Solved

Page Fault in Non Paged area

Posted on 2006-11-27
17
1,312 Views
Last Modified: 2013-11-15
Had the error above twice now on a new machine. It has been working perfectly fine for 3 months now and we have another 9 identical machines that do not have this issue. We have installed no new programs or hardware.

The error message in the blue screen mentions no particular driver, but does give the following codes:

0X00000050 (0XE532C008, 0X00000000, 0X8052D8F7, 0X00000001)

I have run all of Dell's diagnostics (including memory/cache/CPU/disk tests), all report back fine. My gut feeling is that it is a RAM issue, but as the tests seemed to indicate that the hardware is fine, I am at a loss.

I have looked at several other posts regarding this message, but they all seem to have a systeem driver mentioned in the error message.

Can anyone help?

Thanks
0
Comment
Question by:5t34lth_G33k
  • 8
  • 6
  • 2
  • +1
17 Comments
 
LVL 32

Expert Comment

by:and235100
ID: 18017943
Use memtest86 (http://www.memtest86.com/) to test your memory.

Do several passes (leave it overnight)
0
 
LVL 32

Expert Comment

by:and235100
ID: 18017965
Memtest should indicate if your memory is bad.

You might also check the amount of Virtual Memory you have set.

In Windows, go to start, control panel, d-click System.

Go to Advanced tab, and click the Settings button under Performance.

Click the Advanced tab - and hit the Change button at the bottom.

Check that you have 1.5x the physical memory you have set as both minimum and maximum values as virtual memory.

e.g. - 1Gb physical memory - 1535MB virtual memory

0
 
LVL 7

Author Comment

by:5t34lth_G33k
ID: 18018025
OK, I will give it a try later. Regarding memtest, I have found it in the past to give errors even when there are none, purely because it is quite old and doesnt support some of the latest motherboards/memory types.

The machine has 2GB of RAM and the page file is set to auto size between 2GB and 4GB. It currently only has allocated 2GB.
0
 
LVL 21

Expert Comment

by:shuboarder
ID: 18018198
System Restore:

If you can recall a time when you were not getting the blue screen, you might want to try a system restore point.
Start >> All Programs >> Accessories >> System Tools >> System Restore

The good thing about this is it is fully reversible, so if you restore to a previous point in time and it doesn't work, you can easily undo the changes.

This should rule out any driver issues...

If you continue to see a blue screen after this, then it will more than likely be a hardware issue, and yes you are correct, this error usually indicates a RAM problem.

Good luck!
0
 
LVL 7

Author Comment

by:5t34lth_G33k
ID: 18018254
good thinking shu, but will this restore the users desktop/settings etc to the specified date?
0
 
LVL 7

Author Comment

by:5t34lth_G33k
ID: 18018279
only reason I ask is that we have several trading programs that store all their user files in the program files directory. If these were rolled back to the specified date it would be disastrous!
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 18025591
Windows crash with bugcheck code 50 may be caused by faulty ram or device driver error (ie video, sound card, modem and etc). The system event log and the minidump has the most useful diagnostic information. When Windows crashes with blue screen, it writes a system event 1001 or 1003 and a minidump to the folder \windows\minidump. Check system event 1001 and 1003 and it has the detail of the blue screen.

Event ID: 1001
Source: Save Dump
Description:
The computer has rebooted from a bugcheck.The bugcheck was : 0xc000000a (0xe1270188, 0x00000002, 0x00000000, 0x804032100).
Microsoft Windows..... A dump was saved in: .......

Event Source: System Error
Event Category: (102)
Event ID: 1003
Description:
Error code 1000007f, parameter1 0000000d, parameter2 00000000, parameter3 00000000, parameter4 00000000

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001/1003. Copy the content and paste it back here

Zip 5 to 6 minidumps to a zip file and attach it at any webspace. I will study the dump and find out the culprit. If you can't provide the minidumps, run memtest to stress test the ram. Make sure that your windows is not infected with spyware, adware adn chkdsk /r.
http://www.memtest86.com/.

Get public webspace
Use a free service like rapidshare to attach the minidumps and post the url of the mimidumps at this thread.
http://www.rapidshare.de/
0
 
LVL 7

Author Comment

by:5t34lth_G33k
ID: 18026036
WOW that would be great! http://www.clogroup.com/Minidump.zip

There are only 2 in there, only 2 we have.

Could you point me to a link that tells you how to read those dumps?

