Hallo,
I just had another blue screen with the message: Page-Fault-In-Nonpaged-Area.
The problem could have been caused by nv4_disp.dll. When the bluescrenn hit I was playing "Shrek 2-Team Action" with my son.
I've read and found quite a bit, but I don't know where to start to find the bug.
Page fault-in nonpaged area
-
-
Hello Exitus,
You have been with us for a while now and know the procedure in such cases. In order to be able to help you, we need a maximum of input, in other words:
What was precise in the blue screen? What was it? complete Message text, with all the frizzy columns of numbers and letters?How, you didn't write that down? Think about it next time! That simplifies the analysis. Well, all is not lost yet. Please have a look in the event display, you can find out how this works, for example here: https://www.win-tipps-tweaks.de/forum/tipps-tr…e-eventids.html
Are there any entries for the time of the blue screen under the heading "System" or "Applications" that are marked as "Errors"? Just post what you find there.
You should find at least one entry with the ID 1001 or something similar to this one:
--Event ID: 1001 Source: Save Dump Description: The computer has rebooted from a bugcheck.The bugcheck was : 0xc000000a (0xa1270184, 0x00000003, 0x00000000, ...). Microsoft Windows..... [B]A dump was saved in: .......[/B]
The minidump mentioned in it in the folder \ windows \ minidump you should take a look; its content provides further information about the cause of the error.Event ID 1003 could also be found instead.
--Event ID: 1003 Event Source: System Error Event Category: (...) Description: Error code 1000007f, parameter1 00000000, parameter2 00000000, parameter3 00000000, parameter4 00000000
The error code with its parameters would then be interesting.
Post the results of your research and we'll see.
Regards
Spark pluck. -
Hallo,
sorry for not posting everything, but i was pretty pissed off at the tech at that moment because i couldn't find anything useful in the event viewer.
I only wrote down the following: Address BF 173 BA7 base at BF012000 Datestamp 4410c8d4
STOP 0x00000050
At the time of the blue screen there are no error messages in the "System" event viewer.
Only one is listed in the "Applications" event viewer> Application Error (event ID 1000 failed application iexplore.exe, version 6.0.2900.2180)
There was also an error message, which occurred 4 hours before, but did not reboot the computer. -
Hallo,
to your darning mistake: http://www.jasik.de/shutdown/stop_fehler.htm#05 -
OK, Microsoft states here in the bug check codes http://msdn.microsoft.com/library/en-us/….asp?frame=true exactly four possibilities as the cause of this error:
-Defective hardware, mostly RAM -> Run Memtest86 from
-Corrupted system services --> Start sfc /scanonce at the command prompt
If nothing is found, you have to examine the services individually.
-Corrupt NTFS volume: Run chkdsk /f at the command prompt
- Some Antivirus programs can also cause the error.Regards
Spark pluck. -
Quote from Funkenzupfer
-Defective hardware, mostly RAM -> Run Memtest86 from
I'll do it at the end, because this test takes a long time.
Quote-Corrupted system services --> Start sfc /scanonce at the command prompt
If nothing is found, you have to examine the services individually.
What kind of error should be listed there? How do you check the individual services? (Double click on them?)
Quote-Corrupt NTFS volume: Run chkdsk /f at the command prompt
What does this mean exactly?
Quote- Some Antivirus programs can also cause the error.
I have Antivir PE Classic, I would want to check it out first, what can I do?
Finally: I am surprised that the message on the blue screen was that nv4_disp.dll could have been the cause of the problem, i.e. a driver error. -
Quote from Funkenzupfer
-Corrupted system services --> Start sfc /scanonce at the command prompt
If nothing is found, you have to examine the services individually.
For me it went via Start> Accessories> Command Prompt> Computer rebooted> after the prompt, the CD inserted> Check> No report.
How can I check the individual services now?
Quote-Corrected NTFS volume: Run chkdsk /f at the command prompt
I did> rebooted the computer> checked> then came a very brief report in which I only read something with volume that it may have been corrected. -
The hard drive test seems to have found a problem. (What was the message exactly?) So I would now assume that you have found the cause of the BSOD with it, and will simply continue to monitor the system in the near future. Only if the error occurs again would I take the further steps suggested by Microsoft.
Testing system services individually is a time-consuming business. Microsoft recommends the following:
Quote from MicrosoftResolving a faulty system service problem: Disable the service and confirm that this resolves the error. If so, contact the manufacturer of the system service about a possible update. If the error occurs during system startup, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.
You exclude the antivirus program as the cause by deactivating or temporarily uninstalling it. If the error no longer occurs, that was the source of the error. Unfortunately, there is no other way to find out.
But as I said, I would first wait and see whether the problem shows up again at all.
Regards
Spark pluck. -
Quote from Funkenzupfer
The hard drive test seems to have found a problem. (What was the message exactly?)
Hallo,
That is the "problem". The report could be seen for 1-2 seconds and whoosh it was gone. It was a coincidence that I looked at the screen at the right time.
Should I still do the Memtest86? -
Quote
Should I still do the Memtest86?
It can't do any harm. I would do it, then I can rule out physical memory errors if the problem occurs again. Unfortunately, you cannot use it to check video memory and L2 cache.Regards
Spark pluck. -
Quote from Funkenzupfer
But as I said, I would first wait and see whether the problem shows up again at all.
Hallo,
only the following stop message appeared while a CD was being burned:
Stop:0x0000008E(0xC0000005,0xBF82F5DD,0xECA7F5C8,0x00000000)
win32k.sys.
Address BF82F500 base at BF800000 Datestamp43446a58
In the "System" event viewer there is "only" one warning at the time the blue screen came: Event ID 4226> TCT / IP has reached the security limit set for the number of simultaneous TCP connection attempts.
Otherwise there are no error messages. I'm slowly despairing.
I almost forgot to mention something: When I rebooted the computer and the start screen appeared, it went dark for about 2 seconds and the screen resolution changed automatically. -
Exceeded the limit for the number of TCP / IP connections?
If you don't have a plausible explanation for this (excessive surfing, file sharing software ...) it smells suspiciously like a trojan ... do ours quickly Security check...
Regards
Spark pluck. -
Hallo,
All right, I'll do the security check and get back to you with the results. -
Hallo,
here is an intermediate result:
The online scan only found spyware >> SPYWARE_KEYL_ASTLOG
and here my hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 16: 51: 03, on 14.06.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running Processes:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ winlogon.exe
C: \ WINDOWS \ system32 \ services.exe
C: \ WINDOWS \ system32 \ lsass.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ WINDOWS \ Explorer.EXE
C: \ WINDOWS \ system32 \ Spoolsv.exe
C: \ Program Files \ AntiVir PersonalEdition Classic \ sched.exe
C: \ Program Files \ AntiVir PersonalEdition Classic \ avguard.exe
C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ StarWind \ StarWindService.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ Program Files \ eMule \ emule.exe
C: \ Program Files \ Internet Explorer \ iexplore.exe
C: \ Documents and Settings \ Donald Duck \ Desktop \ IEXPLORE.EXE
C: \ Documents and Settings \ Donald Duck \ Desktop \ IEXPLORE.EXE
C: \ Documents and Settings \ Donald Duck \ Desktop \ Accessories \ HijackThis.exe
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = https://www.win-tipps-tweaks.de/cms
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings, ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C: \ Programs \ Adobe \ Acrobat 7.0 \ ActiveX \ AcroIEHelper.dll
O2 - BHO: (by name) - {53707962-6F74-2D53-2644-206D7942484F} - C: \ PROGRA ~ 1 \ SPYBOT ~ 1 \ SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C: \ Program Files \ Java \ jre1.5.0_06 \ bin \ ssv.dll
O4 - HKLM \ .. \ Run: [NeroFilterCheck] C: \ WINDOWS \ system32 \ NeroCheck.exe
O4 - HKLM \ .. \ Run: [SiSSetCDfmt] C: \ WINDOWS \ system32 \ SetCDfmt.exe
O4 - HKLM \ .. \ Run: [Adobe Photo Downloader] "C: \ Programs \ Adobe \ Photoshop Album Starter Edition \ 3.0 \ Apps \ apdproxy.exe"
O4 - HKLM \ .. \ Run: [NvCplDaemon] RUNDLL32.EXE C: \ WINDOWS \ system32 \ NvCpl.dll, NvStartup
O4 - HKLM \ .. \ Run: [KernelFaultCheck]% systemroot% \ system32 \ dumprep 0 -k
O4 - HKCU \ .. \ Run: [MSMSGS] "C: \ Program Files \ Messenger \ msmsgs.exe" / background
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C: \ Programs \ Adobe \ Acrobat 7.0 \ Reader \ reader_sl.exe
O8 - Extra context menu item: Export to Microsoft &Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\http://EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C: \ Program Files \ Java \ jre1.5.0_06 \ bin \ ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C: \ Program Files \ Java \ jre1.5.0_06 \ bin \ ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C: \ PROGRA ~ 1 \ MICROS ~ 2 \ OFFICE11 \ REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C: \ Program Files \ Messenger \ msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C: \ Program Files \ Messenger \ msmsgs.exe
O9 - Extra button: Click here to support the xp-AntiSpy project - {2D848379-E70A-40B3-B8C1-106CBB702A80} - C: \ Programs \ xp-AntiSpy \ sponsoring \ sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Support for xp-AntiSpy - {2D848379-E70A-40B3-B8C1-106CBB702A80} - C: \ Program Files \ xp-AntiSpy \ sponsoring \ sponsor.html (HKCU)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1130584945756
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C: \ Program Files \ AntiVir PersonalEdition Classic \ sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C: \ Programs \ AntiVir PersonalEdition Classic \ avguard.exe
NVIDIA Corporation - C: \ WINDOWS \ system23 \ nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ StarWind \ StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C: \ Programs \ TuneUp Utilities 2006 \ WinStylerThemeSvc.exe -
Hi,
Jam error ... 8E: http://www.jasik.de/shutdown/stop_fehler.htm#8EI guess that's caused by the NVIDIA driver.
-
You could be right with the Nvidia driver, halloween, at least as far as the first crash as far as Exitus was concerned. I would now update the graphics driver or reload it.
But where do these many TCP / IP connections that were logged the last time the crash came from? A few things are noticeable in the Hijack-This log: iexplore.exe is not in its correct directory, but on a user's desktop, under C: \ Documents and Settings \ Donald Duck \ Desktop \ IEXPLORE.EXE. There shouldn't be an executable file of the MSIE, just a link. So that could possibly not be the real Internet Explorer, especially since an instance of the Internet Explorer is running in the "correct" directory (C: \ Programs \ Internet Explorer \ iexplore.exe) at the same time. On the other hand, Exitus, you had this entry earlier in the hijackthis-log, which hyrican had evaluated here at the time. Still, I would check it out.
He already wrote you something about the entry for C: \ WINDOWS \ system32 \ SetCDfmt.exe.Otherwise the whole thing looks pretty inconspicuous to me.
Since this time it happened while burning, and not during a graphics-intensive application (game or similar), I would now consider the memory test, even if it takes a long time.Regards
Spark pluck -
Quote from Funkenzupfer
On the other hand, Exitus, you had this entry earlier in the hijackthis-log, which hyrican had evaluated here at the time. Still, I would check it out.
He already wrote you something about the entry for C: \ WINDOWS \ system32 \ SetCDfmt.exe.
What do you mean? How and what should I check exactly?
Quote from Funkenzupfer..., I would now consider the memory test, even if it takes a long time.
You mean the Memtst86?
Quote from HelloweenI guess that's caused by the NVIDIA driver.
I have the latest driver (84.21). I also believe that this is producing the errors since I installed it for a game. I had no problems before.
Where can I get the older driver that is also stable?
Finally, I would like to address the problem with the screen resolution again, which changes automatically every time the computer is restarted.
What can it be and how can I get a grip on it? -
Hi,
QuoteI have the latest driver (84.21).
But it's not always the best!
Maybe a system restore? There is a lot going on anyway !!
-