BSOD on new build - usually after logging in

LGS141 · Apr 3, 2013

Hi all,

I built my PC back in February and get a BSOD pretty much at least once a week. Sometimes it can be more often, other times it doesn't happen for a couple of weeks. All components are brand new. This usually crashes just after logging in, though not instantly. The usual error I get is PAGE_FAULT_IN_NON_PAGED_AREA.

I've tried the following to resolve this:

- Reinstalled OS (Windows 8 64bit) twice, though I cannot attribute any particular install/driver to the crashes
- Downloaded and installed driver updates from motherboard manufacturer
- Downloaded and installed driver updates from graphics card manufacturer
- Downloaded and installed driver updates for other components from manufacturer (Intel, Realtek...)
- Ran memtest, which passed 8 cycles
- Ran SFC /Scannow, all was clean

Now I've found your forums, I tried a couple of other things:

- Ran verifier.exe as suggested, I got BSODs as soon as I logged in. Attached a dump from one of the crashes.
- Ran sfdiagnostic tool, the results of which I have attached here.
- After this, I ran SFC /Scannow again and it found corrupt files, I've attached the log here.

Please note I have a few dump files in my minidump folder from other computers for analysing purposes, so the relevant dump files are the latest four from 25/03/2013 - 03/04/2013.

Would appreciate any help somebody may be able to give.

usasma · Apr 3, 2013

This is gonna be sorta backwards as you've run Driver Verifier.....

Verifier blames IOMap64.sys - a driver component of Asus Smart Doctor/iTracker 2. Please uninstall this program from your system and see if the BSOD's stop.

Don't forget to turn Driver Verifier off. To do this, open verifier.exe and select "Delete existing settings". Then click on "Finish" and reboot the system for the changes to take effect.

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable! :

lmimirr.sys Tue Apr 10 18:32:45 2007 (461C108D)
RemotelyAnywhere Mirror Miniport Driver or LogMeIn Mirror Miniport Driver
http://www.carrona.org/drivers/driver.php?id=lmimirr.sys

RaInfo.sys Fri Jan 4 13:57:14 2008 (477E818A)
LogMeIn/RemotelyAnywhere Kernel Information Provider
http://www.carrona.org/drivers/driver.php?id=RaInfo.sys

LMIRfsDriver.sys Mon Jul 14 12:26:56 2008 (487B7E50)
RemotelyAnywhere Mirror Miniport Driver or LogMeIn Mirror Miniport Driver
http://www.carrona.org/drivers/driver.php?id=LMIRfsDriver.sys

KMWDFILTER.sys Wed Apr 29 02:20:48 2009 (49F7F1C0)
UASSOFT.com HID (mouse) Driver
http://www.carrona.org/drivers/driver.php?id=KMWDFILTER.sys

ElbyCDIO.sys Thu Dec 16 17:58:13 2010 (4D0A9985)
CDRTools/ElbyCDIO/DVD Region Killer/VirtualCloneDrive (elby CloneDVD™ 2)/AnyDVD
http://www.carrona.org/drivers/driver.php?id=ElbyCDIO.sys

VClone.sys Sat Jan 15 11:21:04 2011 (4D31C970)
VirtualCloneCD Driver by Elaborate Bytes AG
http://www.carrona.org/drivers/driver.php?id=VClone.sys

speedfan.sys Fri Mar 18 12:08:46 2011 (4D83838E)
SpeedFan
http://www.carrona.org/drivers/driver.php?id=speedfan.sys

WPRO_41_2001.sys Mon Nov 7 16:04:48 2011 (4EB847F0)
CACE Technologies WinPcap Packet Driver
http://www.carrona.org/drivers/driver.php?id=WPRO_41_2001.sys

If this doesn't stop the BSOD's, please post back and we'll try other tests.

Analysis:
The following is for informational purposes only.

