[SOLVED] Need Help / BSOD: PAGE_FAULT_IN_NONPAGED_AREA

[MekiPrime]

Hey everyone,

I have now looked around here for a really long time to fix this error, but no success. I have now already tried a few things, I like to try everything again and report on each step, but maybe I'm doing something wrong.

It's about the above-mentioned bluescreen that occurs more often BUT mostly only in a game "Dead by Daylight".
As soon as I play the game, my computer crashes after a few minutes with the BSOD "PAGE_FAULT_IN_NONPAGED_AREA".
Now I have also reinstalled the game, no success. In other games like "Escape from Tarkov" (which requires more power) this never happens, only in Dead by Daylight.

I have bought new memory and still the error occurs. I don't know anymore if I set something wrong in the BIOS or "overclocked". No idea more. I'm not really a fan of overclocking, so I couldn't imagine that.

My system:
CPU: Intel Core i7-9700K @ 3.60 GHz
Sys: Windows 11
RAM: 32 GB
1. SSD: 1TB
2ND SSD: 500GB
GPU: Aorus GeForce RTX 2070 Super

Then here's some analysis from WhoCrashed. (From today the BSOD Crash)

And here from my Taskmanager:

Would really appreciate your help.


Best,

 

[Colif]

1. Open Windows File Explore
   
2. Navigate to C:\Windows\Minidump
   
3. Copy the mini-dump files out onto your Desktop
   
4. Do not use Winzip, use the built in facility in Windows
   
5. Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
   
6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
   
7. Then post a link here to the zip file, so we can take a look for you . . .
   

 

[MekiPrime]

1. Open Windows File Explore
2. Navigate to C:\Windows\Minidump
3. Copy the mini-dump files out onto your Desktop
4. Do not use Winzip, use the built in facility in Windows
5. Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
7. Then post a link here to the zip file, so we can take a look for you . . .

Here I hope this is the right one:
One Drive Dump File (zip)

 

[Colif]

I have to ask a friend to convert dumps, he will reply later but he might be busy today. There is a chance someone else might look at it before then.

 

[johnbl]

looks like
C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys Sun Mar 6 18:17:48 2022

ended up trying to access a memory location that was invalid and the memory manager tried to page it in. This is most likely just going to be a timing issue due to your bogus copies of overclocking software.

download autoruns from here:https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

delete the entries for these two drivers:
C:\Program Files (x86)\MSI\Dragon Center\Lib\Super_Charger\NTIOLib_X64.sys Sun Jul 9 19:11:47 2017

C:\Program Files (x86)\MSI\Dragon Center\Mystic_Light\Lib\NTIOLib_X64.sys Sun Jul 9 19:13:57 2017

then reboot. I will take a quick look for other issues
delete this one also:
\SystemRoot\System32\drivers\iocbios2.sys Mon Sep 16 14:12:27 2019

I would also get rid of these two ipad charger drivers:
C:\ProgramData\MSI\Super_Charger\ipadtst2_64.sys Fri Jul 29 02:16:56 2016

C:\ProgramData\MSI\Super_Charger\ipadtst_64.sys Mon Nov 11 00:10:23 2013

most likely one is just a old version of the other. Also, you most likely don't need to charge your ipad via the pc usb port.

i would also dump this driver
C:\Program Files (x86)\MSI\Dragon Center\Mystic_Light\MODAPI.sys Sat Jul 26 06:29:37 2008

if you really want the light effect, you should down load and install the current version from the motherboard vendors website.

overall, I would clean up the drivers, then install current versions if I really needed some lost functionality.

you should also see if you can update the motherboard bios. I was unable to read the bios info in the debugger. Generally this mean you have a very old bios since the specifications were changes so long ago.

most likely cause of this bugcheck would be the three overclocking drivers installed.
I could not read the cpu speed to confirm strange overclock values.

other causes would be the storage driver but it looks like you should be ok. (not likely)

you could have a storage device that has problems:
you can download and run crystaldiskinfo.exe to read the drives smart data to see the drive health.
(generally you would get a different internal error code)

 

[MekiPrime]

looks like
C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys Sun Mar 6 18:17:48 2022

ended up trying to access a memory location that was invalid and the memory manager tried to page it in. This is most likely just going to be a timing issue due to your bogus copies of overclocking software.

download autoruns from here:https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

delete the entries for these two drivers:
C:\Program Files (x86)\MSI\Dragon Center\Lib\Super_Charger\NTIOLib_X64.sys Sun Jul 9 19:11:47 2017

