1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

BSOD from win32k.sys

Discussion in 'Windows 7' started by FatalExceptionX, Feb 7, 2011.

Thread Status:
Not open for further replies.
  1. FatalExceptionX

    FatalExceptionX Thread Starter

    Joined:
    Aug 19, 2009
    Messages:
    39
    Hey all, been getting at least 2 BSOD's a day, started a few days ago, heres my crash dump.

    Loading Dump File [C:\Users\Exceptions\Desktop\020711-17674-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Machine Name:
    Kernel base = 0xfffff800`02c0d000 PsLoadedModuleList = 0xfffff800`02e4ae50
    Debug session time: Mon Feb 7 16:51:43.184 2011 (UTC - 6:00)
    System Uptime: 0 days 2:25:39.511
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .......................................
    Loading User Symbols
    Loading unloaded module list
    ..........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1A, {41284, fffff70440015001, 426da, fffff70001080000}

    Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041284, A PTE or the working set list is corrupt.
    Arg2: fffff70440015001
    Arg3: 00000000000426da
    Arg4: fffff70001080000

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x1a_41284

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: chrome.exe

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from fffff80002cd23b3 to fffff80002c7d740

    STACK_TEXT:
    fffff880`07cbc278 fffff800`02cd23b3 : 00000000`0000001a 00000000`00041284 fffff704`40015001 00000000`000426da : nt!KeBugCheckEx
    fffff880`07cbc280 fffff800`02cb0379 : fffffa80`0ba1a3f8 fffff6fb`822000a8 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4a83
    fffff880`07cbc2c0 fffff800`02cb0cf4 : fffffa80`00c778e0 00000000`00000001 fffff6fb`822000a8 fffff704`40015000 : nt!MiTerminateWsle+0x29
    fffff880`07cbc300 fffff800`02cb0a4b : 00000014`00000000 fffff680`00027000 80000000`427da863 00000000`0000001c : nt!MiDeleteValidSystemPte+0x1a4
    fffff880`07cbc400 fffff800`02c97125 : fffffa80`0ba1a3f8 fffffa80`04ecc000 00000000`00000000 fffff680`0000001c : nt!MiDeletePteRange+0x291
    fffff880`07cbc480 fffff800`02cae6d4 : 00000000`050f1045 00000000`050f1000 93000000`44ff3867 93000000`44ff3867 : nt!MiUpdateWsleHash+0x2d6
    fffff880`07cbc4e0 fffff800`02cb0df9 : fffff900`00000000 00000000`0545bfff fffff880`00000000 00000000`0000003c : nt!MiDeleteVirtualAddresses+0x75b
    fffff880`07cbc6a0 fffff800`02f961d0 : fffffa80`0b29dcc0 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
    fffff880`07cbc7c0 fffff800`02f965db : 000003f8`00000000 00000000`04d30000 fffffa80`00000001 fffff960`002cf700 : nt!MiUnmapViewOfSection+0x1b0
    fffff880`07cbc880 fffff800`02c7c993 : 00000000`74a12450 00000000`00000001 fffffa80`0ba1a060 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
    fffff880`07cbc8d0 fffff800`02c78f30 : fffff960`001b53aa 00000000`00000001 fffff900`c00bf010 fffff900`c1e2c010 : nt!KiSystemServiceCopyEnd+0x13
    fffff880`07cbca68 fffff960`001b53aa : 00000000`00000001 fffff900`c00bf010 fffff900`c1e2c010 00000000`00000000 : nt!KiServiceLinkage
    fffff880`07cbca70 fffff960`001b5720 : 00000000`00000000 fffff880`00000000 fffff900`c1e2c010 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3a2
    fffff880`07cbcbc0 fffff960`0017650d : 00000000`7e050bc0 fffff900`c1e2c010 00000000`00000bc0 00000000`74a3f0f4 : win32k!bDeleteSurface+0x34
    fffff880`07cbcbf0 fffff800`02c7c993 : fffffa80`0a3cdb60 fffff900`c00bf010 fffff900`c00bf010 00000000`7efdb000 : win32k!NtGdiDeleteObjectApp+0xd5
    fffff880`07cbcc20 00000000`74a12dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`000fe558 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74a12dd9


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!SURFACE::bDeleteSurface+3a2
    fffff960`001b53aa e9d6010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`001b5585)

    SYMBOL_STACK_INDEX: c

    SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3a2

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4cbe5d3e

    FAILURE_BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3a2

    BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3a2

    Followup: MachineOwner
     
  2. FatalExceptionX

    FatalExceptionX Thread Starter

    Joined:
    Aug 19, 2009
    Messages:
    39
    Heres yesterdays crash:

    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Machine Name:
    Kernel base = 0xfffff800`02c02000 PsLoadedModuleList = 0xfffff800`02e3fe50
    Debug session time: Sun Feb 6 19:11:18.366 2011 (UTC - 6:00)
    System Uptime: 0 days 10:19:23.067
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..........................................
    Loading User Symbols
    Loading unloaded module list
    ..............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 1a9f8e, 2, 1a9e9a}

    Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 0000000000000099, A PTE or PFN is corrupt
    Arg2: 00000000001a9f8e, page frame number
    Arg3: 0000000000000002, current page state
    Arg4: 00000000001a9e9a, 0