Code:

[font=lucida console]**************************Wed Apr  3 13:55:20.220 2013 (UTC - 4:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\040313-15656-01.dmp]
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Built by: [B]9200[/B].16496.amd64fre.win8_gdr.130108-1504
System Uptime:[B]0 days 0:00:50.890[/B]
*** WARNING: Unable to verify timestamp for IOMap64.sys
*** ERROR: Module load completed but symbols could not be loaded for IOMap64.sys
Probably caused by :[B]IOMap64.sys ( IOMap64+3525 )[/B]
BugCheck [B]C4, {83, 0, 1000000, 18a}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000C4]DRIVER_VERIFIER_DETECTED_VIOLATION (c4)[/url]
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
Arguments: 
Arg1: 0000000000000083, MmMapIoSpace called to map, but the caller hasn't locked down the MDL pages.
Arg2: 0000000000000000, Starting physical address to map.
Arg3: 0000000001000000, Number of bytes to map.
Arg4: 000000000000018a, The first page frame number that isn't locked down.
BUGCHECK_STR:  0xc4_83
PROCESS_NAME:  Monitor.exe
FAILURE_BUCKET_ID: [B]0xc4_83_VRF_IOMap64+3525[/B]
CPUID:        "Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz"
MaxSpeed:     3400
CurrentSpeed: [B]3392[/B]
  BIOS Version                  P1.60
  BIOS Release Date             09/20/2012
  Manufacturer                  To Be Filled By O.E.M.
  Product Name                  To Be Filled By O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Wed Apr  3 13:54:08.079 2013 (UTC - 4:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\040313-10875-01.dmp]
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Built by: [B]9200[/B].16496.amd64fre.win8_gdr.130108-1504
System Uptime:[B]0 days 0:00:49.747[/B]
*** WARNING: Unable to verify timestamp for IOMap64.sys
*** ERROR: Module load completed but symbols could not be loaded for IOMap64.sys
Probably caused by :[B]IOMap64.sys ( IOMap64+3525 )[/B]
BugCheck [B]C4, {83, 0, 1000000, 18a}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000C4]DRIVER_VERIFIER_DETECTED_VIOLATION (c4)[/url]
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
Arguments: 
Arg1: 0000000000000083, MmMapIoSpace called to map, but the caller hasn't locked down the MDL pages.
Arg2: 0000000000000000, Starting physical address to map.
Arg3: 0000000001000000, Number of bytes to map.
Arg4: 000000000000018a, The first page frame number that isn't locked down.
BUGCHECK_STR:  0xc4_83
PROCESS_NAME:  Monitor.exe
FAILURE_BUCKET_ID: [B]0xc4_83_VRF_IOMap64+3525[/B]
CPUID:        "Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz"
MaxSpeed:     3400
CurrentSpeed: [B]3392[/B]
  BIOS Version                  P1.60
  BIOS Release Date             09/20/2012
  Manufacturer                  To Be Filled By O.E.M.
  Product Name                  To Be Filled By O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[font=lucida console]**************************Wed Apr  3 13:55:20.220 2013 (UTC - 4:00)**************************
[COLOR=RED][B]lmimirr.sys                 Tue Apr 10 18:32:45 2007 (461C108D)[/B][/COLOR]
[COLOR=RED][B]RaInfo.sys                  Fri Jan  4 13:57:14 2008 (477E818A)[/B][/COLOR]
[COLOR=RED][B]LMIRfsDriver.sys            Mon Jul 14 12:26:56 2008 (487B7E50)[/B][/COLOR]
[COLOR=RED][B]KMWDFILTER.sys              Wed Apr 29 02:20:48 2009 (49F7F1C0)[/B][/COLOR]
[COLOR=RED][B]IOMap64.sys                 Thu Feb  4 20:55:34 2010 (4B6B7A96)[/B][/COLOR]
[COLOR=RED][B]ElbyCDIO.sys                Thu Dec 16 17:58:13 2010 (4D0A9985)[/B][/COLOR]
[COLOR=RED][B]VClone.sys                  Sat Jan 15 11:21:04 2011 (4D31C970)[/B][/COLOR]
[COLOR=RED][B]speedfan.sys                Fri Mar 18 12:08:46 2011 (4D83838E)[/B][/COLOR]
[COLOR=RED][B]WPRO_41_2001.sys            Mon Nov  7 16:04:48 2011 (4EB847F0)[/B][/COLOR]
ISCTD64.sys                 Fri May  4 20:44:01 2012 (4FA477D1)
ikbevent.sys                Tue Jun 12 15:22:18 2012 (4FD796EA)
HECIx64.sys                 Mon Jul  2 18:14:58 2012 (4FF21D62)
xusb22.sys                  Wed Jul 25 22:26:57 2012 (5010AAF1)
dump_storahci.sys           Wed Jul 25 22:30:35 2012 (5010ABCB)
imsevent.sys                Thu Aug 16 19:20:04 2012 (502D8024)
avgrkx64.sys                Thu Sep 13 20:41:40 2012 (50527D44)
avgloga.sys                 Thu Sep 20 21:23:51 2012 (505BC1A7)
avgldx64.sys                Mon Oct  1 21:05:50 2012 (506A3DEE)
avgidsha.sys                Sun Oct 14 21:22:54 2012 (507B656E)
avgidsdrivera.sys           Mon Oct 22 06:47:11 2012 (5085242F)
intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)
avgmfx64.sys                Thu Nov 15 17:03:50 2012 (50A566C6)
avgwfpa.sys                 Mon Nov 26 17:09:35 2012 (50B3E89F)
nvhda64v.sys                Wed Dec 19 00:41:41 2012 (50D15395)
Rt630x64.sys                Thu Dec 27 19:04:06 2012 (50DCE1F6)
VBoxNetFlt.sys              Wed Feb 20 10:34:52 2013 (5124ED1C)
VBoxUSBMon.sys              Wed Feb 20 10:34:53 2013 (5124ED1D)
VBoxDrv.sys                 Wed Feb 20 10:36:24 2013 (5124ED78)
nvlddmkm.sys                Thu Mar 14 21:37:00 2013 (51427B3C)
[/font]

