PAGE_FAULT_IN_NONPAGED_AREA

During bootup, I am getting the fault messge "PAGE_FAULT_IN_NONPAGED_AREA". I
have been doing research and most of the answers I found are related to
memory errors or other hardware problems. I installed Trend Micro Internet
security 2008 and everything was working fine. The customer said she was
having a problem and when I went on site, I noticed that the system somehow
had a virus. I managed to get the virus removed, but now I am getting that
Page Fault. It is possible that the Pagefile is corrupted? Can you please
give me a sequence of steps to try? Also, the XP Pro system does boot in Safe
Mode just fine.

Results of the AV Scan:
Fail to Clean [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Success Delete [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Fail to Clean [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Success Delete [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Fail to Clean [ PAK_Generic.001]( 1) from C:\WINDOWS\system32\powerxt.dll
Fail to Clean [ TROJ_SRIZBI.AP]( 1) from C:\WINDOWS\Temp\210.tmp
Success Delete [ TROJ_SRIZBI.AP]( 1) from C:\WINDOWS\Temp\210.tmp

Any help is greatly appreciated!

Thanks,
David

The fault does link to memory,if you want to overwrite the page-file,open
system properties,advanced,virtual-memory,set C: to "no page file",click
set 2X,close out,restart pc.Once in xp,go to run,type:cmd In cmd type:
Defrag C: Once thru,type:EXIT Open system properties,set C: to "let windows
manage" set 2X,close out,you'll get the prompt to overwrite
page-file,restart pc.
For in depth look at PAGE_FAULT,go
to:http://www.osronline.com/custom.cfm?...int.cfm&id=335

"datamstr" wrote:

During bootup, I am getting the fault messge "PAGE_FAULT_IN_NONPAGED_AREA". I
have been doing research and most of the answers I found are related to
memory errors or other hardware problems. I installed Trend Micro Internet
security 2008 and everything was working fine. The customer said she was
having a problem and when I went on site, I noticed that the system somehow
had a virus. I managed to get the virus removed, but now I am getting that
Page Fault. It is possible that the Pagefile is corrupted? Can you please
give me a sequence of steps to try? Also, the XP Pro system does boot in Safe
Mode just fine.

Results of the AV Scan:
Fail to Clean [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Success Delete [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Fail to Clean [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Success Delete [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Fail to Clean [ PAK_Generic.001]( 1) from C:\WINDOWS\system32\powerxt.dll
Fail to Clean [ TROJ_SRIZBI.AP]( 1) from C:\WINDOWS\Temp\210.tmp
Success Delete [ TROJ_SRIZBI.AP]( 1) from C:\WINDOWS\Temp\210.tmp

Any help is greatly appreciated!

Thanks,
David

The malware your post mentioned are not viruses. You should not rely on
a single product to detect and remove malware.
http://www.elephantboycomputers.com/...moving_Malware

You also need to make sure there are no remaining infections in System
Restore points.

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793437.aspx

0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
(Click to consult the online MSDN article.)
Requested data was not in memory. An invalid system memory address was
referenced. Defective memory (including main memory, L2 RAM cache, video
RAM) or incompatible software (including remote control and antivirus
software) might cause this Stop message, as may other hardware problems
(e.g., incorrect SCSI termination or a flawed PCI card).
Source: http://aumha.org/a/stop.htm

Remove the dust bunnies and test the RAM memory
http://www.elephantboycomputers.com/...ardware_Tshoot

Check the hard drive for bad sectors by running chkdsk /f /r

Check the System log of Event Viewer for Error Reports.

Please post copies of all Error and Warning Reports appearing in the
System log in Event Viewer for the last boot. No Information Reports or
Duplicates please. Indicate which also appear in a previous boot.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not checked.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

datamstr wrote:
During bootup, I am getting the fault messge
"PAGE_FAULT_IN_NONPAGED_AREA". I have been doing research and most of
the answers I found are related to memory errors or other hardware
problems. I installed Trend Micro Internet security 2008 and
everything was working fine. The customer said she was having a
problem and when I went on site, I noticed that the system somehow
had a virus. I managed to get the virus removed, but now I am getting
that Page Fault. It is possible that the Pagefile is corrupted? Can
you please give me a sequence of steps to try? Also, the XP Pro
system does boot in Safe Mode just fine.

Results of the AV Scan:
Fail to Clean [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Success Delete [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Fail to Clean [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Success Delete [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Fail to Clean [ PAK_Generic.001]( 1) from
C:\WINDOWS\system32\powerxt.dll Fail to Clean [ TROJ_SRIZBI.AP](
1) from C:\WINDOWS\Temp\210.tmp
Success Delete [ TROJ_SRIZBI.AP]( 1) from C:\WINDOWS\Temp\210.tmp

Any help is greatly appreciated!

Thanks,
David

Hi Andrew,

Thanks for your help!

I followed the steps you outlined, but the defrager did not run. I think
because in Safe Mode, it can't. I still had to boot in Safe Mode after
overwriting the page-file.

The last time I tried to boot XP normally, a different error appeared:

STOP 0x000000BE
"An attempt was made to write to Read Only Memory"

I will post a response with some more information to Gerry's post.

Thanks,
David


"Andrew E." wrote:

The fault does link to memory,if you want to overwrite the page-file,open
system properties,advanced,virtual-memory,set C: to "no page file",click
set 2X,close out,restart pc.Once in xp,go to run,type:cmd In cmd type:
Defrag C: Once thru,type:EXIT Open system properties,set C: to "let windows
manage" set 2X,close out,you'll get the prompt to overwrite
page-file,restart pc.
For in depth look at PAGE_FAULT,go
to:http://www.osronline.com/custom.cfm?...int.cfm&id=335

"datamstr" wrote:

During bootup, I am getting the fault messge "PAGE_FAULT_IN_NONPAGED_AREA". I
have been doing research and most of the answers I found are related to
memory errors or other hardware problems. I installed Trend Micro Internet
security 2008 and everything was working fine. The customer said she was
having a problem and when I went on site, I noticed that the system somehow
had a virus. I managed to get the virus removed, but now I am getting that
Page Fault. It is possible that the Pagefile is corrupted? Can you please
give me a sequence of steps to try? Also, the XP Pro system does boot in Safe
Mode just fine.

Results of the AV Scan:
Fail to Clean [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Success Delete [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Fail to Clean [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Success Delete [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Fail to Clean [ PAK_Generic.001]( 1) from C:\WINDOWS\system32\powerxt.dll
Fail to Clean [ TROJ_SRIZBI.AP]( 1) from C:\WINDOWS\Temp\210.tmp
Success Delete [ TROJ_SRIZBI.AP]( 1) from C:\WINDOWS\Temp\210.tmp

Any help is greatly appreciated!

Thanks,
David

Hi Gerry,

Thanks so much for your help!

I did not get a chance to run the hardware troubleshooter yet.
I tried running chkdsk upon reboot, but it does not run and gives the message:
"type of filesystem is raw" so it can't run chkdsk.
I looked in "Computer Management - Disk Management" and the disk shows to
be healthy and is a NTFS partition. So why can't chkdsk run? Maybe a driver
problem?

I booted the system normally to see if something in the event logs would be
helpful.
After the STOP error appeared, I rebooted into Safe Mode an examined the
System Event Log. Results:

Here is the BugCheck System Log Event:
The computer has rebooted from a bugcheck. The bugcheck was: 0x100000be
(0xf1b34af8, 0x03e64121, 0xf8b01980, 0x0000000a). A dump was saved in:
C:\WINDOWS\Minidump\Mini091908-03.dmp.

Here is the driver load fail event in the System Log Event:
Application popup: : \SystemRoot\system32\spndt.sys failed to load

I have not tried sigverif.exe yet.

Thanks,
David


"Gerry" wrote:

The malware your post mentioned are not viruses. You should not rely on
a single product to detect and remove malware.
http://www.elephantboycomputers.com/...moving_Malware

You also need to make sure there are no remaining infections in System
Restore points.

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793437.aspx

0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
(Click to consult the online MSDN article.)
Requested data was not in memory. An invalid system memory address was
referenced. Defective memory (including main memory, L2 RAM cache, video
RAM) or incompatible software (including remote control and antivirus
software) might cause this Stop message, as may other hardware problems
(e.g., incorrect SCSI termination or a flawed PCI card).
Source: http://aumha.org/a/stop.htm

Remove the dust bunnies and test the RAM memory
http://www.elephantboycomputers.com/...ardware_Tshoot

Check the hard drive for bad sectors by running chkdsk /f /r

Check the System log of Event Viewer for Error Reports.

Please post copies of all Error and Warning Reports appearing in the
System log in Event Viewer for the last boot. No Information Reports or
Duplicates please. Indicate which also appear in a previous boot.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not checked.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

datamstr wrote:
During bootup, I am getting the fault messge
"PAGE_FAULT_IN_NONPAGED_AREA". I have been doing research and most of
the answers I found are related to memory errors or other hardware
problems. I installed Trend Micro Internet security 2008 and
everything was working fine. The customer said she was having a
problem and when I went on site, I noticed that the system somehow
had a virus. I managed to get the virus removed, but now I am getting
that Page Fault. It is possible that the Pagefile is corrupted? Can
you please give me a sequence of steps to try? Also, the XP Pro
system does boot in Safe Mode just fine.

Results of the AV Scan:
Fail to Clean [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Success Delete [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Fail to Clean [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Success Delete [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Fail to Clean [ PAK_Generic.001]( 1) from
C:\WINDOWS\system32\powerxt.dll Fail to Clean [ TROJ_SRIZBI.AP](
1) from C:\WINDOWS\Temp\210.tmp
Success Delete [ TROJ_SRIZBI.AP]( 1) from C:\WINDOWS\Temp\210.tmp

Any help is greatly appreciated!

Thanks,
David

Background information on Stop Error message
http://msdn.microsoft.com/en-us/library/ms796175.aspx

0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY
(A driver attempted to write to read-only memory. Commonly occurs after
installing a faulty device driver, system service, or firmware. If a
driver file is named in the error message, try to correct the problem by
disabling, removing, or rolling back the driver.
datamstr wrote:
Source: http://aumha.org/a/stop.htm

http://www.fileresearchcenter.com/S/...SYS-13278.html

http://www.z-a-recovery.com/art-raw-filesystem.htm
This link explains the chkdsk message. Note most downloadable tools here
are not free.

Also another data recovery tool -not free:
http://www.easeus.com/datarecoverywi...-raw-drive.htm

Are you able to back up important data or are you prevented from doing
that? Do you have a Windows XP CD which would enable you to reformat the
drive and start again?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Hi Gerry,

Thanks so much for your help!

I did not get a chance to run the hardware troubleshooter yet.
I tried running chkdsk upon reboot, but it does not run and gives the
message: "type of filesystem is raw" so it can't run chkdsk.
I looked in "Computer Management - Disk Management" and the disk
shows to
be healthy and is a NTFS partition. So why can't chkdsk run? Maybe a
driver problem?

I booted the system normally to see if something in the event logs
would be helpful.
After the STOP error appeared, I rebooted into Safe Mode an examined
the System Event Log. Results:

Here is the BugCheck System Log Event:
The computer has rebooted from a bugcheck. The bugcheck was:
0x100000be (0xf1b34af8, 0x03e64121, 0xf8b01980, 0x0000000a). A dump
was saved in: C:\WINDOWS\Minidump\Mini091908-03.dmp.

Here is the driver load fail event in the System Log Event:
Application popup: : \SystemRoot\system32\spndt.sys failed to load

I have not tried sigverif.exe yet.

Thanks,
David


"Gerry" wrote:

The malware your post mentioned are not viruses. You should not rely
on a single product to detect and remove malware.
http://www.elephantboycomputers.com/...moving_Malware

You also need to make sure there are no remaining infections in
System Restore points.

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793437.aspx

0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
(Click to consult the online MSDN article.)
Requested data was not in memory. An invalid system memory address
was referenced. Defective memory (including main memory, L2 RAM
cache, video RAM) or incompatible software (including remote control
and antivirus software) might cause this Stop message, as may other
hardware problems (e.g., incorrect SCSI termination or a flawed PCI
card).
Source: http://aumha.org/a/stop.htm

Remove the dust bunnies and test the RAM memory
http://www.elephantboycomputers.com/...ardware_Tshoot

Check the hard drive for bad sectors by running chkdsk /f /r

Check the System log of Event Viewer for Error Reports.

Please post copies of all Error and Warning Reports appearing in the
System log in Event Viewer for the last boot. No Information Reports
or Duplicates please. Indicate which also appear in a previous boot.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer.

A tip for posting copies of Error Reports! Run Event Viewer and
double click on the error you want to copy. In the window, which
appears is a button resembling two pages. Click the button and close
Event Viewer.Now start your message (email) and do a paste into the
body of the message. Make sure this is the first paste after exiting
from
Event Viewer.

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not
checked.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

datamstr wrote:
During bootup, I am getting the fault messge
"PAGE_FAULT_IN_NONPAGED_AREA". I have been doing research and most
of the answers I found are related to memory errors or other
hardware problems. I installed Trend Micro Internet security 2008
and everything was working fine. The customer said she was having a
problem and when I went on site, I noticed that the system somehow
had a virus. I managed to get the virus removed, but now I am
getting that Page Fault. It is possible that the Pagefile is
corrupted? Can you please give me a sequence of steps to try? Also,
the XP Pro system does boot in Safe Mode just fine.

Results of the AV Scan:
Fail to Clean [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Success Delete [ VBS_FAKEALER.HJ]( 1) from C:\Documents and
Settings\Linda\Local Settings\Temp\.ttE.tmp.vbs
Fail to Clean [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Success Delete [ TROJ_AGENT.AKEU]( 1) from
C:\WINDOWS\system32\drivers\c09210a0.sys
Fail to Clean [ PAK_Generic.001]( 1) from
C:\WINDOWS\system32\powerxt.dll Fail to Clean [ TROJ_SRIZBI.AP](
1) from C:\WINDOWS\Temp\210.tmp
Success Delete [ TROJ_SRIZBI.AP]( 1) from
C:\WINDOWS\Temp\210.tmp

Any help is greatly appreciated!

Thanks,
David