C:\Program Files (x86)\MSI\Dragon Center\Mystic_Light\Lib\NTIOLib_X64.sys Sun Jul 9 19:13:57 2017

then reboot. I will take a quick look for other issues
delete this one also:
\SystemRoot\System32\drivers\iocbios2.sys Mon Sep 16 14:12:27 2019

I would also get rid of these two ipad charger drivers:
C:\ProgramData\MSI\Super_Charger\ipadtst2_64.sys Fri Jul 29 02:16:56 2016

C:\ProgramData\MSI\Super_Charger\ipadtst_64.sys Mon Nov 11 00:10:23 2013

most likely one is just a old version of the other. Also, you most likely don't need to charge your ipad via the pc usb port.

i would also dump this driver
C:\Program Files (x86)\MSI\Dragon Center\Mystic_Light\MODAPI.sys Sat Jul 26 06:29:37 2008

if you really want the light effect, you should down load and install the current version from the motherboard vendors website.

overall, I would clean up the drivers, then install current versions if I really needed some lost functionality.

you should also see if you can update the motherboard bios. I was unable to read the bios info in the debugger. Generally this mean you have a very old bios since the specifications were changes so long ago.

most likely cause of this bugcheck would be the three overclocking drivers installed.
I could not read the cpu speed to confirm strange overclock values.

other causes would be the storage driver but it looks like you should be ok. (not likely)

you could have a storage device that has problems:
you can download and run crystaldiskinfo.exe to read the drives smart data to see the drive health.
(generally you would get a different internal error code)

So thank you for all your advice.

I have deleted the files, which you recommended.

Then I did a BIOS update. My BIOS was from 2019, now I have the latest BIOS (+ support WIN 11 /2021).

I also reset all the settings in the BIOS to "default". Maybe I still had something "overclocked".

The only problem I have is all the drivers, I don't know where to remove them completely so I can reinstall them.

However, I honestly noticed that my computer is running fine for now with the tips you mentioned. Have also directly started the game "Dead by Daylight" and so far no bluescreen.

I wait the days times, as it runs so, let's see when the next blue screen appears. I hope not at all.

 

[Colif]

The only problem I have is all the drivers, I don't know where to remove them completely so I can reinstall them.

which ones?

then reboot. I will take a quick look for other issues
delete this one also:
\SystemRoot\System32\drivers\iocbios2.sys Mon Sep 16 14:12:27 2019

this is part of Intel extreme tuning utility so remove that.

the MSI apps might appear in Add/remove apps list

 

[MekiPrime]

which ones?


this is part of Intel extreme tuning utility so remove that.

the MSI apps might appear in Add/remove apps list

Thy, I found everything and I delete it too

Everyting until now fine

 

[MekiPrime]

looks like
C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys Sun Mar 6 18:17:48 2022

ended up trying to access a memory location that was invalid and the memory manager tried to page it in. This is most likely just going to be a timing issue due to your bogus copies of overclocking software.

download autoruns from here:https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

delete the entries for these two drivers:
C:\Program Files (x86)\MSI\Dragon Center\Lib\Super_Charger\NTIOLib_X64.sys Sun Jul 9 19:11:47 2017

C:\Program Files (x86)\MSI\Dragon Center\Mystic_Light\Lib\NTIOLib_X64.sys Sun Jul 9 19:13:57 2017

then reboot. I will take a quick look for other issues
delete this one also:
\SystemRoot\System32\drivers\iocbios2.sys Mon Sep 16 14:12:27 2019

I would also get rid of these two ipad charger drivers:
C:\ProgramData\MSI\Super_Charger\ipadtst2_64.sys Fri Jul 29 02:16:56 2016

C:\ProgramData\MSI\Super_Charger\ipadtst_64.sys Mon Nov 11 00:10:23 2013

most likely one is just a old version of the other. Also, you most likely don't need to charge your ipad via the pc usb port.

i would also dump this driver
C:\Program Files (x86)\MSI\Dragon Center\Mystic_Light\MODAPI.sys Sat Jul 26 06:29:37 2008

if you really want the light effect, you should down load and install the current version from the motherboard vendors website.

overall, I would clean up the drivers, then install current versions if I really needed some lost functionality.

you should also see if you can update the motherboard bios. I was unable to read the bios info in the debugger. Generally this mean you have a very old bios since the specifications were changes so long ago.

most likely cause of this bugcheck would be the three overclocking drivers installed.
I could not read the cpu speed to confirm strange overclock values.

other causes would be the storage driver but it looks like you should be ok. (not likely)

you could have a storage device that has problems:
you can download and run crystaldiskinfo.exe to read the drives smart data to see the drive health.
(generally you would get a different internal error code)

It's me again,
so I got the same blue screen again today, even though I followed all the measures you gave me.