LGS141 · Apr 3, 2013

Thanks for the reply. I've already disabled verifier.

The only Asus software I have that is similar to what you've mentioned is Asus GPU Tweak. I've uninstalled it.

I will update the drivers tomorrow - one thing - I uninstalled Speedfan a while back, so do you know how I can safely uninstall the driver?

usasma · Apr 4, 2013

Don't worry about it for now. It's probably not the cause - and if it is, it'll rear it's ugly little head again (so we can squash it then!)

I'll post instructions on how to safely remove it later on today (in case you still want to do it).

LGS141 · Apr 4, 2013

usasma said:
Don't worry about it for now. It's probably not the cause - and if it is, it'll rear it's ugly little head again (so we can squash it then!)

I'll post instructions on how to safely remove it later on today (in case you still want to do it).

One thing I do remember now, actually, is that SpeedFan was one of the original programs I installed after installing the OS.

I'm sure I installed it after the two reinstalls of the OS as well, but removed it because I kept getting regular (almost every time I logged in) BSODS. When I uninstalled it, I get a lot less BSODS and crashes.

usasma · Apr 4, 2013

Got a minute before I left for work, so here's how to safely remove it:

1) Create a Restore Point using System Restore
2) Create a Repair disc:
Win8 - Press "WIN" and "R" to open the Run dialog...type "RECDISC" (without the quotes) and press ENTER
3) Test the System Repair disc to make sure that you can get to the System Restore entry when you boot from the disk (you may also want to try actually using System Restore to make sure that it works)
4) Download this free program (Autoruns for Windows) and use it to disable any instances of speedfan.sys that are starting (or any other SpeedFan entries) (DO NOT DELETE - only disabled by removing the checkmark in the left hand column)
5) Check in Device Manager (to include showing hidden devices from the View menu item) and ensure that any instances of speedfan.sys (or any other SpeedFan entries) are "Uninstalled" (DO NOT DISABLE THESE).
6) Check in the Services applet (services.msc) to be sure any instances of speedfan.sys or any other SpeedFan entries are disabled.
7) Go to C:\Windows\System32\drivers and rename the speedfan.sys driver to speedfan.BAD

In the event that the system doesn't boot:

1) Boot from the System Repair disc and use the Command Prompt option to rename speedfan.BAD to speedfan.sys
2) Boot from the System Repair disc and use the System Restore option to restore the system to a point before the changes were made.

Good luck!

BSOD on new build - usually after logging in

LGS141

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One

LGS141

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One

LGS141

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One