUCKET_ID:  0xFC_iaStorA!unknown_function
MaxSpeed:     3400
CurrentSpeed: 3503
 
Processor may be overclocked!
Expected Frequency:   3400
Actual Frequency:     3503
Overclock Ratio:      1.03029
 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sat Jan 16 01:56:46.471 2021 (UTC - 4:00)
Loading Dump File [C:\BSOD App\SysnativeBSODApps\011521-34812-01.dmp]
Built by: 9600.19880.amd64fre.winblue_ltsb.201021-0600
System Uptime: 1 days 15:58:00.750
BugCheck Info: MEMORY_MANAGEMENT (1a)
Bugcheck code 0000001A
Arguments: 
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
    the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: fffff68052baf090
Arg3: 0000000200000000
Arg4: 0000000000000000
PROCESS_NAME:  HPNETW~1.EXE
Probably caused by: memory_corruption ( ONE_BIT )
FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT
MaxSpeed:     3400
CurrentSpeed: 3503
 
Processor may be overclocked!
Expected Frequency:   3400
Actual Frequency:     3503
Overclock Ratio:      1.03029
 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

x BlueRobot · Mar 18, 2021

Rich (BB code):

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory.  The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffe000f1a3a8e6, Virtual address for the attempted execute.
Arg2: 80000001012008e3, PTE contents.
Arg3: ffffd000364b9ef0, (reserved) << Trap Frame Address
Arg4: 0000000000000003, (reserved)

Rich (BB code):

2: kd> .trap 0xffffd000364b9ef0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000080040033 rbx=0000000000000000 rcx=fffff6fb7dbedf80
rdx=ffffd000364ba450 rsi=0000000000000000 rdi=0000000000000000
rip=ffffe000f1a3a8e6 rsp=ffffd000364ba088 rbp=ffffd000364ba100
r8=0000000000000000  r9=0000000000000000 r10=7010008004002001
r11=0000000080050033 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
ffffe000`f1a3a8e6 0000            add     byte ptr [rax],al ds:00000000`80040033=??

Rich (BB code):

2: kd> !pte ffffe000f1a3a8e6
                                           VA ffffe000f1a3a8e6
PXE at FFFFF6FB7DBEDE00    PPE at FFFFF6FB7DBC0018    PDE at FFFFF6FB78003C68    PTE at FFFFF6F00078D1D0
contains 0000000000E4B863  contains 0000000000E4A863  contains 80000001012008E3  contains 0000000000000000
pfn e4b       ---DA--KWEV  pfn e4a       ---DA--KWEV  pfn 101200    --LDA--KW-V  LARGE PAGE pfn 10123a

Rich (BB code):

2: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffd000`364b9d48 fffff800`b36e46d0 nt!KeBugCheckEx
01 ffffd000`364b9d50 fffff800`b37f330b nt!MI_CHECK_KERNEL_NOEXECUTE_FAULT+0x64
02 ffffd000`364b9d90 fffff800`b3658ea3 nt!MiRaisedIrqlFault+0x167 << @ DISPATCH_LEVEL
03 ffffd000`364b9df0 fffff800`b375bb9d nt!MmAccessFault+0x103
04 ffffd000`364b9ef0 ffffe000`f1a3a8e6 nt!KiPageFault+0x31d
05 ffffd000`364ba088 ffffe000`f1f1d0a5 0xffffe000`f1a3a8e6 << Crash here!
06 ffffd000`364ba090 ffffe000`f31e6300 0xffffe000`f1f1d0a5
07 ffffd000`364ba098 ffffd000`364ba100 0xffffe000`f31e6300
08 ffffd000`364ba0a0 ffffe000`f1f12423 0xffffd000`364ba100
09 ffffd000`364ba0a8 ffffe000`00000002 0xffffe000`f1f12423
0a ffffd000`364ba0b0 0000029a`366edde2 0xffffe000`00000002
0b ffffd000`364ba0b8 ffffe000`f2a05458 0x0000029a`366edde2
0c ffffd000`364ba0c0 ffffe000`ef49b010 0xffffe000`f2a05458
0d ffffd000`364ba0c8 ffffe000`f2a05458 0xffffe000`ef49b010
0e ffffd000`364ba0d0 ffffd000`364ba240 0xffffe000`f2a05458
0f ffffd000`364ba0d8 fffff801`9a8f3ae8 0xffffd000`364ba240
10 ffffd000`364ba0e0 ffffe000`f2a05458 iaStorA+0x5ae8

It seems that the actual crash began due to an illegal page fault, you can't cause a page fault for an address which is part of a non-pageable region. The processor was also at IRQL Level 2, which again, would have lead to a crash. However, it just so happens, that the memory address was non-executable and therefore lead to the Stop 0xFC bugcheck. I'm sure that MmAccessFault checks a number of different conditions and then decided to throw the appropriate exception code based on that.

As suggested, I would update the Intel Storage driver, it used to cause a number of issues with Windows 7 systems, so it would be no surprise if it were causing issues with Windows 8.x systems as well.

Rich (BB code):

2: kd> lmvm iaStorA
Browse full module list
start             end                 module name
fffff801`9a8ee000 fffff801`9aba8000   iaStorA  T (no symbols)           
    Loaded symbol image file: iaStorA.sys
    Image path: \SystemRoot\System32\drivers\iaStorA.sys
    Image name: iaStorA.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Aug  2 02:39:52 2013 (51FB0DE8)
    CheckSum:         000AC609
    ImageSize:        002BA000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Search

Search

I need a more knowledgeable set of eyes

SysWiz

New member

Attachments

Wrench97

Administrator, Hardware Expert

x BlueRobot

Administrator