Windows 10: BSOD caused by PAGE_FAULT_IN_NONPAGED_AREA50 and MsMpEng.exe

Discus and support BSOD caused by PAGE_FAULT_IN_NONPAGED_AREA50 and MsMpEng.exe in Windows 10 BSOD Crashes and Debugging to solve the problem; My computer will run into BSOD almost always after continual running 7 days. I am wondering which part could cause this problem? Software or hardware?... Discussion in 'Windows 10 BSOD Crashes and Debugging' started by VSCoder, May 22, 2020 at 10:57 AM.

  1. VSCoder Win User

    BSOD caused by PAGE_FAULT_IN_NONPAGED_AREA50 and MsMpEng.exe


    My computer will run into BSOD almost always after continual running 7 days. I am wondering which part could cause this problem? Software or hardware? I saw that the problem could be caused by memory so I reinstalled my memory and verified it is correctly installed but the problem still pops up again. Here are the memory dump file analysis by windbg.exe for reference. Thanks!



    Microsoft R Windows Debugger Version 10.0.18362.1 AMD64

    Copyright c Microsoft Corporation. All rights reserved.





    Loading Dump File [C:\Windows\MEMORY.DMP]

    Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.





    ************* Path validation summary **************

    Response Time ms Location

    Deferred SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols

    Executable search path is:

    Windows 10 Kernel Version 18362 MP 24 procs Free x64

    Product: WinNt, suite: TerminalServer SingleUserTS

    Built by: 18362.1.amd64fre.19h1_release.190318-1202

    Machine Name:

    Kernel base = 0xfffff800`52c00000 PsLoadedModuleList = 0xfffff800`53048170

    Debug session time: Fri May 22 07:18:20.595 2020 UTC - 4:00

    System Uptime: 0 days 20:01:35.269

    Loading Kernel Symbols

    ...............................................................

    ................................................................

    ...............................................................

    Loading User Symbols

    PEB is paged out Peb.Ldr = 00000065`31483018. Type ".hh dbgerr001" for details

    Loading unloaded module list

    .......

    For analysis of this file, run !analyze -v

    9: kd> !analyze -v

    *******************************************************************************

    * *

    * Bugcheck Analysis *

    * *

    *******************************************************************************



    PAGE_FAULT_IN_NONPAGED_AREA 50

    Invalid system memory was referenced. This cannot be protected by try-except.

    Typically the address is just plain bad or it is pointing at freed memory.

    Arguments:

    Arg1: ffff8109a4967c08, memory referenced.

    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.

    Arg3: fffff800532b411b, If non-zero, the instruction address which referenced the bad memory

    address.

    Arg4: 0000000000000002, reserved



    Debugging Details:

    ------------------





    KEY_VALUES_STRING: 1





    PROCESSES_ANALYSIS: 1



    SERVICE_ANALYSIS: 1



    STACKHASH_ANALYSIS: 1



    TIMELINE_ANALYSIS: 1





    DUMP_CLASS: 1



    DUMP_QUALIFIER: 401



    BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202



    SYSTEM_MANUFACTURER: System manufacturer



    SYSTEM_PRODUCT_NAME: System Product Name



    SYSTEM_SKU: SKU



    SYSTEM_VERSION: System Version



    BIOS_VENDOR: American Megatrends Inc.



    BIOS_VERSION: 1302



    BIOS_DATE: 01/20/2020



    BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.



    BASEBOARD_PRODUCT: ROG CROSSHAIR VIII HERO WI-FI



    BASEBOARD_VERSION: Rev X.0x



    DUMP_TYPE: 1



    BUGCHECK_P1: ffff8109a4967c08



    BUGCHECK_P2: 0



    BUGCHECK_P3: fffff800532b411b



    BUGCHECK_P4: 2



    READ_ADDRESS: ffff8109a4967c08



    FAULTING_IP:

    nt!ObpCreateHandle+87b

    fffff800`532b411b 488b4608 mov rax,qword ptr [rsi+8]



    MM_INTERNAL_CODE: 2



    CPU_COUNT: 18



    CPU_MHZ: ed1



    CPU_VENDOR: AuthenticAMD



    CPU_FAMILY: 17



    CPU_MODEL: 71



    CPU_STEPPING: 0



    DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT



    BUGCHECK_STR: AV



    PROCESS_NAME: MsMpEng.exe



    CURRENT_IRQL: 0



    ANALYSIS_SESSION_HOST: DESKTOP-UK5AERM



    ANALYSIS_SESSION_TIME: 05-22-2020 10:36:51.0393



    ANALYSIS_VERSION: 10.0.18362.1 amd64fre



    TRAP_FRAME: ffff9388df8ed140 -- .trap 0xffff9388df8ed140

    NOTE: The trap frame does not contain all registers.

    Some register values may be zeroed or incorrect.

    rax=ffffa80c04b7e080 rbx=0000000000000000 rcx=0000000000000000

    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000

    rip=fffff800532b411b rsp=ffff9388df8ed2d0 rbp=ffff9388df8ed3f0

    r8=0000000000000000 r9=0000000000000000 r10=0000000000000001

    r11=ffff9388df8ed840 r12=0000000000000000 r13=0000000000000000

    r14=0000000000000000 r15=0000000000000000

    iopl=0 nv up ei ng nz na po cy

    nt!ObpCreateHandle+0x87b:

    fffff800`532b411b 488b4608 mov rax,qword ptr [rsi+8] ds:00000000`00000008=????????????????

    Resetting default scope



    LAST_CONTROL_TRANSFER: from fffff80052e2dd34 to fffff80052dc2390



    STACK_TEXT:

    ffff9388`df8ece98 fffff800`52e2dd34 : 00000000`00000050 ffff8109`a4967c08 00000000`00000000 ffff9388`df8ed140 : nt!KeBugCheckEx

    ffff9388`df8ecea0 fffff800`52cc91af : a80c04e7`0090fffe 00000000`00000000 00000000`00000000 ffff8109`a4967c08 : nt!MiSystemFault+0x195c94

    ffff9388`df8ecfa0 fffff800`52dd041e : 00000000`00000000 00000000`df8ed840 00000000`00000000 ffffa80c`04e700a0 : nt!MmAccessFault+0x34f

    ffff9388`df8ed140 fffff800`532b411b : ffff9388`df8ed3f0 00000000`00000001 00000000`00000000 ffff8109`a4967c20 : nt!KiPageFault+0x35e

    ffff9388`df8ed2d0 fffff800`532aa75c : ffff9388`df8ed820 ffffa80c`04e64080 00000000`00000000 00000000`00000000 : nt!ObpCreateHandle+0x87b

    ffff9388`df8ed500 fffff800`5329d78e : ffffa80c`04b7e080 ffff9388`df8edb80 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByPointer+0xec

    ffff9388`df8ed760 fffff800`5329d573 : 00000065`336fd528 00000000`00000066 00000000`00000000 00000000`000003e3 : nt!PsOpenThread+0x20e

    ffff9388`df8edac0 fffff800`52dd3c18 : ffffa80c`04b7e080 ffff9388`00000000 ffff9388`df8edb80 00000222`08707890 : nt!NtOpenThread+0x23

    ffff9388`df8edb00 00007ffb`df3de584 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28

    00000065`336fd0a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`df3de584





    THREAD_SHA1_HASH_MOD_FUNC: e7308cb5b2bce3259fcb2a2d82b2a4ae62d0edb9



    THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6e415a18470408776de4bd4e59a14db327878c3e



    THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe



    FOLLOWUP_IP:

    nt!ObpCreateHandle+87b

    fffff800`532b411b 488b4608 mov rax,qword ptr [rsi+8]



    FAULT_INSTR_CODE: 8468b48



    SYMBOL_STACK_INDEX: 4



    SYMBOL_NAME: nt!ObpCreateHandle+87b



    FOLLOWUP_NAME: MachineOwner



    MODULE_NAME: nt



    IMAGE_NAME: ntkrnlmp.exe



    DEBUG_FLR_IMAGE_TIMESTAMP: 0



    STACK_COMMAND: .thread ; .cxr ; kb



    BUCKET_ID_FUNC_OFFSET: 87b



    FAILURE_BUCKET_ID: AV_R_INVALID_nt!ObpCreateHandle



    BUCKET_ID: AV_R_INVALID_nt!ObpCreateHandle



    PRIMARY_PROBLEM_CLASS: AV_R_INVALID_nt!ObpCreateHandle



    TARGET_TIME: 2020-05-22T11:18:20.000Z



    OSBUILD: 18362



    OSSERVICEPACK: 0



    SERVICEPACK_NUMBER: 0



    OS_REVISION: 0



    SUITE_MASK: 272



    PRODUCT_TYPE: 1



    OSPLATFORM_TYPE: x64



    OSNAME: Windows 10



    OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS



    OS_LOCALE:



    USER_LCID: 0



    OSBUILD_TIMESTAMP: unknown_date



    BUILDDATESTAMP_STR: 190318-1202



    BUILDLAB_STR: 19h1_release



    BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202



    ANALYSIS_SESSION_ELAPSED_TIME: 25e4



    ANALYSIS_SOURCE: KM



    FAILURE_ID_HASH_STRING: km:av_r_invalid_nt!obpcreatehandle



    FAILURE_ID_HASH: {27f6cfdc-4604-91eb-121d-57c0a4aaf233}



    Followup: MachineOwner

    ---------

    :)
     
  2. Msap14 Win User

    BSOD Hardware Caused???

    they do weird things like that, which all seem like something else is failing.
    One of the worst things to diagnose, they seem to only quit when they want to.

    Memtest is a good next step, if you rule out RAM and Power Supply make sure you disconnect all unnecessary peripherals and try to start the system with as little hardware as possible, if it works then, you can narrow down the culprit by trial and error.

    the follow was taken from some website:

    It's very difficult to determine if a failure is caused by the CPU because many other components can cause the same symptom when they fail.

    1. System fails to boot
    2. System re-boots intermittently
    3. General Protection Fault
    4. Illegal Operation
    5. Stop Error, or BSoD (Blue Screen OfDeath)

    Actually, CPUs rarely fail, and about the only way to determine if the CPU is causing the failure is to swap it out with a known working CPU of the same type and speed. Since this is difficult, the best bet is to first rule out every other possibility.

    Before suspecting the CPU, rule out all the possibilities listed below.

    1. The Operating System
    2. A peripheral port device
    3. A bad memory module
    4. The hard disk drive
    5. The power supply
    6. The motherboard

    If you have ruled out out all the other possibilities, investigate the items listed below.

    1. Overheating
    2. A short circuit
    3. ESD
     
  3. ARC
    Arc Win User
    Random BSOD while browsing internet


    BitDefender is nothing special. mwac.sys causes BSODs anywhere.
    A tiny documentation can be found here: Solved Random BSODs - Windows 10 Forums
    In that very thread, the suggested action apparently worked.

    The storage and network filters of any third party antivirus can cause BSODs. Neither MBAM nor BitDefender is any special. For a regular antivirus, it may be shifted to an alternative; but MBAM has no alternative. So a clean install of the said program is the most feasible first step.
    As far as the first step is not failing, it is better to not think for the second step. Because the BSODs are not universal, failure at the first step is not universal; and success at the second step is also not universal.
    That is why I posted that my suggestion may work, or may not. Let us see where it goes.
     
  4. hoax32 Win User

    BSOD caused by PAGE_FAULT_IN_NONPAGED_AREA50 and MsMpEng.exe

    BSOD Hardware Caused???

    It is not overheating - CPU runs 60*C in games.
    Short Circuit - EXTREAMLY UNLIKELY
     
Thema:

BSOD caused by PAGE_FAULT_IN_NONPAGED_AREA50 and MsMpEng.exe

Loading...
  1. BSOD caused by PAGE_FAULT_IN_NONPAGED_AREA50 and MsMpEng.exe - Similar Threads - BSOD caused PAGE_FAULT_IN_NONPAGED_AREA50

  2. Cause of BSODs

    in Windows 10 Ask Insider
    Cause of BSODs: Hello everyone, last night and today i have encounter 2 BSODs and i really have no idea whats the cause, could someone help me determine the cause and possible fixes? Thank you in advance On Thu 02/04/2020 18:03:28 your computer crashed or a problem was reported crash dump...
  3. BSOD- Cause

    in Windows 10 BSOD Crashes and Debugging
    BSOD- Cause: I have been having massive problems with my Laptop constant BSOD/ no bootable device errors. The SSD with the OS was replaced a week ago and I had no bluescreens since then. I thought this had fixed the issue. Unfortunately I was forced to install windows 1909 and every time...
  4. BSOD ntoskrnl..exe

    in Windows 10 BSOD Crashes and Debugging
    BSOD ntoskrnl..exe: My computer has crashed a few times often when i play games. I bought more ram because i thought that it was the issue but it didn't help. It did work a few days but then the crashes came back. After that i fixed the BSOD´s by lowering the graphics and the resolution on the...
  5. Cause of BSOD?

    in Windows 10 BSOD Crashes and Debugging
    Cause of BSOD?: Hello, Had a BSOD a couple hours after updating from 1903 to 1909. Is somebody able to help me find the root cause? Minidump: https://1drv.ms/u/s!An67U6rcsUDcgepzbbX5f7ldMqx1wQ?e=v95wwJ MsInfo32: https://1drv.ms/u/s!An67U6rcsUDcgep0seS8-uu8JP2TJQ?e=BY4PoM Thanks for...
  6. BSOD ntoskrnl..exe+1b35e0

    in Windows 10 BSOD Crashes and Debugging
    BSOD ntoskrnl..exe+1b35e0: Help. Getting 4-5 of these a day. Running latest Windows 10 Pro, Xibo signboard, Docker with Xibo server. Always the same 'Caused By Address'. Put in new memory, ran memory test, no errors, all drivers up to date. Change disk type to AHCA, made sure windows driver was...
  7. BSOD caused by ksaud.sys

    in Windows 10 Software and Apps
    BSOD caused by ksaud.sys: running w10 64 and when i keep bluestacks opened for more than 45min-1 hour i get BSOD... bluestacks analized all mem dumps and found out ksaud.sys causes this... need help in fixing the issue... thank you......
  8. rundll32.exe causes heavy problems

    in Windows 10 BSOD Crashes and Debugging
    rundll32.exe causes heavy problems: Hi everyone, It's simply impossible to work fluently without been stopped, because of this process. All rundll32 processes in Task Manager point to the same process in system32. Many antivirus softwares have been tried, but nothing found. System info: Lenovo yoga with i7...
  9. AV causing BSOD?

    in AntiVirus, Firewalls and System Security
    AV causing BSOD?: Someone told me Kaspersky AV is risky for bsod's: is this true? Would Norton (security deluxe) be better for that problem? 105294
  10. BSOD caused by ntsoskrnl.exe

    in Windows 10 BSOD Crashes and Debugging
    BSOD caused by ntsoskrnl.exe: So uh, yeah, this is causing me issues. Attachment 42120 25862