Tracking down random BSOD on windows 7
I have gotten a computer running windows 7 handed to me that randomly, several times a day, bsods with a PAGE_FAULT_IN_NONPAGED_AREA (50) or WHEA_UNCORRECTABLE_ERROR (124). Crashes happens regardless of load. I am running out of ideas for how to track this down.
- Analyzing the minidumps shows the crash to be in ntkrnlmp.exe/WMIADAP.exe
- System has plenty of power (600w)
- Ram checks out fine using memtest86+ over a weekend.
- System is clean inside. No dust build up. Temperatures stay low.
- As far as I know (and reliability history shows) no new drivers were installed for several months before the problems started. All drivers are now up to date.
- sfc /scannow reports the system as clean.
- CHKDSK reports the disks as clean
- Removing the AV (Avast) has no effect.
Any more things that should be tried on windows 7 before I start replacing the hardware?
Edit: The system is custom built but not over-clocked. The major parts are:
- MB: MSI P6N Diamond
- CPU: Core 2 Duo E6850
- GPU: Raedon 5850
- PSU: Corsair HX620
- Memory: Corsair TWIN2X4096-6400C5
- HD: Intel SSD X25-M G2
Edit: Crashes comes in groups and seems to have settled on the page_fault now. Here is the last bunch, including the driver causing them:
10-04-22 16:01 PAGE_FAULT_IN_NONPAGED_AREA ntoskrnl.exe ntoskrnl.exe+70600
10-04-22 09:03 PAGE_FAULT_IN_NONPAGED_AREA ntoskrnl.exe ntoskrnl.exe+70600
10-04-22 02:27 PAGE_FAULT_IN_NONPAGED_AREA fltmgr.sys fltmgr.sys+16df
10-04-21 22:29 PAGE_FAULT_IN_NONPAGED_AREA Ntfs.sys Ntfs.sys+b3293
10-04-21 17:32 PAGE_FAULT_IN_NONPAGED_AREA rdpbus.sys rdpbus.sys+1f0a790
10-04-21 16:02 PAGE_FAULT_IN_NONPAGED_AREA serenum.sys serenum.sys+29fae00
10-04-21 15:00 PAGE_FAULT_IN_NONPAGED_AREA rdprefmp.sys rdprefmp.sys+3ae8790
10-04-21 12:59 PAGE_FAULT_IN_NONPAGED_AREA cdrom.sys cdrom.sys+2b12790
10-04-21 11:22 PAGE_FAULT_IN_NONPAGED_AREA rdpencdd.sys rdpencdd.sys+289f70
10-04-21 10:43 PAGE_FAULT_IN_NONPAGED_AREA Msfs.SYS Msfs.SYS+5b68760
10-04-21 10:34 PAGE_FAULT_IN_NONPAGED_AREA Msfs.SYS Msfs.SYS+5aea720
10-04-21 10:18 PAGE_FAULT_IN_NONPAGED_AREA fltmgr.sys fltmgr.sys+16df
10-04-21 04:19 PAGE_FAULT_IN_NONPAGED_AREA rassstp.sys rassstp.sys+1e72760
10-04-21 04:11 PAGE_FAULT_IN_NONPAGED_AREA Msfs.SYS Msfs.SYS+4ce9330
10-04-21 03:16 PAGE_FAULT_IN_NONPAGED_AREA cdrom.sys cdrom.sys+2a5ae00
10-04-21 03:03 PAGE_FAULT_IN_NONPAGED_AREA raspptp.sys raspptp.sys+2150420
10-04-21 02:12 PAGE_FAULT_IN_NONPAGED_AREA ntoskrnl.exe ntoskrnl.exe+70600
10-04-21 02:03 PAGE_FAULT_IN_NONPAGED_AREA TDI.SYS TDI.SYS+163cb90
10-04-21 00:45 PAGE_FAULT_IN_NONPAGED_AREA ntoskrnl.exe ntoskrnl.exe+70600
10-04-21 00:13 PAGE_FAULT_IN_NONPAGED_AREA VClone.sys VClone.sys+2138330
10-04-20 23:20 PAGE_FAULT_IN_NONPAGED_AREA fltmgr.sys fltmgr.sys+6033
10-04-20 21:01 PAGE_FAULT_IN_NONPAGED_AREA raspppoe.sys raspppoe.sys+399d250
10-04-20 20:47 PAGE_FAULT_IN_NONPAGED_AREA umbus.sys umbus.sys+2921760
10-04-20 15:09 PAGE_FAULT_IN_NONPAGED_AREA cdrom.sys cdrom.sys+6c97760
10-04-20 15:03 PAGE_FAULT_IN_NONPAGED_AREA cdrom.sys cdrom.sys+4245760
10-04-20 14:57 PAGE_FAULT_IN_NONPAGED_AREA cdrom.sys cdrom.sys+16a2f70
10-04-20 13:10 PAGE_FAULT_IN_NONPAGED_AREA rasl2tp.sys rasl2tp.sys+ff46f180
10-04-20 11:47 PAGE_FAULT_IN_NONPAGED_AREA raspppoe.sys raspppoe.sys+21ff790
10-04-20 10:26 PAGE_FAULT_IN_NONPAGED_AREA ntoskrnl.exe ntoskrnl.exe+70600
10-04-20 09:57 PAGE_FAULT_IN_NONPAGED_AREA fltmgr.sys fltmgr.sys+16df
10-04-20 09:27 PAGE_FAULT_IN_NONPAGED_AREA raspptp.sys raspptp.sys+1fae790