Many thanks

0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 7

Author Comment

by:5t34lth_G33k
ID: 18026072
While we are still looking into it, would it be a good precaution to reinstall all the device drivers?
0
 
LVL 20

Accepted Solution

by:
cpc2004 earned 500 total points
ID: 18026613
Hi,

Both dumps are crashed with exactly the reason and the running process is update.exe. Serach goggle and update.exe is Spyware Doctor Internet Security Product. Un-install update.exe may resolve the blue screen problem


Mini112106-01.dmp BugCheck 10000050, {e6167008, 0, 8052d8f7, 1}
Owning Process            88d567d0       Image:         Update.exe
Probably caused by : ntkrpamp.exe ( nt!KiFastCallEntry+fc )

Mini112706-01.dmp BugCheck 10000050, {e532c008, 0, 8052d8f7, 1}
Owning Process            88a39650       Image:         Update.exe
Probably caused by : ntkrpamp.exe ( nt!KiFastCallEntry+fc )

cpc2004
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 18026661
Hi,

Refer the following webpage for minidump analysis.
http://www.jsifaq.com/SF/Tips/Tip.aspx?id=4981

However the minidump is easy but it is difficult to interpret the debug report.

cpc2004
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 18026706
Hi,

One confirmed case at this forum, windows automatic update causes blue screen. Disable windows automatic update if it is enabled.

cpc2004
0
 
LVL 7

Author Comment

by:5t34lth_G33k
ID: 18026743
We have Lightspeed Systems Anti virus/spyware blocker that also has its own update.exe process - is ther enay way of telling which update.exe caused the BSOD?
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 18026757
Hi,

Your dump is a minidump. It only have kernel address space and it does not have information from user address space. The update.exe is running at user address space hence I don't know what version of update.exe are executing when blue screen occurs.

Use dump option to kernel dump and the dump size will be between 50 to 100MB and it is too big to download.

cpc2004
0
 
LVL 7

Author Comment

by:5t34lth_G33k
ID: 18027691
CPC2004 - i have set the dump option to Kernal dump. If it is not too big if/when it happens again I will try to post it here and analyse myself. When I have found which update.exe has caused the issues, I will post back here and award points
0
 
LVL 7

Author Comment

by:5t34lth_G33k
ID: 18028993
Does this mean that the IPMSecurityAgent2.sys driver caused the error?



Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\dump.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\windows\symbols
Executable search path is: c:\windows\i386
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Tue Nov 21 11:56:24.875 2006 (GMT+0)
System Uptime: 46 days 18:42:38.908
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
Unable to load image IpmSecurityAgent2.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for IpmSecurityAgent2.sys
*** ERROR: Module load completed but symbols could not be loaded for IpmSecurityAgent2.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e6167008, 0, 8052d8f7, 1}


Could not read faulting driver name
Probably caused by : IpmSecurityAgent2.sys ( IpmSecurityAgent2+6cb6 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e6167008, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8052d8f7, If non-zero, the instruction address which referenced the bad memory
      address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  e6167008

FAULTING_IP:
nt!IoCreateStreamFileObjectEx+124
8052d8f7 f266af          repne scas word ptr es:[edi]

MM_INTERNAL_CODE:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  Update.exe

LAST_CONTROL_TRANSFER:  from ab256cb6 to 8052d8f7

STACK_TEXT:  
b7357cec ab256cb6 e4584120 00000077 886429c3 nt!IoCreateStreamFileObjectEx+0x124
WARNING: Stack unwind information not available. Following frames may be wrong.
b7357d64 7c90eb94 badb0d00 0012fa90 ab22bd98 IpmSecurityAgent2+0x6cb6
b7357d68 badb0d00 0012fa90 ab22bd98 ab22bdcc 0x7c90eb94
b7357d6c 0012fa90 ab22bd98 ab22bdcc 00000000 0xbadb0d00
b7357d70 ab22bd98 ab22bdcc 00000000 00000000 0x12fa90
b7357d74 ab22bdcc 00000000 00000000 00000000 <Unloaded_kmixer.sys>+0x5d98
b7357d78 00000000 00000000 00000000 00000000 <Unloaded_kmixer.sys>+0x5dcc


STACK_COMMAND:  kb

FOLLOWUP_IP:
IpmSecurityAgent2+6cb6
ab256cb6 ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  IpmSecurityAgent2+6cb6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: IpmSecurityAgent2

IMAGE_NAME:  IpmSecurityAgent2.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4552250e

FAILURE_BUCKET_ID:  0x50_IpmSecurityAgent2+6cb6

BUCKET_ID:  0x50_IpmSecurityAgent2+6cb6

Followup: MachineOwner
---------

0
 
LVL 20

Expert Comment

by:cpc2004
ID: 18033735
Hi,

You do not specify the symbol file path, hence the debug report is incomplete.
>>>
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
>>>

Use the following command to setup the symbol file within windbg

File --> Symbol File Path --> srv*c:\websymbols*http://msdl/microsoft.com/download/symbols

0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Storage devices are generally used to save the data or sometime transfer the data from one computer system to another system. However, sometimes user accidentally erased their important data from the Storage devices. Users have to know how data reco…
How to update Firmware and Bios in Dell Equalogic PS6000 Arrays and Hard Disks firmware update.
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now