locked
Windows 7 Enterprise x64 - BSOD - 0x50 Page Fault in non paged area - NTFS.SYS - Lenovo T410 deployment RRS feed

  • Question

  • I recently created an image that we have used for about 50 Lenovo T410 Thinkpad laptops with Windows 7 Enterprise x64.  This image was very simple: the OS (as stated above), Office 2007 and all updates for Win7 and Office.  I also used the ThinkVantage System update to ensure I have the latest driver for everything in the system.  I also flashed the BIOS to the current version.  I have swapped out the hard drive to another working Lenovo and got the same issue.  I ran a memory test (came up clean), hard drive check (came up clean).  I fully removed any anti-virus software to ensure that was not conflicting.

    In the last few days, three separate people have contacted our help center (I work at a college) saying their brand new thinkpad was suddenly blue screening with a 0x50 Page Fault In Non Paged Area and referenced NTFS.SYS (they were all based on this image I created).  All of these users were running fine when all of a sudden this started to happen.  I spent all day researching the issue, trying to figure out what was causing it.  I verified again that all drivers were updated.  I can boot in safe mode but in normal mode, the computer boots up and if I just let it sit at the "Press CTRL-ALT-DELETE" to log in (we are on a domain) it will blue screen after a few minutes, or if I log in, it will blue screen after a few minutes.

    I found through process of elimination that if I disabled the "Superfetch" and "Microsoft Software Shadow Copy Provider" service, I could get the computer to be stable for a LOT longer, but still not 100% and it would eventually give the same blue screen.  I'm not saying these services have anything to do with it, but whatever the issue is, seems to be activated a lot sooner when those services are running.

    Here is a link to one of the MINI-Dump files it created when it blue screened:

    http://xythos.gordon.edu/xythoswfs/webui/_xy-123286_1-t_uWPKpOEB

    I have many of these Lenovo laptops with the same base image that don't seem to have the problem (yet), but I'm scared that since three have all reported the issue within 1-2 week of them having it, that something is happening and causing it to break.  Most of our users are pretty low end users, they are not installing a lot of things, just web, email and documents.

    Thanks for any help you can provide!

    Chris

    Friday, July 23, 2010 10:20 PM

Answers

  • So this is very interesting, I just found out that my crashes seem to do with the System Volume Information folder.  I booted off a CD, renamed the System Volume Information folder to "Old System Volume Information" and then the computer booted fine.  Obviously I lost any system restore points, but now the computer is fine.  The question is, what messed up this folder in such a way that caused the computers to blue screen after 5-15 days in the field?  We do use a backup program called "CrashPlan Pro" (www.crashplan.com) and I have contacted them to see if this connected to their product, but I have only had this problem on our new Lenovo computers and we have CrashPlan on hundreds of computers.

    Once I "fix" the computer, it seems to be OK, at least for now.  I guess time will tell if the issue comes back again.  If so, not sure what to do long term to fix it or how to track down what is causing it.  I guess I could disable system restore (I don't really like that idea).

    I think this explains why the system would blue screen even when running the repair windows option, since that tries to access this System Volume Information folder.

    Thoughts?

    • Marked as answer by Arthur Xie Tuesday, August 3, 2010 8:32 AM
    Monday, July 26, 2010 8:13 PM

All replies

  • In the following thread involving a T410 the problematic program causing the BSOD was the ThinkVantage Active Protection program:

    http://social.answers.microsoft.com/Forums/en-US/w7repair/thread/069a2904-bae5-4a9d-a275-51673a6af1d8

    Although the BSOD in the thread was different the same  ThinkVantage Active Protection program may be causing your issue.

    Can you uninstall the ThinkVantage Active Protection program on one of the computers having the issue and see if the problem resolves? 

    Saturday, July 24, 2010 12:36 AM
  • Thank you for your reply and your time.  I tried uninstalling the ThinkVantage Active Protection program and still had the same issue.
    Saturday, July 24, 2010 1:11 AM
  • You're welcome for the help.

    That the computer works in Safe Mode gives a good indication the problem is a third party driver that loads at startup.

    Can you first try a "clean boot" and see if that resolves the problem, if necessary configure the clean boot in Safe Mode:

    http://support.microsoft.com/kb/929135

    Follow Step 1 to clean boot and Step 7 to return to return to a normal startup.

     

     

    Saturday, July 24, 2010 2:35 AM
  • Download windbg (just get one of the older versions instead of the whole WDK).  File->open crash dump.  Click or type  '!analyze -v'.  You might get the answer.

     

    Saturday, July 24, 2010 4:21 AM
  • Thanks!  I did more or less the steps listed in that Microsoft Article and seemed to narrow it down to the computer working fine if I disabled the "Microsoft Software Shadow Copy Provider" service and the "Superfetch" service.  I have to disable both to get it to be stable, if either one is active, the computer will blue-screen before I even get the full desktop loaded, or will reboot at the login screen if I just let it sit there.

    I feel like in my testing one time it did give the blue-screen when I had those two services disabled, but I can't reproduce that now, so maybe I was confused.  Since these are two microsoft services, I was not sure what to try next.

    Saturday, July 24, 2010 11:44 AM
  • I downloaded winbg (I have never used it before, but I think I figured it out).  I don't see that it is giving me much useful information, but here is what it gave me (if I ran it incorrectly, please let me know):


    Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [c:\windows\minidump\072310-21886-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is: c:\windows
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
    Machine Name:
    Kernel base = 0xfffff800`02e0b000 PsLoadedModuleList = 0xfffff800`03048e50
    Debug session time: Fri Jul 23 21:37:57.294 2010 (GMT-4)
    System Uptime: 0 days 0:01:02.434
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffff98108902698, 0, fffff8800144b4e0, 5}


    Could not read faulting driver name
    Probably caused by : Ntfs.sys ( Ntfs!memmove+250 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff98108902698, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff8800144b4e0, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 0000000000000005, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b30e0
     fffff98108902698

    FAULTING_IP:
    Ntfs!memmove+250
    fffff880`0144b4e0 488b440af8      mov     rax,qword ptr [rdx+rcx-8]

    MM_INTERNAL_CODE:  5

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    TRAP_FRAME:  fffff88003399da0 -- (.trap 0xfffff88003399da0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000020 rbx=0000000000000000 rcx=fffff981089026c8
    rdx=ffffffffffffffd8 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8800144b4e0 rsp=fffff88003399f38 rbp=fffff98008902718
     r8=00000000ffffff68  r9=0000000007fffffb r10=fffff8a002266a90
    r11=fffff98008902760 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    Ntfs!memmove+0x250:
    fffff880`0144b4e0 488b440af8      mov     rax,qword ptr [rdx+rcx-8] ds:fffff981`08902698=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80002efa801 to fffff80002e7b600

    STACK_TEXT: 
    fffff880`03399c38 fffff800`02efa801 : 00000000`00000050 fffff981`08902698 00000000`00000000 fffff880`03399da0 : nt!KeBugCheckEx
    fffff880`03399c40 fffff800`02e796ee : 00000000`00000000 00000000`00000028 00000000`00000000 fffff880`015094a3 : nt! ?? ::FNODOBFM::`string'+0x40ecb
    fffff880`03399da0 fffff880`0144b4e0 : fffff880`0150a310 fffffa80`03b7e7a0 fffff880`03399f90 fffff8a0`00000400 : nt!KiPageFault+0x16e
    fffff880`03399f38 fffff880`0150a310 : fffffa80`03b7e7a0 fffff880`03399f90 fffff8a0`00000400 fffff8a0`0219f7c0 : Ntfs!memmove+0x250
    fffff880`03399f40 fffff880`0150adbc : fffff8a0`0219f7c0 fffff800`030205a0 fffff8a0`0219f7c0 00000000`00000000 : Ntfs!NtfsRestartInsertSimpleRoot+0x50
    fffff880`03399f80 fffff880`0150454f : fffffa80`03b7e7a0 fffffa80`0830b180 fffff880`0339a118 fffff880`0339a150 : Ntfs!InsertSimpleRoot+0xb8
    fffff880`0339a050 fffff880`014b8e17 : 00000000`00000000 fffff8a0`0219f7c0 fffff880`0339a118 fffff880`0339a1a8 : Ntfs!AddToIndex+0xcf
    fffff880`0339a0d0 fffff880`014bd665 : fffffa80`03b7e7a0 fffff8a0`0219f7c0 fffff8a0`021af0c8 fffffa80`00000000 : Ntfs!NtOfsAddRecords+0x167
    fffff880`0339a2b0 fffff880`01503ebc : fffffa80`03b7e7a0 fffff8a0`021af0c0 00000000`0003142c 00000000`00031430 : Ntfs!GetSecurityIdFromSecurityDescriptorUnsafe+0x1fd
    fffff880`0339a360 fffff880`0153c4be : fffffa80`03b7e7a0 fffffa80`0830b180 00000000`00000000 fffff980`08902d00 : Ntfs!NtfsCacheSharedSecurityByDescriptor+0xa0
    fffff880`0339a3b0 fffff880`014c28fd : fffffa80`03b7e7a0 fffffa80`0830b180 fffff800`030205a0 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x11130
    fffff880`0339a430 fffff880`0145d6c4 : fffffa80`03b7e7a0 fffff880`01487a00 fffffa80`03b7e7a0 fffff8a0`02264a90 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x4fe
    fffff880`0339a580 fffff880`0152ac66 : fffffa80`03b7e7a0 00000000`00000000 00000000`00000000 fffff8a0`02264a90 : Ntfs!NtfsInitializeDirectory+0x254
    fffff880`0339a690 fffff880`0151f90a : fffffa80`03b7e7a0 fffffa80`0830b180 00000000`00000000 fffffa80`0830b180 : Ntfs!NtfsInitializeExtendDirectory+0x3d6
    fffff880`0339a850 fffff880`014bbc79 : 00000000`00000000 fffffa80`082f4b40 00000000`00000001 00000000`00000000 : Ntfs!NtfsMountVolume+0x1691
    fffff880`0339ab90 fffff880`0144351d : 00000000`00000000 00000000`00000000 fffffa80`03b7e7a0 00000000`00000000 : Ntfs!NtfsCommonFileSystemControl+0x59
    fffff880`0339abd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspDispatch+0x2ad


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    Ntfs!memmove+250
    fffff880`0144b4e0 488b440af8      mov     rax,qword ptr [rdx+rcx-8]

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  Ntfs!memmove+250

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: Ntfs

    IMAGE_NAME:  Ntfs.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

    FAILURE_BUCKET_ID:  X64_0x50_Ntfs!memmove+250

    BUCKET_ID:  X64_0x50_Ntfs!memmove+250

    Followup: MachineOwner
    ---------

     

    Saturday, July 24, 2010 11:48 AM
  • Try loading the kernel dump instead (c:\windows\memory.dmp).  A cool thing you can do is File-> Symbol File Path ..., set it to 'srv*c:\symbols*http://msdl.microsoft.com/download/symbols'.  Then you can see all the function names in the stack.  Maybe it's just a hard drive problem if it happens in ntfs.sys?  Or try running verifier.exe on all the non-microsoft drivers.  The next blue screen might point to the true culprit.  Normally there's no memory protection between drivers, so the wrong driver name might be in the blue screen message.

    http://www.edbott.com/weblog/?p=576

     

    Saturday, July 24, 2010 10:57 PM
  • Hi JS2010.  I did try loading the kernel dump instead, but not seeing much that points me to a solution.  I will include everything it gave me at the end of this post.  I set the symbol file path as you described. 

    I do not think it is just a hard drive problem as: 1) It passes all hardware tests 2) This is happening on multiple identical machines with this same image 3) I have been using this machine now for about 24 hours and it is has been stable with those two services disabled (Superfetch and Microsoft Software Shadow Copy Provider).

    I then ran verifier and it said that I have no unsigned drivers and no drivers built for older versions of windows.  Again, this is a VERY CLEAN image, so that is why I'm so confused as to the issue.  I did not see a way to specifically run it on all non-microsoft drivers, but the fact that I have no unsigned drivers and no older drivers not made for Win7 Ent. x64 makes me wonder if it is a non-microsoft driver issue.

    Any other thoughts or did I miss anything you asked me to do?  Thanks again for all the help!!

    Here are the results when I analized the kernal dump as suggested:


    Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
    Machine Name:
    Kernel base = 0xfffff800`02e0b000 PsLoadedModuleList = 0xfffff800`03048e50
    Debug session time: Fri Jul 23 21:37:57.294 2010 (GMT-4)
    System Uptime: 0 days 0:01:02.434
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................................
    Loading User Symbols

    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffff98108902698, 0, fffff8800144b4e0, 5}

    Probably caused by : Ntfs.sys ( Ntfs!memmove+250 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff98108902698, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff8800144b4e0, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 0000000000000005, (reserved)

    Debugging Details:
    ------------------


    READ_ADDRESS:  fffff98108902698

    FAULTING_IP:
    Ntfs!memmove+250
    fffff880`0144b4e0 488b440af8      mov     rax,qword ptr [rdx+rcx-8]

    MM_INTERNAL_CODE:  5

    IMAGE_NAME:  Ntfs.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

    MODULE_NAME: Ntfs

    FAULTING_MODULE: fffff88001440000 Ntfs

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    TRAP_FRAME:  fffff88003399da0 -- (.trap 0xfffff88003399da0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000020 rbx=0000000000000000 rcx=fffff981089026c8
    rdx=ffffffffffffffd8 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8800144b4e0 rsp=fffff88003399f38 rbp=fffff98008902718
     r8=00000000ffffff68  r9=0000000007fffffb r10=fffff8a002266a90
    r11=fffff98008902760 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    Ntfs!memmove+0x250:
    fffff880`0144b4e0 488b440af8      mov     rax,qword ptr [rdx+rcx-8] ds:fffff981`08902698=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80002efa801 to fffff80002e7b600

    STACK_TEXT: 
    fffff880`03399c38 fffff800`02efa801 : 00000000`00000050 fffff981`08902698 00000000`00000000 fffff880`03399da0 : nt!KeBugCheckEx
    fffff880`03399c40 fffff800`02e796ee : 00000000`00000000 00000000`00000028 00000000`00000000 fffff880`015094a3 : nt! ?? ::FNODOBFM::`string'+0x40ecb
    fffff880`03399da0 fffff880`0144b4e0 : fffff880`0150a310 fffffa80`03b7e7a0 fffff880`03399f90 fffff8a0`00000400 : nt!KiPageFault+0x16e
    fffff880`03399f38 fffff880`0150a310 : fffffa80`03b7e7a0 fffff880`03399f90 fffff8a0`00000400 fffff8a0`0219f7c0 : Ntfs!memmove+0x250
    fffff880`03399f40 fffff880`0150adbc : fffff8a0`0219f7c0 fffff800`030205a0 fffff8a0`0219f7c0 00000000`00000000 : Ntfs!NtfsRestartInsertSimpleRoot+0x50
    fffff880`03399f80 fffff880`0150454f : fffffa80`03b7e7a0 fffffa80`0830b180 fffff880`0339a118 fffff880`0339a150 : Ntfs!InsertSimpleRoot+0xb8
    fffff880`0339a050 fffff880`014b8e17 : 00000000`00000000 fffff8a0`0219f7c0 fffff880`0339a118 fffff880`0339a1a8 : Ntfs!AddToIndex+0xcf
    fffff880`0339a0d0 fffff880`014bd665 : fffffa80`03b7e7a0 fffff8a0`0219f7c0 fffff8a0`021af0c8 fffffa80`00000000 : Ntfs!NtOfsAddRecords+0x167
    fffff880`0339a2b0 fffff880`01503ebc : fffffa80`03b7e7a0 fffff8a0`021af0c0 00000000`0003142c 00000000`00031430 : Ntfs!GetSecurityIdFromSecurityDescriptorUnsafe+0x1fd
    fffff880`0339a360 fffff880`0153c4be : fffffa80`03b7e7a0 fffffa80`0830b180 00000000`00000000 fffff980`08902d00 : Ntfs!NtfsCacheSharedSecurityByDescriptor+0xa0
    fffff880`0339a3b0 fffff880`014c28fd : fffffa80`03b7e7a0 fffffa80`0830b180 fffff800`030205a0 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x11130
    fffff880`0339a430 fffff880`0145d6c4 : fffffa80`03b7e7a0 fffff880`01487a00 fffffa80`03b7e7a0 fffff8a0`02264a90 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x4fe
    fffff880`0339a580 fffff880`0152ac66 : fffffa80`03b7e7a0 00000000`00000000 00000000`00000000 fffff8a0`02264a90 : Ntfs!NtfsInitializeDirectory+0x254
    fffff880`0339a690 fffff880`0151f90a : fffffa80`03b7e7a0 fffffa80`0830b180 00000000`00000000 fffffa80`0830b180 : Ntfs!NtfsInitializeExtendDirectory+0x3d6
    fffff880`0339a850 fffff880`014bbc79 : 00000000`00000000 fffffa80`082f4b40 00000000`00000001 00000000`00000000 : Ntfs!NtfsMountVolume+0x1691
    fffff880`0339ab90 fffff880`0144351d : 00000000`00000000 00000000`00000000 fffffa80`03b7e7a0 00000000`00000000 : Ntfs!NtfsCommonFileSystemControl+0x59
    fffff880`0339abd0 fffff800`02e88861 : fffff880`012fee00 fffff880`016b7000 fffff800`03020500 fffffa80`00000001 : Ntfs!NtfsFspDispatch+0x2ad
    fffff880`0339acb0 fffff800`03120a86 : ffffffff`ffffffff fffffa80`03b7a1a0 00000000`00000080 fffffa80`03b4d9e0 : nt!ExpWorkerThread+0x111
    fffff880`0339ad40 fffff800`02e59b06 : fffff880`031d3180 fffffa80`03b7a1a0 fffff880`031ddfc0 ffffffff`ffffffff : nt!PspSystemThreadStartup+0x5a
    fffff880`0339ad80 00000000`00000000 : fffff880`0339b000 fffff880`03395000 fffff880`03399320 00000000`00000000 : nt!KxStartSystemThread+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    Ntfs!memmove+250
    fffff880`0144b4e0 488b440af8      mov     rax,qword ptr [rdx+rcx-8]

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  Ntfs!memmove+250

    FOLLOWUP_NAME:  MachineOwner

    FAILURE_BUCKET_ID:  X64_0x50_Ntfs!memmove+250

    BUCKET_ID:  X64_0x50_Ntfs!memmove+250

    Followup: MachineOwner
    ---------

     

    Sunday, July 25, 2010 12:07 AM
  • Verifier -> create standard settings -> select driver names from a list

    Check the ones you want to debug.  They will run in a sandbox on reboot.  You can click Provider to sort by it.  Do you have some kind of 3rd party raid driver?

    This is also a good way just to list loaded drivers.

    Or google 'blue screen  Ntfs!memmove'


    Sunday, July 25, 2010 2:12 AM
  • Thanks!  I ran verifier on just the non-Microsoft drivers and then on every driver but don't get any different results.  If I leave the two services off that I spoke about, the computer seems fairly normal.  When I turn it on (even when using Verifier), just get the exact same blue screen (Page fault in non paged area - 0x50 and referencing ntfs.sys).

    I do not have any raid driver, again, all standard stuff - all updated drivers from the Lenovo site for the T410.

    I have done TONS of searching on Google of every possibility and have come up empty, so that is why I was turning to this forum.

    Thanks for your suggestions! 

    Any other ideas?

    Sunday, July 25, 2010 11:20 AM
  • Have you checked your RAM? For me it looks like the RAM is broken.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Sunday, July 25, 2010 12:55 PM
  • My other wild guess is use ide instead of ehci in the bios.

     

    Sunday, July 25, 2010 2:18 PM
  • Hi Andre - I have run extensive RAM tests and they all come back fine.  I even swapped the RAM with other RAM just to make sure.  Again, all the same result.
    Sunday, July 25, 2010 6:43 PM
  • Another interesting thing is that if I start the "Launch Startup Repiar (recommended)" option, as soon as it starts "Searching for problems..." it will give me the same blue screen (Page_Fault_In_nonpaged_Area x050 - NTFS.Sys).

    Sunday, July 25, 2010 7:04 PM
  • Err, verify ntfs.sys?

     

    Sunday, July 25, 2010 8:11 PM
  • Have you also checked the HDD for errors?
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Sunday, July 25, 2010 8:56 PM
  • Perhaps run the System File Checker to check for system file corruption - follow Option 1 in the following link:

    http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

    • Proposed as answer by Arthur Xie Tuesday, October 26, 2010 8:55 AM
    Sunday, July 25, 2010 9:04 PM
  • I previously checked the hard drive for errors - no errors found.
    Monday, July 26, 2010 12:54 AM
  • I already tried this as well, no file corruption found.
    Monday, July 26, 2010 12:55 AM
  • Can you provide some of the most recent minidump files such as from crashes after uninstalling the ThinkVantage Active Protection program.
    Monday, July 26, 2010 1:31 AM
  • So this is very interesting, I just found out that my crashes seem to do with the System Volume Information folder.  I booted off a CD, renamed the System Volume Information folder to "Old System Volume Information" and then the computer booted fine.  Obviously I lost any system restore points, but now the computer is fine.  The question is, what messed up this folder in such a way that caused the computers to blue screen after 5-15 days in the field?  We do use a backup program called "CrashPlan Pro" (www.crashplan.com) and I have contacted them to see if this connected to their product, but I have only had this problem on our new Lenovo computers and we have CrashPlan on hundreds of computers.

    Once I "fix" the computer, it seems to be OK, at least for now.  I guess time will tell if the issue comes back again.  If so, not sure what to do long term to fix it or how to track down what is causing it.  I guess I could disable system restore (I don't really like that idea).

    I think this explains why the system would blue screen even when running the repair windows option, since that tries to access this System Volume Information folder.

    Thoughts?

    • Marked as answer by Arthur Xie Tuesday, August 3, 2010 8:32 AM
    Monday, July 26, 2010 8:13 PM
  • Wrong owner or permissions?

     

    Monday, July 26, 2010 8:54 PM
  • Maybe any startup program that runs in kernel mode tries to load data from that folder. From the error message we can find that fault memory page is loaded when the issue occurs. I suspect that several data is not created by the system restore function in Windows 7 and the problem reason should be that.
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    • Proposed as answer by Nasri Messarra Monday, December 20, 2010 12:49 PM
    Thursday, July 29, 2010 9:21 AM
  • I had to reformat my T410i four times after "page fault in non page area" BSODs that I couldn't fix (safe mode not working, restore not helping, deletion of AVG files via dos, etc.). I never knew if it was because of AVG 2011 conflicting with the rescue program that came with my Lenovo or because of an external CD player (probably an issue with the non signed 32 bit driver).

     

    I finally decided to remove Windows 7 64 bits and everything that came with the T410i and installed Windows 7 32 bits. I also bought Norton Antivirus 2011. It will make your computer slower on startup but everything else is clockwork.

    My advise: if you're using some old equipment, downgrade to 32 bits. Windows 7 backup system is reliable and efficient enough, disable the rescue thing and use Windows'. Otherwise, think twice before installing old (32 bit programs) or plugging in old equipment.

    hope this helps,

     

    N. M.

    Monday, December 20, 2010 12:51 PM