Any other tips?

Here are the new DumpFile in .zip
19.04.2022 - One Drive Dump File (zip)

 

[johnbl]

It's me again,
so I got the same blue screen again today, even though I followed all the measures you gave me.

Any other tips?

Here are the new DumpFile in .zip
19.04.2022 - One Drive Dump File (zip)

looks like easyanticheat.sys problem. it called some place in user memory that tried to call an address that was not in kernel memory. (address does look like a kernel address but was invalid)

I would update the driver and make sure you don't have something trying to hack it.
driver looks pretty new:
C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys Sun Mar 6 18:17:48 2022

this driver might be suspect. guess there are exploits that use it now.
i think it turns on light for RAM sticks
C:\Windows\system32\drivers\ene.sys Mon Mar 19 20:59:12 2018

also, fails driver verifier tests during boot.

 

[johnbl]

looks like easyanticheat.sys problem. it called some place in user memory that tried to call an address that was not in kernel memory. (address does look like a kernel address but was invalid)

I would update the driver and make sure you don't have something trying to hack it.
driver looks pretty new:
C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys Sun Mar 6 18:17:48 2022

this driver might be suspect. guess there are exploits that use it now.
i think it turns on light for RAM sticks
C:\Windows\system32\drivers\ene.sys Mon Mar 19 20:59:12 2018

also, fails driver verifier tests during boot.

both bugchecks show the same type of problem, easysanticheat.sys transfer control to a usermode address then back into easyanticheat.sys then the driver tries to use a kernel address not already in nonpaged pool. (not already in kernel memory) this is not allowed and caused the bugcheck.

this would be a programming mistake in the driver or malware attacking the driver. (more likely or there would be a lot more people having this bugcheck)

I would do a malware scan, remove the suspect driver, and reinstall the anticheat software. two bugchecks like this is not a random event.

info on driver exploit:
https://www.cvedetails.com/cve/CVE-2020-12446

 

[MekiPrime]

both bugchecks show the same type of problem, easysanticheat.sys transfer control to a usermode address then back into easyanticheat.sys then the driver tries to use a kernel address not already in nonpaged pool. (not already in kernel memory) this is not allowed and caused the bugcheck.

this would be a programming mistake in the driver or malware attacking the driver. (more likely or there would be a lot more people having this bugcheck)

I would do a malware scan, remove the suspect driver, and reinstall the anticheat software. two bugchecks like this is not a random event.

info on driver exploit:
https://www.cvedetails.com/cve/CVE-2020-12446

looks like easyanticheat.sys problem. it called some place in user memory that tried to call an address that was not in kernel memory. (address does look like a kernel address but was invalid)

I would update the driver and make sure you don't have something trying to hack it.
driver looks pretty new:
C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys Sun Mar 6 18:17:48 2022

this driver might be suspect. guess there are exploits that use it now.
i think it turns on light for RAM sticks
C:\Windows\system32\drivers\ene.sys Mon Mar 19 20:59:12 2018

also, fails driver verifier tests during boot.

Thank you for the tips.

I was able to completely uninstall EasyAntiCheat & the deletion of ene.sys, I also did several scans with different programs, no malware found.

I hope it works now ;D

 

[MekiPrime]

both bugchecks show the same type of problem, easysanticheat.sys transfer control to a usermode address then back into easyanticheat.sys then the driver tries to use a kernel address not already in nonpaged pool. (not already in kernel memory) this is not allowed and caused the bugcheck.

this would be a programming mistake in the driver or malware attacking the driver. (more likely or there would be a lot more people having this bugcheck)

I would do a malware scan, remove the suspect driver, and reinstall the anticheat software. two bugchecks like this is not a random event.

info on driver exploit:
https://www.cvedetails.com/cve/CVE-2020-12446

I'm sorry to disappoint you, exactly the same blue screen again.

I have uninstalled EasyAntiCheat, reinstalled it, checked for malware and deleted ene.sys.

Should I upload the DumpFile again. BUT it also only happens with Dead by Daylight, all other games with EasyAntiCheat (Rust, Elden Ring etc.) it doesn't happen, only with Dead by Daylight.