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x4E_99

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: dllhost.exe

    CURRENT_IRQL: 2

    LAST_CONTROL_TRANSFER: from fffff80002d0238c to fffff80002c72740

    STACK_TEXT:
    fffff880`0b76e638 fffff800`02d0238c : 00000000`0000004e 00000000`00000099 00000000`001a9f8e 00000000`00000002 : nt!KeBugCheckEx
    fffff880`0b76e640 fffff800`02ce46a9 : 00000000`00000000 fffff683`ff78e7b0 14600001`ae989005 00000000`00000002 : nt!MiBadShareCount+0x4c
    fffff880`0b76e680 fffff800`02ca3381 : 00000003`00000000 fffff683`ff78ea48 fffffa80`0c9bd730 eff00001`adbae025 : nt! ?? ::FNODOBFM::`string'+0x31ed3
    fffff880`0b76e830 fffff800`02ca5df9 : 00000000`00000000 000007fe`f1d52fff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x408
    fffff880`0b76e9f0 fffff800`02f8b1d0 : fffffa80`0c045990 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
    fffff880`0b76eb10 fffff800`02f8b5db : fffff880`00000000 000007fe`f1ce0000 fffffa80`00000001 fffffa80`0a846df0 : nt!MiUnmapViewOfSection+0x1b0
    fffff880`0b76ebd0 fffff800`02c71993 : 00000000`00000000 00000000`00000001 fffffa80`0c9bd730 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
    fffff880`0b76ec20 00000000`76f0fffa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`002af5b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f0fffa


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MiBadShareCount+4c
    fffff800`02d0238c cc int 3

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!MiBadShareCount+4c

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

    BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

    Followup: MachineOwner
     
  3. FatalExceptionX

    FatalExceptionX Thread Starter

    Joined:
    Aug 19, 2009
    Messages:
    39
    And this one is from about 2 months ago, which i dont really care about, I had another one caused by avp.exe a few days agi but lost the dump file, so heres a different one. Im concerned about the recent ones because this last week has been happening at least twice every few hours


    Use !analyze -v to get detailed debugging information.

    BugCheck A, {fffff680000561b0, 0, 0, fffff80002b842f5}

    Probably caused by : memory_corruption ( nt!MiEmptyWorkingSet+1c5 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffff680000561b0, memory referenced
    Arg2: 0000000000000000, IRQL
    Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80002b842f5, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb50e0
    fffff680000561b0

    CURRENT_IRQL: 0

    FAULTING_IP:
    nt!MiEmptyWorkingSet+1c5
    fffff800`02b842f5 488b02 mov rax,qword ptr [rdx]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: avp.exe

    TRAP_FRAME: fffff8800875d4b0 -- (.trap 0xfffff8800875d4b0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000098000000000 rbx=0000000000000000 rcx=00000000000561b0
    rdx=fffff680000561b0 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002b842f5 rsp=fffff8800875d640 rbp=000000000000000f
    r8=0000000fffffffff r9=0000000000000001 r10=0000000000000000
    r11=0000000000000013 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei ng nz na pe cy
    nt!MiEmptyWorkingSet+0x1c5:
    fffff800`02b842f5 488b02 mov rax,qword ptr [rdx] ds:8404:fffff680`000561b0=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff80002a7cca9 to fffff80002a7d740

    STACK_TEXT:
    fffff880`0875d368 fffff800`02a7cca9 : 00000000`0000000a fffff680`000561b0 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0875d370 fffff800`02a7b920 : 00000000`00000000 ffffffff`ffffffff 00000000`1b749000 00000000`1b761000 : nt!KiBugCheckDispatch+0x69
    fffff880`0875d4b0 fffff800`02b842f5 : 00000003`00000000 ffffffff`ffffffff 00000000`0000000e fffffa80`0a160ec8 : nt!KiPageFault+0x260
    fffff880`0875d640 fffff800`02cc54ad : fffffa80`08a8a5d0 00000000`00000001 ffffffff`ffffffff ffffffff`ffffffff : nt!MiEmptyWorkingSet+0x1c5
    fffff880`0875d6f0 fffff800`02ecf0ed : 00000000`00000001 00000000`00000000 00000000`00000000 fffff8a0`01d03e00 : nt!MmAdjustWorkingSetSizeEx+0xad
    fffff880`0875d780 fffff800`02dd6bcb : 00000000`00000008 00000000`00000000 00000000`00000001 00000000`0736e700 : nt!PspSetQuotaLimits+0x32d
    fffff880`0875d8d0 fffff800`02a7c993 : fffffa80`08a8a5d0 fffff880`0875dca0 00000000`7e5eb000 00000000`7e5eb000 : nt! ?? ::NNGAKEGL::`string'+0x49b60
    fffff880`0875dc20 00000000`77c9ff1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0736e6c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c9ff1a


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MiEmptyWorkingSet+1c5
    fffff800`02b842f5 488b02 mov rax,qword ptr [rdx]

    SYMBOL_STACK_INDEX: 3

    SYMBOL_NAME: nt!MiEmptyWorkingSet+1c5

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: X64_0xA_nt!MiEmptyWorkingSet+1c5

    BUCKET_ID: X64_0xA_nt!MiEmptyWorkingSet+1c5

    Followup: MachineOwner
    ---------
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/979499

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice