Først og fremmest: denne lyder i samme kategori:
http://answers.microsoft.com/en-us/windows/forum/windows_10-update/page-fault-in-non-paged-area/3d003c23-5df6-403a-a0d6-d969db64e373Dernæst - mini-dump filerne er alle ulæselige, på nær de første fire. De siger nogenlunde samstemmende:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffc000af25c06e, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8012fc52d20, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
ffffc000af25c06e
FAULTING_IP:
TfSysMon+2d20
fffff801`2fc52d20 0fb70f movzx ecx,word ptr [rdi]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: TFService.exe
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre
TRAP_FRAME: ffffd001c04d64b0 -- (.trap 0xffffd001c04d64b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000168 rbx=0000000000000000 rcx=ffffc000af242000
rdx=ffffc000af25bf49 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8012fc52d20 rsp=ffffd001c04d6640 rbp=ffffc000af242008
r8=000000000000006e r9=fffff8012fc5caa1 r10=0000000000000000
r11=ffffe0002d59c840 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
TfSysMon+0x2d20:
fffff801`2fc52d20 0fb70f movzx ecx,word ptr [rdi] ds:00000000`00000000=0000
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff803a05ee4be to fffff803a05c17a0
STACK_TEXT:
ffffd001`c04d6258 fffff803`a05ee4be : 00000000`00000050 ffffc000`af25c06e 00000000`00000000 ffffd001`c04d64b0 : nt!KeBugCheckEx
ffffd001`c04d6260 fffff803`a04ea621 : 00000000`00000000 00000000`00000168 ffffd001`c04d64b0 ffffd001`c04d6300 : nt! ?? ::FNODOBFM::`string'+0x1e2be
ffffd001`c04d6350 fffff803`a05caabc : ffffc000`af242000 00000000`00000801 00000000`00000000 00001f80`01000001 : nt!MmAccessFault+0x5f1
ffffd001`c04d64b0 fffff801`2fc52d20 : ffffc000`aef3dfb0 00000000`00019e00 fffff801`2fc5cb00 00000000`00000001 : nt!KiPageFault+0x13c
ffffd001`c04d6640 ffffc000`aef3dfb0 : 00000000`00019e00 fffff801`2fc5cb00 00000000`00000001 ffffe000`2f0ac180 : TfSysMon+0x2d20
ffffd001`c04d6648 00000000`00019e00 : fffff801`2fc5cb00 00000000`00000001 ffffe000`2f0ac180 00000000`b4a00004 : 0xffffc000`aef3dfb0
ffffd001`c04d6650 fffff801`2fc5cb00 : 00000000`00000001 ffffe000`2f0ac180 00000000`b4a00004 00000000`00000010 : 0x19e00
ffffd001`c04d6658 00000000`00000001 : ffffe000`2f0ac180 00000000`b4a00004 00000000`00000010 fffff801`2fc52b65 : TfSysMon+0xcb00
ffffd001`c04d6660 ffffe000`2f0ac180 : 00000000`b4a00004 00000000`00000010 fffff801`2fc52b65 fffff801`2fc5cb00 : 0x1
ffffd001`c04d6668 00000000`b4a00004 : 00000000`00000010 fffff801`2fc52b65 fffff801`2fc5cb00 ffffe000`0000cf00 : 0xffffe000`2f0ac180
ffffd001`c04d6670 00000000`00000010 : fffff801`2fc52b65 fffff801`2fc5cb00 ffffe000`0000cf00 ffffc000`af242000 : 0xb4a00004
ffffd001`c04d6678 fffff801`2fc52b65 : fffff801`2fc5cb00 ffffe000`0000cf00 ffffc000`af242000 00000000`00000000 : 0x10
ffffd001`c04d6680 fffff801`2fc5cb00 : ffffe000`0000cf00 ffffc000`af242000 00000000`00000000 00000000`00000000 : TfSysMon+0x2b65
ffffd001`c04d6688 ffffe000`0000cf00 : ffffc000`af242000 00000000`00000000 00000000`00000000 fffff801`2fc52ba0 : TfSysMon+0xcb00
ffffd001`c04d6690 ffffc000`af242000 : 00000000`00000000 00000000`00000000 fffff801`2fc52ba0 fffffa80`03d245c0 : 0xffffe000`0000cf00
ffffd001`c04d6698 00000000`00000000 : 00000000`00000000 fffff801`2fc52ba0 fffffa80`03d245c0 fffff803`a04f6390 : 0xffffc000`af242000
STACK_COMMAND: kb
FOLLOWUP_IP:
TfSysMon+2d20
fffff801`2fc52d20 0fb70f movzx ecx,word ptr [rdi]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: TfSysMon+2d20
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: TfSysMon
IMAGE_NAME: TfSysMon.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d6325eb
FAILURE_BUCKET_ID: AV_TfSysMon+2d20
BUCKET_ID: AV_TfSysMon+2d20
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_tfsysmon+2d20
FAILURE_ID_HASH: {0a44d4ac-6138-71da-edd0-a5948d12afd0}
Followup: MachineOwner
---------
FAILURE_ID_HASH_STRING: km:av_tfsysmon+2d3f
FAILURE_ID_HASH: {c80b33c1-eb1e-ccb7-17d1-a1563fbb5ee0}
Followup: MachineOwner
_______________________________________________________________
Ovenstående er en lang smørre, der primært er sat ind, i fald der er andre der kan få øje på noget, jeg ikke lige har set.
Summa summarum er Windows altså sur på TfSysMon.sys, der ser ud til at være en inkompatibel Windows 8 driver.
Og da nettet siger den hører til ThreatFire PC-Tools, er det den du skal finde og afinstallere - eller som nødsituation, kan du omdøbe sys-filen til tfsysmon.sys.old - men du skal først finde den.
Den ligger sandsynligvis i c:\windows\system eller c:\windows\system32