EDIT: Here the new MiniDump File
20.04.2022 - One Drive Dump File (zip)

 

[johnbl]

I'm sorry to disappoint you, exactly the same blue screen again.

I have uninstalled EasyAntiCheat, reinstalled it, checked for malware and deleted ene.sys.

Should I upload the DumpFile again. BUT it also only happens with Dead by Daylight, all other games with EasyAntiCheat (Rust, Elden Ring etc.) it doesn't happen, only with Dead by Daylight.

EDIT: Here the new MiniDump File
20.04.2022 - One Drive Dump File (zip)

stack was corruted but the raw stack shows that the calls came
EasyAntiCheat+0x3c947
to a bunch of code outside of normal drivers then to
this windows function
nt!MmGetVirtualForPhysical
which then got the page fault and resulted in the bugcheck.

looks like
C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys Sun Mar 6 18:17:48 2022
is still installed in the dump for
Wed Apr 20 03:06:20.232 2022

download and run autoruns from here:https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
locate the driver and disable or delete it.
then retest to see if you bugcheck.

this dump also shows the ene.sys driver.
I will re download in case I grabbed the wrong dump.
----------
nope: that was the one that was put up there 5 hours ago.
note: i just read a article on how malware is using this function to try to hack into the system.

so i would do the following:
download rammap from https://docs.microsoft.com/en-us/sysinternals/downloads/rammap
find the menu item that says empty and select them all.
you are trying to dump all the standby memory contents so malware can not hide there.

then go into control panel, and turn off your virtual memory
so when you reboot your pagefile.sys will be deleted. So malware can not hid in the pagefile.sys.

start cmd.exe as an admin then run
dism.exe /online /cleanup-image /restorehealth

reboot then go back into control panel and turn on the virtual memory again so your pagefile.sys is recreated.

I would also check to see what file filters you have installed on your machine. It is just a good place to hide malware.
start cmd.exe then run
fltmc.exe
here is what this windows 10 laptop shows as installed

PS C:\WINDOWS\system32> fltmc

Filter Name Num Instances Altitude Frame
------------------------------ ------------- ------------ -----
bindflt 1 409800 0
WdFilter 5 328010 0
storqosflt 0 244000 0
wcifs 1 189900 0
CldFlt 0 180451 0
FileCrypt 0 141100 0
luafv 1 135000 0
npsvctrig 1 46000 0
Wof 3 40700 0
FileInfo 5 40500 0
PS C:\WINDOWS\system32>


look for entries not on this list.
some of your other drivers you have installed could be the source of the problem also. Malware hides.

in the article I was looking at the malware was attached to a 3rd party network filter so it could watch network traffic, then it use the nt function on discarded network driver allocations to run code.

 

[MekiPrime]

stack was corruted but the raw stack shows that the calls came
EasyAntiCheat+0x3c947
to a bunch of code outside of normal drivers then to
this windows function
nt!MmGetVirtualForPhysical
which then got the page fault and resulted in the bugcheck.

looks like
C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys Sun Mar 6 18:17:48 2022
is still installed in the dump for
Wed Apr 20 03:06:20.232 2022

download and run autoruns from here:https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
locate the driver and disable or delete it.
then retest to see if you bugcheck.

this dump also shows the ene.sys driver.
I will re download in case I grabbed the wrong dump.
----------
nope: that was the one that was put up there 5 hours ago.
note: i just read a article on how malware is using this function to try to hack into the system.

so i would do the following:
download rammap from https://docs.microsoft.com/en-us/sysinternals/downloads/rammap
find the menu item that says empty and select them all.
you are trying to dump all the standby memory contents so malware can not hide there.

then go into control panel, and turn off your virtual memory
so when you reboot your pagefile.sys will be deleted. So malware can not hid in the pagefile.sys.

start cmd.exe as an admin then run
dism.exe /online /cleanup-image /restorehealth

reboot then go back into control panel and turn on the virtual memory again so your pagefile.sys is recreated.

I would also check to see what file filters you have installed on your machine. It is just a good place to hide malware.
start cmd.exe then run
fltmc.exe
here is what this windows 10 laptop shows as installed

PS C:\WINDOWS\system32> fltmc

Filter Name Num Instances Altitude Frame
------------------------------ ------------- ------------ -----
bindflt 1 409800 0
WdFilter 5 328010 0
storqosflt 0 244000 0
wcifs 1 189900 0
CldFlt 0 180451 0
FileCrypt 0 141100 0
luafv 1 135000 0
npsvctrig 1 46000 0
Wof 3 40700 0
FileInfo 5 40500 0
PS C:\WINDOWS\system32>


look for entries not on this list.
some of your other drivers you have installed could be the source of the problem also. Malware hides.

in the article I was looking at the malware was attached to a 3rd party network filter so it could watch network traffic, then it use the nt function on discarded network driver allocations to run code.

Thank you for your reply.

I have now followed everything and the filter came out with these entries:
Filter Name Num Instances Altitude Frame
----------------------------- -------------------- ---- -----
bindflt 1 409800 0
MBAMChameleon 6 400900 0
MBAMProtection 7 328800 0
MBAMFarflt 6 268150 0
storqosflt 0 244000 0
wcifs 0 189900 0
gameflt 5 189850 0
CldFlt 1 180451 0
FileCrypt 0 141100 0
luafv 1 135000 0
npsvctrig 1 46000 0
Wof 5 40700 0
FileInfo 7 40500 0

Is there anything "dangerous" with it?

Do you think a "reinstallation" of Windows would help?

 

[johnbl]

Thank you for your reply.

I have now followed everything and the filter came out with these entries:
Filter Name Num Instances Altitude Frame
----------------------------- -------------------- ---- -----
bindflt 1 409800 0
MBAMChameleon 6 400900 0
MBAMProtection 7 328800 0
MBAMFarflt 6 268150 0
storqosflt 0 244000 0
wcifs 0 189900 0
gameflt 5 189850 0
CldFlt 1 180451 0
FileCrypt 0 141100 0
luafv 1 135000 0
npsvctrig 1 46000 0
Wof 5 40700 0
FileInfo 7 40500 0

Is there anything "dangerous" with it?

Do you think a "reinstallation" of Windows would help?

the filter drivers look ok. just virus scanner and microsoft game filter driver.

try your system without the ene.sys driver reinstall the anticheat software.

 

[MekiPrime]

the filter drivers look ok. just virus scanner and microsoft game filter driver.

try your system without the ene.sys driver reinstall the anticheat software.

How I can try it without ene.sys driver?

I have now rebooted/reinstalled the whole windows. And the same blue screen came up again....
I have now unplugged two of the "older RAM bars" and so far no more bluescreens. I wait the days, should it appear again, I will send the dumpfile here.

 

[johnbl]

How I can try it without ene.sys driver?

I have now rebooted/reinstalled the whole windows. And the same blue screen came up again....
I have now unplugged two of the "older RAM bars" and so far no more bluescreens. I wait the days, should it appear again, I will send the dumpfile here.

if you suspect RAM issues make sure your run memtest86 to confirm your RAM timings

i would just google "autoruns" download the microsoft tool,run it find the driver ene.sys and delete the entry.
you might also be able to find the uninstaller that you used to install the driver and run it. guess it controls lighting effect on G.SKILL Trident Z Lighting. it is a target for malware attacks.

I would just remove it until you know it is not the cause of the bugchecks.

memory:
bank 0:
CMK8GX4M1D3000C16

bank 1:
Crucial Technology BL8G32C16U4BL.8FE
16-18-18-36-54-2 (tCAS-tRCD-tRP-tRAS-tRC-tCR)
note that the suggested command rate is 2
1.35 volts.

bank 2:
corsair VENGEANCE
CMK8GX4M1D3000C16
Timing16-20-20-38 Voltage1.35V
not sure what the command rate should be

bank 3:
Crucial Technology BL8G32C16U4B.8FE

I would think to make these work together you would want all of the ram slots to be timed with 2n or 2t command clock rates and do not go over 1.35V
BIOS versions typically set command rate to 1T or 1N but if the board is fully populated or you have certain RAM as is your case you need to set the command rate to 2.

I would make this setting in bios ram timings and run memtest86
Also, note when you update the bios or reset it you have to set this setting each time if it is not set correctly by default.
the command rate indicates that it take 2 ticks of the clock before the memory address is valid on the memory controller. At one tick it might work with less ram installed but as more RAM is added and slots further from the cpu it just needs that extra clock tick to have the electronics setup for a valid memory address to be set.

does some of this ram have leds on it? just wondering why
g skill ene.sys driver would be loaded.
\C:\Windows\system32\drivers\ene.sys
Timestamp: Mon Mar 19 20:59:12 2018