10-04-20 05:21 PAGE_FAULT_IN_NONPAGED_AREA hal.dll hal.dll+101bc
10-04-20 03:23 PAGE_FAULT_IN_NONPAGED_AREA ks.sys ks.sys+27d2760
10-04-20 03:17 PAGE_FAULT_IN_NONPAGED_AREA ntoskrnl.exe ntoskrnl.exe+70600
10-04-20 03:04 PAGE_FAULT_IN_NONPAGED_AREA csc.sys csc.sys+390f480
10-04-20 01:12 PAGE_FAULT_IN_NONPAGED_AREA peauth.sys peauth.sys+91d760
10-04-20 01:04 PAGE_FAULT_IN_NONPAGED_AREA NDProxy.SYS NDProxy.SYS+28a7760
10-04-20 00:57 PAGE_FAULT_IN_NONPAGED_AREA USBD.SYS USBD.SYS+240c7c0
10-04-20 00:51 PAGE_FAULT_IN_NONPAGED_AREA ntoskrnl.exe ntoskrnl.exe+70600
10-04-20 00:44 PAGE_FAULT_IN_NONPAGED_AREA rassstp.sys rassstp.sys+1567790
10-04-20 00:38 PAGE_FAULT_IN_NONPAGED_AREA usbohci.sys usbohci.sys+1e20760
10-04-20 00:32 PAGE_FAULT_IN_NONPAGED_AREA wfplwf.sys wfplwf.sys+3cb8760
10-04-20 00:26 PAGE_FAULT_IN_NONPAGED_AREA cdrom.sys cdrom.sys+21e0570
10-04-20 00:10 PAGE_FAULT_IN_NONPAGED_AREA cdrom.sys cdrom.sys+2ef0a10
10-04-20 00:07 PAGE_FAULT_IN_NONPAGED_AREA HIDPARSE.SYS HIDPARSE.SYS+2600760
10-04-20 00:01 PAGE_FAULT_IN_NONPAGED_AREA ntoskrnl.exe ntoskrnl.exe+70600
10-04-19 22:47 PAGE_FAULT_IN_NONPAGED_AREA kbdclass.sys kbdclass.sys+2aba760
10-04-19 22:41 PAGE_FAULT_IN_NONPAGED_AREA cdrom.sys cdrom.sys+baf4010
10-04-19 20:37 PAGE_FAULT_IN_NONPAGED_AREA Ntfs.sys Ntfs.sys+bb16c
10-04-19 20:21 PAGE_FAULT_IN_NONPAGED_AREA cdrom.sys cdrom.sys+b12da0
Some quick statistics on which driver causes the crashes doesn't make me more certain. Sure, the kernel and cdrom shows up at top, but the rest seems to be more or less everything in the OS:
cdrom.sys 9
ntoskrnl.exe 8
fltmgr.sys 4
raspptp.sys 4
Msfs.SYS 3
Ntfs.sys 2
raspppoe.sys 2
csc.sys 1
hal.dll 1
HIDPARSE.SYS 1
kbdclass.sys 1
ks.sys 1
NDProxy.SYS 1
peauth.sys 1
rasl2tp.sys 1
rdpbus.sys 1
rdpencdd.sys 1
rdprefmp.sys 1
serenum.sys 1
TDI.SYS 1
umbus.sys 1
USBD.SYS 1
usbohci.sys 1
VClone.sys 1
wfplwf.sys 1
Although a driver may be up to date, the hardware it manages may have become flaky and cause it to abort.
You may try BlueScreenView to analyze the dumps:
BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table. For each crash, BlueScreenView displays the minidump filename, the date/time of the crash, the basic crash information displayed in the blue screen (Bug Check Code and 4 parameters), and the details of the driver or module that possibly caused the crash (filename, product name, file description, and file version).
For each crash displayed in the upper pane, you can view the details of the device drivers loaded during the crash in the lower pane. BlueScreenView also mark the drivers that their addresses found in the crash stack, so you can easily locate the suspected drivers that possibly caused the crash.
My completely unscientific testing suggests that the first component to try replacing is the video card. (preferably with a different brand)
My "testing" consists of googling for <component> and <component> BSOD, and dividing the number of hits for the second by the first to arrive at a percentage:
- E6850 1.7%
- MSI P6N Diamond 2.3%
- Radeon 5850 9.2%
- I don't think it's the RAM due to memtest86
- PSU and SSD also seem unlikely
BTW when I was having trouble with TV tuners a couple of years ago I used this method to select two tuners whose presence / drivers don't seem to have caused any crashes. Combined with my unwillingness to reboot for updates I often have uptimes measured in weeks. (I can often find the program which is using a file which needs to be replaced, close it and replace the file manually - even if the program is Explorer)