Question BSOD PAGE_FAULT_IN_NONPAGED_AREA or MEMORY_MANAGEMENT

[Kermel]

Hello,
I have been recently experiencing problems with my older lenovo laptop. Almost every day (when the computer wakes up) I have a bluescreen or two before it can be used normally.

Tried googling around, checking the minidumps and memory dumps by "WhoCrashed", "BlueScreenView" or "WinDbg" but I wasn't able to figure out where the problem is.
(Always it points to the ntoskrnl.exe :-/).

Could anybody be more lucky and help me checking those dumps?

Link to download the minidumps: Minidumps.zip

(I could provide the memory.dmp too, if needed but this one is quite large - 1,5GB, xzipped around 396MB :-/)

Many thanks in advance...

Ondrej

Few details about the machine (available in the minidumps too):

BUILD_VERSION_STRING: 7601.24444.amd64fre.win7sp1_ldr_escrow.190429-1700
SYSTEM_MANUFACTURER: LENOVO
SYSTEM_PRODUCT_NAME: 20AA000EMC
SYSTEM_SKU: LENOVO_MT_20AA
SYSTEM_VERSION: ThinkPad T431s
BIOS_VENDOR: LENOVO
BIOS_VERSION: GHET42WW (1.27 )

 

[Colif]

well, ntoskrnl is a common fall guy, its the windows kernel. I will get someone to check dump files for you.

minidumps are good enough in most cases.

have you gone here and clicked automatic driver updates - I believe this is right model - https://pcsupport.lenovo.com/au/en/...pad-t-series-laptops/thinkpad-t431s/downloads

lol. typical, I see SYSTEM_VERSION: ThinkPad T431s after searching for the product name code.

 

[Kermel]

Hello, yes, the drivers are up-to date, I even recently updated the bios.

thank you

 

[Satan-IR]

The first dump (010819-65614-01.dmp) is a 3B bugcheck file points to a system service svchost.exe and two drivers are named. Those two are BHDrvx64.sys and SYMEVENT64x86.SYS

I think those two are drivers used by a Symantec product maybe Norton anti-virus? The SYMEVENT module is from 2012. So maybe an update if available might help with that.

- - -

The second dump file (011119-57798-01.dmp) is a 50 bugcheck also can be caused by anti-virus or corruption in the NTFS volume/file system. The process named here is Chrome.exe. This could also mean the anti-virus

I would suggest you run sfc /scannow from an elevated command prompt (Right click cmd and click Run as administrator) to check for error in the NTFS file system.

- - -

The third dump (011719-52463-01.dmp) is a D1 bugcheck. Also a driver issue when it access memory addresses it should not.
Process is ccSvcHst.exe and driver is NETIO.SYS. I think that process is also a Symentec file.

I can't go through all of the dumps right now but I kind of have a hunch a large proportion of them would be caused by the Norton software as well. See if updating the Symantec security package/suite would help.

 

[gardenman]

I ran the next 10 dump files through the debugger and got the following results: https://pste.eu/p/chd4.html

Spoiler

File information:	031719-39530-01.dmp (Mar 17 2019 - 16:54:42)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: OUTLOOK.EXE)
Uptime:	2 Day(s), 13 Hour(s), 09 Min(s), and 29 Sec(s)

File information:	031519-36410-01.dmp (Mar 15 2019 - 03:44:37)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: idea64.exe)
Uptime:	7 Day(s), 23 Hour(s), 37 Min(s), and 02 Sec(s)

File information:	030719-33150-01.dmp (Mar 7 2019 - 04:06:50)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: devenv.exe)
Uptime:	3 Day(s), 13 Hour(s), 36 Min(s), and 51 Sec(s)

File information:	030319-19718-01.dmp (Mar 1 2019 - 19:55:19)
Bugcheck:	SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)
Probably caused by:	memory_corruption (Process: System)
Uptime:	1 Day(s), 12 Hour(s), 36 Min(s), and 57 Sec(s)

File information:	022819-39593-01.dmp (Feb 28 2019 - 03:22:47)
Bugcheck:	IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:	memory_corruption (Process: svchost.exe)
Uptime:	0 Day(s), 23 Hour(s), 49 Min(s), and 00 Sec(s)

File information:	022719-15802-01.dmp (Feb 26 2019 - 13:17:27)
Bugcheck:	IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:	memory_corruption (Process: System)
Uptime:	1 Day(s), 9 Hour(s), 06 Min(s), and 41 Sec(s)

File information:	021919-12261-01.dmp (Feb 19 2019 - 03:36:56)
Bugcheck:	PAGE_FAULT_IN_NONPAGED_AREA (50)
Probably caused by:	memory_corruption (Process: svchost.exe)
Uptime:	4 Day(s), 9 Hour(s), 21 Min(s), and 32 Sec(s)

File information:	020819-39312-01.dmp (Feb 8 2019 - 03:48:56)
Bugcheck:	PAGE_FAULT_IN_NONPAGED_AREA (50)
Probably caused by:	memory_corruption (Process: firefox.exe)
Uptime:	0 Day(s), 22 Hour(s), 10 Min(s), and 18 Sec(s)

File information:	013019-39437-01.dmp (Jan 30 2019 - 03:13:56)
Bugcheck:	IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:	memory_corruption (Process: svchost.exe)
Uptime:	4 Day(s), 15 Hour(s), 25 Min(s), and 13 Sec(s)

File information:	012119-34741-01.dmp (Jan 21 2019 - 15:20:33)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: devenv.exe)
Uptime:	2 Day(s), 22 Hour(s), 52 Min(s), and 54 Sec(s)

Comment: 2 or more types of RAM are installed.

Comment: This appears to be a older system with 25+ drivers on it that I've never seen. I'll try to get descriptions for a few of these drivers and update this post when possible.

Additional driver info:

Spoiler

btmaux.sys - Intel PROSetWireless Bluetooth Auxiliary driver
btmhsf.sys - Bluetooth Filter driver (Motorola Solutions, Inc.)
dne64x.sys - Deterministic Network Enhancer driver
DzHDD64.sys - Doze Mode Kernel Driver for HDD control driver (Lenovo)
e1c62x64.sys - Intel(R) Gigabit Network Connection driver
irstrtdv.sys - Intel® Rapid Start Technology Service driver
l36wgps64.sys - F3607gw Mobile Broadband GPS Port driver
Mbm3CBus.sys - F3607gw Mobile Broadband Device driver
Mbm3DevMt.sys - F3607gw Mobile Broadband Device Management driver
Mbm3mdfl.sys - F3607gw Mobile Broadband Modem Port Filter driver
Mbm3Mdm.sys - F3607gw Mobile Broadband Modem Port WDM driver
Mbm3cm.sys - F3607gw Mobile Broadband Device driver
Mbm3wh.sys - F3607gw Mobile Broadband Device driver
NETwsw01.sys - Intel Wireless WiFi Link Adapter driver
pangpd.sys - Palo Alto Networks driver
psadd.sys - Lenovo PSA driver
risdxc64.sys - RICOH PCIe SDXC/MMC Controller driver
smihlp.sys - SMI helper driver (Authentec Inc.)
SYMDS64.SYS - Symantec Data Store 64-Bit driver (Symantec) http://www.symantec.com/
SYMEFA64.SYS - Symantec Extended File Attributes 64-bit driver
truecrypt.sys - TrueCrypt driver
Tvti2c.sys - Lenovo SMBUS driver
tvtvcamd.sys - ThinkVantage Virtual Camera driver
VBoxNetFlt.sys - VirtualBox Bridged Networking Service Filter driver
WwanUsbMp64.sys - Ericsson WWAN Wireless Module Device driver
wwuss64.sys - Ericsson WWAN driver
wwussf64.sys - Ericsson WWAN Selective suspend Filter driver

System page: https://www.lenovo.com/us/en/laptops/thinkpad/t-series/t431s/

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

NETIO.SYS. I think that process is also a Symentec file.

nah, Netio.sys is actually part of windows, it is the Network Input output driver. Its close enough though as they all lan related.

op should update network drivers, though which is a good question, could be Ericsson wwan or the mobile broadband modem

 

[Satan-IR]

nah, Netio.sys is actually part of windows, it is the Network Input output driver. Its close enough though as they all lan related.

op should update network drivers, though which is a good question, could be Ericsson wwan or the mobile broadband modem

Yes I know netio.sys is a system driver. In the sentence before that I said the process is *.exe and the driver is netio.sys. Next I said the process is a Symantec file; not to repeat the name again.

I wanted to highlight that the Symantec product is probably a major part of this plethora of crashes and stops since its processes and drives are named in some of the dumps.

I agree a majority of the issues in the dumps gardenman and I ran, seems to involve the networking and the security software and browsers; so the common ground is networking/internet functionality. Updating networking drivers is a very good pointer.

Also I have seen a variety of weird behavior by Symantec products throughout the years. I, personally, would remove that and use Windows defender or Malwarebytes or other third party applications. I guess I would try updating the drivers first though.

 

[Colif]

taking norton off and seeing if you still get BSOD is another valid answer.

I prefer bitdefender but thats after using paid versions of AV for 15 years and working out what not to use. everyone has to figure it out for themselves

 

[Kermel]

Thanks to all for your remarks and comments. Tomorrow I'm setting of for a vacation but after I return I will definitely look into the networking-related drivers and maybe also try to get rid of the Symantec antivirus
(what I already noticed is that it consumes enormous amounts of my disk space with lots of old definitions and stuff like that).

Also one funny story - I was programming a simple smtp client to send mails using common used .NET libraries but was not able to get the mail to the recipients (weird exceptions occured), after some headbanging I discovered that it is Symantec network protection that cuts off the mail communication from my code without bothering to log or inform about such action (of course all other mail clients including Outlook etc. are working normally). So whenever I needed to test my code, I had to switch the network protection off (not even setting any whitelists helped).
So thats for Symantec :-D