Windows 8 Blue Screens ntoskrnl.exe & EhStorClass.sys Page fault in nonpaged area

[akimoggie]

Hello!

My girlfriend and I are having some problems with her new Toshiba laptop. At random times it bluescreens, usually giving a PAGE_FAULT_IN_NONPAGED_AREA (0x00000050) error. A lot of what I've been reading about it state that it could be an issue with the ram sticks, however the tests we've done (SFC, windows memory diagnostic w/ multiple passes) came up clean--we haven't tried memtest86 yet because we haven't had time, but plan to do that next.

Her laptop is as follows:

Toshiba Qosmio X70-ABT3G22
OS: Windows 8.1
CPU: Intel Core i7 4700MQ
RAM: 24GB (2x4GB + 2x8GB) Samsung DDR3-1600mhz

More info about the ram sticks in question:

(slot 3 is the same as slot 2 and slot 4 is the same as slot 1)

We used Blue Screen Viewer to look at the last two BSODs she had.

==================================================
Dump File         : 071714-26640-01.dmp
Crash Time        : 7/17/2014 4:37:46 AM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff901`7376a400
Parameter 2       : 00000000`00000000
Parameter 3       : fffff960`001a3b58
Parameter 4       : 00000000`00000002
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+153fa0
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.3.9600.17085 (winblue_gdr.140330-1035)
Processor         : x64
Crash Address     : ntoskrnl.exe+153fa0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\Windows\Minidump\071714-26640-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 9600
Dump File Size    : 290,792
Dump File Time    : 7/17/2014 4:39:03 AM
==================================================

==================================================
Dump File         : 071714-21609-01.dmp
Crash Time        : 7/17/2014 12:06:15 AM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : ffffe000`19cc1dc4
Parameter 2       : 00000000`00000001
Parameter 3       : fffff801`10bc412e
Parameter 4       : 00000000`00000002
Caused By Driver  : EhStorClass.sys
Caused By Address : EhStorClass.sys+2169ad
File Description  : Enhanced Storage Class driver for IEEE 1667 devices
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.3.9600.16384 (winblue_rtm.130821-1623)
Processor         : x64
Crash Address     : ntoskrnl.exe+153fa0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\Windows\Minidump\071714-21609-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 9600
Dump File Size    : 286,680
Dump File Time    : 7/17/2014 12:07:48 AM
==================================================

That's all the info I have at the moment, let me know what other info is needed. Any and all advice is really appreciated! Thanks!

edit#1: Also, overheating doesn't seem to be an issue--the BSODs occur regardless of whether she's playing a game, browsing the internet, or doing nothing. She's watched her CPU usage, memory usage, and computer temperature and everything is totally normal. Also, she's been on point in regards to updating drivers and Windows updates and such, but I'm thinking something slipped through the cracks. It's a new laptop and all.

 

[techgeek]

Is this the way the laptop was configured for RAM? Or have you added some?

If you've added new RAM, try removing it and seeing if the problem remains.

Also as you mentioned the best way to check RAM is with Memtest, leave it run overnight. In my experience, it can take some time before errors start appearing. So let it run 6 - 8 hours. If after that long it hasn't produced any errors, they your RAM is fine.

 

[akimoggie]

Is this the way the laptop was configured for RAM? Or have you added some?

If you've added new RAM, try removing it and seeing if the problem remains.

Also as you mentioned the best way to check RAM is with Memtest, leave it run overnight. In my experience, it can take some time before errors start appearing. So let it run 6 - 8 hours. If after that long it hasn't produced any errors, they your RAM is fine.

Thanks for your response!

The RAM was pre-configured that way, direct from Toshiba. We haven't fiddled with any of the hardware.

Until we have time to run Memtest, are there any other things we should check into? Or are all indications pointing towards something physically wrong with the ram (as I fear)?

 

[techgeek]

Looking at the dump file really makes me think bad RAM. However you could also try opening a command prompt window and typing:

chkdsk c: /r

It will tell you that it can't lock the drive and ask if you want to schedule the check disk for on the next reboot, answer Y and close the command prompt and reboot.

This will do a full scan (include and surface scan) of your hard drive. It will take a long time depending on how big the hard drive is.

P.S. I really think it's RAM though, the crashes were with different drivers, but at the same address in both dumps.

 

[akimoggie]

Looking at the dump file really makes me think bad RAM. However you could also try opening a command prompt window and typing:

chkdsk c: /r

It will tell you that it can't lock the drive and ask if you want to schedule the check disk for on the next reboot, answer Y and close the command prompt and reboot.

This will do a full scan (include and surface scan) of your hard drive. It will take a long time depending on how big the hard drive is.

P.S. I really think it's RAM though, the crashes were with different drivers, but at the same address in both dumps.

Alright. If it comes back clean after the memtest we'll try that. I think you're right, though--there's been several more BSODs since this morning and all of them have the same address. I'll post them here for reference, but at this point the BSODs have become frequent enough that I don't see how it can be anything other than the RAM.

Here's the last crash logs.

==================================================
Dump File         : 071714-33937-01.dmp
Crash Time        : 7/17/2014 12:21:41 PM
Bug Check String  : CRITICAL_PROCESS_DIED
Bug Check Code    : 0x000000ef
Parameter 1       : ffffe000`f5bed900
Parameter 2       : 00000000`00000000
Parameter 3       : 00000000`00000000
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+153fa0
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+153fa0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\Windows\Minidump\071714-33937-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 9600
Dump File Size    : 295,496
Dump File Time    : 7/17/2014 12:23:03 PM
==================================================

==================================================
Dump File         : 071714-30437-01.dmp
Crash Time        : 7/17/2014 12:24:51 PM
Bug Check String  : DRIVER_POWER_STATE_FAILURE
Bug Check Code    : 0x0000009f
Parameter 1       : 00000000`00000003
Parameter 2       : ffffe001`aced1060
Parameter 3       : ffffd001`c4c57930
Parameter 4       : ffffe001`aedf4340
Caused By Driver  : afd.sys
Caused By Address : afd.sys+4eba0
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+153fa0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\Windows\Minidump\071714-30437-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 9600
Dump File Size    : 1,208,024
Dump File Time    : 7/17/2014 12:25:55 PM
==================================================

==================================================
Dump File         : 071714-28593-01.dmp
Crash Time        : 7/17/2014 1:44:34 PM
Bug Check String  : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code    : 0x0000000a
Parameter 1       : ffffe000`a1be2ca8
Parameter 2       : 00000000`00000002
Parameter 3       : 00000000`00000000
Parameter 4       : fffff800`c04e8664
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+153fa0
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+153fa0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\Windows\Minidump\071714-28593-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 9600
Dump File Size    : 270,784
Dump File Time    : 7/17/2014 1:45:44 PM
==================================================

(Really running the gamut of ominous error messages there!)

Anyway, Memtest will be running so I'll get back to you after we come back from work and all. Thanks again for your help.