Win32k.sys BSOD

Bankai · 17 Feb 2012

I just had a very random BSOD while just using the computer for browsing the web. It was related to win32k.sys. I have attached the dump files to this post. Any help would be much appreciated.

EDIT: I'm running Windows 7 Home Premium 64bit with SP1 and have an i5 760 processor and a GT240 graphics card.

writhziden · 17 Feb 2012

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mike\Documents\Kingston\BSODDmpFiles\Bankai\Windows_NT6_BSOD_jcgriff2\021812-14508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03055000 PsLoadedModuleList = 0xfffff800`0329a670
Debug session time: Fri Feb 17 14:41:05.842 2012 (GMT-7)
System Uptime: 0 days 1:36:05.216
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff96000104ecb, fffff88005bb91f0, 0}

Probably caused by : win32k.sys ( win32k!xxxCancelTracking+ab )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000104ecb, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88005bb91f0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!xxxCancelTracking+ab
fffff960`00104ecb 488b10          mov     rdx,qword ptr [rax]

CONTEXT:  fffff88005bb91f0 -- (.cxr 0xfffff88005bb91f0)
rax=0100000000000000 rbx=fffff900c2dace80 rcx=0000000000000000
rdx=fffff88005bb9d70 rsi=0000000000000000 rdi=fffffa80059d3138
rip=fffff96000104ecb rsp=fffff88005bb9bd0 rbp=fffff900c2dacc20
 r8=fffff88005bba170  r9=0000000000000000 r10=fffffa8004a35c80
r11=fffff900c31e52d0 r12=0000000000000000 r13=fffff88005bb9bf0
r14=fffff900c1c03c20 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
win32k!xxxCancelTracking+0xab:
fffff960`00104ecb 488b10          mov     rdx,qword ptr [rax] ds:002b:01000000`00000000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff9600015c561 to fffff96000104ecb

STACK_TEXT:  
fffff880`05bb9bd0 fffff960`0015c561 : fffff900`c31e52d0 fffff880`05bba050 00000000`00000001 00000000`00000000 : win32k!xxxCancelTracking+0xab
fffff880`05bb9eb0 fffff960`0016ffd9 : 00000000`00000001 00000000`00000000 00000000`00000001 000cd52c`000e0082 : win32k!xxxProcessEventMessage+0x141
fffff880`05bb9f80 fffff960`001aac37 : fffff900`c1c03c20 fffff880`05bba3e8 00000000`00000000 00000000`00000000 : win32k!xxxScanSysQueue+0x575
fffff880`05bba2c0 fffff960`001b7d6e : 00000000`0352f720 80000000`000025ff 00000000`00000000 00000000`ffffffff : win32k!xxxRealInternalGetMessage+0x453
fffff880`05bba3a0 fffff800`030d0ed3 : fffffa80`06108060 00000000`0352fb88 fffff880`05bba448 00000000`00000001 : win32k!NtUserRealInternalGetMessage+0x7e
fffff880`05bba430 00000000`7757913a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0352fb68 fffff800`030c9210 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7757913a
fffff880`05bba8b0 fffffa80`06108120 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`06108168 : nt!KiCallUserMode
fffff880`05bba8b8 00000000`00000000 : 00000000`00000000 00000000`00000000 fffffa80`06108168 fffff880`05bbadb0 : 0xfffffa80`06108120


FOLLOWUP_IP: 
win32k!xxxCancelTracking+ab
fffff960`00104ecb 488b10          mov     rdx,qword ptr [rax]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!xxxCancelTracking+ab

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f10ff24

STACK_COMMAND:  .cxr 0xfffff88005bb91f0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!xxxCancelTracking+ab

BUCKET_ID:  X64_0x3B_win32k!xxxCancelTracking+ab

Followup: MachineOwner
---------

Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...

I note the following problem devices:

Code:

Microsoft ISATAP Adapter		ROOT\*ISATAP\0000	This device cannot start.
Teredo Tunneling Pseudo-Interface	ROOT\*TEREDO\0000	This device cannot start.

Thanks to Dave76 for help understanding possible causes.

Start with the most likely problems (in bold) listed above.

If you are overclocking any hardware, please stop.
Look into your problem devices and try to determine why they cannot start. Start with a Google search if you are not familiar with the devices. If you still need help, post back and we can look into it for you, as well.
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.