Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Page_Fault (50) when searching registry


  • Please log in to reply

#1
therealex

therealex

    Member

  • Member
  • PipPipPip
  • 112 posts
Hi,

I'm running XP sp3. When I search HKEY_USER, I get a BSOD Page_Fault in Non-paged area (0x00000050) error. Here's what I've done so far:

Logged on in Safe Mode
Logged on as another user
Swapped out memory
Disconnected everything but the primary drive
Bought a new hard drive (!) and cloned it
Put the original hard drive in a different computer (so it's not hardware related)
Used one of those registry analyzers
Booted from UBCD and ran a remote registry program to search that key.

None of the above worked. Every single time, it crashes. The dump is below my signature. They're all the same, and I can reproduce it easily by doing a search. It only affects that one key.

BTW - I can't run certain programs, like Old Timer File Cleaner, Driver Verifier or GMER. I'm thinking it's all connected, but don't know how or why. Malwarebytes and Avast come up clean, so it's probably not a virus/spyware.

Thanks very much for your attention,

- Russ



BugCheck 10000050, {fffffbf8, 0, 8054b51a, 0}


Could not read faulting driver name
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+23a )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffbf8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054b51a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: fffffbf8

FAULTING_IP:
nt!ExFreePoolWithTag+23a
8054b51a 668b4efa mov cx,word ptr [esi-6]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: regedit.exe

LAST_CONTROL_TRANSFER: from 806339d3 to 8054b51a

STACK_TEXT:
a3b2ac3c 806339d3 fffffbfe 00000000 e297c008 nt!ExFreePoolWithTag+0x23a
a3b2ac58 80634001 e29757d8 e297c008 e102daa4 nt!CmpCleanUpKcbValueCache+0x51
a3b2ac6c 8063c6bc e29757d8 e2fa4b60 8063c7d8 nt!CmpCleanUpKcbCacheWithLock+0x19
a3b2ac78 8063c7d8 a3b2ac8c 80634106 e297c008 nt!CmpGetDelayedCloseIndex+0x16
a3b2ac80 80634106 e297c008 a3b2ac98 80634548 nt!CmpAddToDelayedClose+0xa
a3b2ac8c 80634548 e297c008 a3b2acb0 80636fda nt!CmpDereferenceKeyControlBlockWithLock+0x48
a3b2ac98 80636fda e297c008 e3348700 e3348710 nt!CmpDereferenceKeyControlBlock+0x12
a3b2acb0 805bb466 e3348728 00000000 e3348710 nt!CmpDeleteKeyObject+0x92
a3b2accc 805266ca e3348728 00000000 000000ec nt!ObpRemoveObjectRoutine+0xe0
a3b2ace4 805bc33b 897d8348 e16703c8 898a2030 nt!ObfDereferenceObject+0x4c
a3b2acfc 805bc3d1 e16703c8 e3348728 000000ec nt!ObpCloseHandleTableEntry+0x155
a3b2ad44 805bc509 000000ec 00000001 00000000 nt!ObpCloseHandle+0x87
a3b2ad58 8054161c 000000ec 0007f440 7c90e4f4 nt!NtClose+0x1d
a3b2ad58 7c90e4f4 000000ec 0007f440 7c90e4f4 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007f440 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+23a
8054b51a 668b4efa mov cx,word ptr [esi-6]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

SYMBOL_NAME: nt!ExFreePoolWithTag+23a

FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+23a

BUCKET_ID: 0x50_nt!ExFreePoolWithTag+23a

Followup: MachineOwner
---------
  • 0

Advertisements


#2
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts
what exactly are you trying to do...
  • 0

#3
therealex

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts

what exactly are you trying to do...


I'm trying to find out why, when I search that registry key, my system crashes. Obviously, that's not normal! It's not hardware related, as I moved the drive to a different computer system and the same thing happened.

- Russ
  • 0

#4
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts
what exactly are you trying to change in the registry...

I would first try running chkdsk /r
nojoy...
try system restore...
nojoy...

you can try a Repair Install to Fix Windows 7
how to here...
but if that doesn't fix it you will probably be forced to do a complete reinstall
  • 0

#5
therealex

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
It's actually Windows XP. It's a new hard drive, but I've already run chkdsk. I did a system restore to a couple of weeks ago, but it didn't resolve the problem.

Here's what I'm thinking:

What if I took an older copy of the registry, say from a month ago. Export the entire HKEY_USERS from that. Using UBCD, I edit the current registry and remove the HKEY_USERS key on there now, replacing it with the one from a month ago. Since the user info hasn't changed - what do you think? Will it screw it up? Additional programs have been installed, so will that mess up the registration of those programs?

Thanks for reading.

- Russ
  • 0

#6
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts
I still don't know what you are trying to see/change in the user section of the registry...
please be specific...
have tried just using the + beside the users to open up whats there

if all else fails try XP repair...guide here
  • 0

#7
therealex

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
I'm not trying to change anything. It's just that I was doing a search through the registry because I had uninstalled some old software, and the system crashed. After doing all of the things noted in the first post, I managed to target it down to that key. I can do a search on that specific key, and within a few seconds it freezes the system and BSODs.

Which subkey is it, specifically? Hard to say. I tried doing a search for "Adobe" and it made it to the Adobe key in the Default subkey. When I tried another search, past that point, for a subkey starting with "B", it froze.

Is it interfering with XP operations? Well, it does take an unusually long time to start up, even in safe mode. Is it a rootkit or virus? Doubtful, as it exhibited the same behavior when booted from a UBCD - on a different computer! I searched the registry using "Remote Registry Viewer" (part of UBCD), and it gave exactly the same error. So, my conclusion is that it's something in that particular part of the registry that is somehow causing it. It's not a hardware error (again, did the same thing when attached to a completely different PC).

It's because this is so unusual that I'm asking for help. Would Combofix find something? Perhaps, but I don't know how to read Combofix results. All I know is that searching the registry shouldn't cause a BSOD. Something is up here.
  • 0

#8
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts

it does take an unusually long time to start up, even in safe mode

HOW LONG EXACTLY

did you do the repair


Please download ARCDC from Artellos.com.
  • Double click ARCDC.exe
  • Follow the dialog until you see 6 options. pick the version and service pack option that corresponds to your system l
  • You will be prompted with a Terms of Use by Microsoft, please accept.
  • You will see a few dos screens flash by, this is normal.
  • Next you will be able to choose to add extra files. Select the Default Files.
  • The last window will allow you to burn the disk using BurnCDCC
Your ISO is located on your desktop.

make sure in the bios the cd drive is the first boot device....put the cd in the cd drive..boot your computer....when you get to the screen that gives you the option to install or repair ...select r

when you get to the command prompt
type in chkdsk /r press enter
note the single space before the /


Chkdsk will display the specific stage it is checking as well as the percentage of completion of the stage. You cannot do anything else on your computer while chkdsk is running. When chkdsk is finished, it will automatically reboot your computer.
NOTE this can take a long time to complete..it may even appear to hang or get stuck at a certain % for a couple of hours...then complete
it may even back up and go over the same area...this is normal...let it run...there are 5 stages
WARNING... Microsoft does not recommend interrupting the CHKDSK process when it is used with the /r switch, and Microsoft does not guarantee the integrity of the disk if the CHKDSK program is interrupted.

DO NOT TURN OFF YOUR COMPUTER WHILE RUNNING CHKDSK or you can have severe problems...
  • 0

#9
therealex

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
I ran chkdsk (again, I've already done it). It made no difference. It's not a hardware error, as evidenced by the fact that it occurs even on the new hard drive that I cloned the old one to. It also occurs when I put the old drive on a different machine.

I find I'm repeating myself quite a bit here. I appreciate your taking the effort to respond, but you don't seem to understand the problem or how to go about fixing it. As you can see from my previous posts, I'm not a beginner. I'm a tech, with an MCSE, certs from every manufacturer you can think of, and 20 years of experience in break/fix. This is not a typical problem, that's why I'm posting here. If it was as simple as "run an MBAM scan" or "run chkdsk /r", the problem would be solved by now.

FYI - I'm going to take an old copy (a month ago) of the registry and put it onto the drive. I'll then try and do a search. If the problem repeats, I'll do an even older restore if I can find one. When I find a solution, I'll repost. If you have any other ideas on how to solve this, aside from a nuke and pave, I would greatly appreciate it.
  • 0

#10
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts

I find I'm repeating myself quite a bit here

me too... :wacko:

for the third time did you try repairing the OS...
for the second time...how long does it take to boot up

if your not willing to try what I say or give me the info I ask for...
then I can't help you...
  • 0

#11
therealex

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
I tried to repair the original hard drive by doing a repair install. Somehow, that corrupted the software registry key (in system32/config), so I'm in the process of restoring that from a backup.

What I've decided to try is this: I'm getting a copy of the registry keys from a backup I did on May 1st. That includes all the config backups along with Ntuser.dat. I'll install those, and see what happens. Frankly, if I can't find a definitive answer to this, I'm going to give up and just install Windows 7, and gradually migrate over.

I've been updating my installs since 1985 (DOS 2.0!) and have never done a clean install. So, this will be an adventure, either way.

As for boot up time: it takes about 90 seconds from where the XP logo goes off and the screen goes dark to when the arrow appears, followed by the login screen. When the desktop appears, it takes an additional two minutes or so, and then additional time as Avast updates, etc. Even in Safe Mode it takes about the same amount of time, so it's not a question of disabling startup items. I have MBAM (paid version) and Avast running, but few other resident programs at startup. I'm thinking it's the registry itself that's slowing things down.

Thanks, I hope that provided all the relevant information.

- Russ
  • 0

#12
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts
lets see if the hard drive has dropped to PIO mode...
click start...run...type in devmgmt.msc...press enter
click on the + beside IDE ATA/ATAPI controllers ...Double-click on the first Primary IDE Channel entry....

Click on the Advanced Settings tab and see if the Current Transfer Mode reads PIO Mode and the Transfer Mode reads DMA if available...
  • 0

#13
therealex

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
You know, I forgot all about that! But, I checked it (all of them, actually) and they're set to Ultra DMA, so it isn't that. But I'm glad you reminded me, it's been awhile since I had to check something like that and it slipped completely out of my memory. I should start a checklist...
  • 0

#14
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts

I'm going to give up and just install Windows 7,

I think that would be your best bet...its faster and more stable
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP