Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSOD BCCode 50 and 19 ntoskrnl.exe and win32k.sys

28 Aug 2013   #1
Lancewiu

Windows 7 Ultimate x64
 
 
BSOD BCCode 50 and 19 ntoskrnl.exe and win32k.sys

The day before yesterday, I installed a few free programs specifically from this thread:
What is a free PC program everyone should have? : AskReddit

The ones I installed specifically are:
CCCP
Malwarebytes
CCleaner
Defraggler (also uninstalled Auslogic's defragger and registry cleaner)
Irfanview (replacing xnview)
and Virtual Clone Drive (replacing Daemon Tools Lite)

I ran CCleaner and then defragged my C: drive. Everything worked just fine that day. However, when I turned on my computer the day after, I kept blue-screening whenever I opened my browser and whenever I tried to open Notepad++ (there may be other causes of BSOD but I haven't yet found them).

So far, I've already run Memtest86 once (by that I let it run overnight) without any errors. I am currently running it again just to be sure, though. I've already run chkdsk once without any issues there so I don't think it's a hard drive error either. I have already run Malwarebytes which didn't fix the issue but did find a few infected files. I already updated my graphics card drivers so that wasn't an issue.

A few minidumps are in the attached zip file but do not include the most recent BSODs because apparently using the internet via either Chrome or Firefox also makes a BSOD (thus, I had to manually move these minidumps over to my work computer). The more current BSODs seem to be exactly the same one though (either code 50 or 19). I will run the diagnostic tool recommended by the posting instructions when I get home. I am also not sure how exactly to interpret the Bluescreen Viewer when viewing my minidumps.

Just a note: I can actually access the internet fine through Steam (at least, the store page works fine and any updating games) but not through any browsers. I also reinstalled Notepad++ but haven't tested whether or not it still crashes.

Can anyone help me interpret these minidumps for me? And maybe a few pointers as to what I'm supposed to be looking for?


My System SpecsSystem Spec
.
28 Aug 2013   #2
Arc

Microsoft Community Contributor Award Recipient

Microsoft Windows 10 Pro Insider Preview 64-bit
 
 

Lancewiu, Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Scan the system for possible virus infection with the following programs.
If memtest and virus scan comes free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

information   Information
Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

warning   Warning
Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip   Tip

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.
_______________________________________________________________________
BSOD ANALYSIS:
Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c4088000, 1, fffff96000032364, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!sfac_GetLongGlyphIDs+84 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c4088000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff96000032364, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034b8100
GetUlongFromAddress: unable to read from fffff800034b81c0
 fffff900c4088000 

FAULTING_IP: 
win32k!sfac_GetLongGlyphIDs+84
fffff960`00032364 44891e          mov     dword ptr [rsi],r11d

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800cf7eb40 -- (.trap 0xfffff8800cf7eb40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000e40908
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000032364 rsp=fffff8800cf7ecd0 rbp=0000000000001566
 r8=0000000000e4099c  r9=0000000000e40916 r10=0000000000001566
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
win32k!sfac_GetLongGlyphIDs+0x84:
fffff960`00032364 44891e          mov     dword ptr [rsi],r11d ds:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032febe0 to fffff80003280b80

STACK_TEXT:  
fffff880`0cf7e9d8 fffff800`032febe0 : 00000000`00000050 fffff900`c4088000 00000000`00000001 fffff880`0cf7eb40 : nt!KeBugCheckEx
fffff880`0cf7e9e0 fffff800`0327ecae : 00000000`00000001 fffff900`c4088000 00000000`00000000 00000000`00001ade : nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`0cf7eb40 fffff960`00032364 : 00000000`00001ade fffff900`c4088000 00000000`0000ffff fffff960`00031cc8 : nt!KiPageFault+0x16e
fffff880`0cf7ecd0 fffff960`000322ab : fffff960`00032704 00000000`00000f02 00000000`0000037d 00000000`00002142 : win32k!sfac_GetLongGlyphIDs+0x84
fffff880`0cf7ed20 fffff960`000321da : 00000000`00e407c0 00000000`00002142 00000000`00001268 00000000`00001268 : win32k!sfac_GetWinNTGlyphIDs+0xbb
fffff880`0cf7ed90 fffff960`000320aa : 00000000`00000000 00000000`00000000 00000000`00e48fa6 00000000`00001288 : win32k!fs_WinNTGetGlyphIDs+0x6a
fffff880`0cf7ede0 fffff960`00031e08 : 00000000`00e48fa6 fffff880`0cf7ef20 00000000`00003043 00000000`00e40f02 : win32k!cjComputeGLYPHSET_MSFT_UNICODE+0x252
fffff880`0cf7eea0 fffff960`00029173 : fffff900`c0d07890 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0xf8
fffff880`0cf7eed0 fffff960`00029312 : fffff900`c0d07890 fffff900`00000001 fffff900`c0d07890 fffff960`0019c3e4 : win32k!bReloadGlyphSet+0x24b
fffff880`0cf7f590 fffff960`0002926a : 00000000`00000000 fffff900`c0d07890 fffff900`00000001 fffff900`c4706e94 : win32k!ttfdQueryFontTree+0x66
fffff880`0cf7f5e0 fffff960`000760bb : fffff960`00029210 fffff900`c0d07c00 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a
fffff880`0cf7f620 fffff960`00075f67 : fffff880`0cf7f730 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63
fffff880`0cf7f6a0 fffff960`0003005a : fffff900`c008a010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ::pfdg+0xa3
fffff880`0cf7f700 fffff960`0008a70c : fffff900`c4706d80 fffff880`0cf7f990 fffff880`0cf7f890 fffff880`0cf7f9e0 : win32k!RFONTOBJ::bRealizeFont+0x46
fffff880`0cf7f820 fffff960`0005b145 : 00000000`10018000 fffff900`00000000 00000d56`00000000 6b096a09`00000002 : win32k!RFONTOBJ::bInit+0x548
fffff880`0cf7f940 fffff960`0005b0db : 00000000`00000000 fffff880`0cf7fb60 00000000`666c6953 8f038d03`89038703 : win32k!ulGetFontData2+0x31
fffff880`0cf7f9b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!ulGetFontData+0x7f


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!sfac_GetLongGlyphIDs+84
fffff960`00032364 44891e          mov     dword ptr [rsi],r11d

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!sfac_GetLongGlyphIDs+84

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  51aeb1a7

FAILURE_BUCKET_ID:  X64_0x50_win32k!sfac_GetLongGlyphIDs+84

BUCKET_ID:  X64_0x50_win32k!sfac_GetLongGlyphIDs+84

Followup: MachineOwner
---------
My System SpecsSystem Spec
28 Aug 2013   #3
Lancewiu

Windows 7 Ultimate x64
 
 

Thanks. I'll report the results once I get back.
My System SpecsSystem Spec
.

29 Aug 2013   #4
Lancewiu

Windows 7 Ultimate x64
 
 
Update

Ran both the virus scanner and the rootkit scanner. No viruses or rootkits found. I haven't run the driver verifier just yet but I'll do that this afternoon through tomorrow. Hopefully it'll be a little easier determining the drivers since I know which programs cause the BSOD.

In the meantime, I did run the diagnostic tool and got a bit more information than just the minidumps. Maybe looking at that will help at least narrow the possibilities down. I'll add that to the original post as well.
My System SpecsSystem Spec
29 Aug 2013   #5
Arc

Microsoft Community Contributor Award Recipient

Microsoft Windows 10 Pro Insider Preview 64-bit
 
 

Quote   Quote: Originally Posted by Lancewiu View Post
Ran both the virus scanner and the rootkit scanner. No viruses or rootkits found. I haven't run the driver verifier just yet but I'll do that this afternoon through tomorrow. Hopefully it'll be a little easier determining the drivers since I know which programs cause the BSOD.

In the meantime, I did run the diagnostic tool and got a bit more information than just the minidumps. Maybe looking at that will help at least narrow the possibilities down. I'll add that to the original post as well.
You please report us back after completing all the suggestions.
My System SpecsSystem Spec
29 Aug 2013   #6
Lancewiu

Windows 7 Ultimate x64
 
 

So I ran it with the driver verifier and got it to crash 3 times. The first time was from opening Firefox and checking my email along with opening youtube and a few other tabs. The second time was just opening Notepad++. Upon opening, it seemed to mess up loading a few xml language files and then crash. The third time was just opening VLC which just crashed. The dumps are attached and I will be replacing it with the one in the original post.
My System SpecsSystem Spec
30 Aug 2013   #7
Arc

Microsoft Community Contributor Award Recipient

Microsoft Windows 10 Pro Insider Preview 64-bit
 
 

There are four verifier enabled minidumps and none of them are showing any possible cause at all.
Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c2a33000, 1, fffff96000042364, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!sfac_GetLongGlyphIDs+84 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c2a33000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff96000042364, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c7100
GetUlongFromAddress: unable to read from fffff800034c71c0
 fffff900c2a33000 

FAULTING_IP: 
win32k!sfac_GetLongGlyphIDs+84
fffff960`00042364 44891e          mov     dword ptr [rsi],r11d

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800a085c20 -- (.trap 0xfffff8800a085c20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000e40908
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000042364 rsp=fffff8800a085db0 rbp=0000000000001566
 r8=0000000000e4099c  r9=0000000000e40916 r10=0000000000001566
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
win32k!sfac_GetLongGlyphIDs+0x84:
fffff960`00042364 44891e          mov     dword ptr [rsi],r11d ds:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000330dbe0 to fffff8000328fb80

STACK_TEXT:  
fffff880`0a085ab8 fffff800`0330dbe0 : 00000000`00000050 fffff900`c2a33000 00000000`00000001 fffff880`0a085c20 : nt!KeBugCheckEx
fffff880`0a085ac0 fffff800`0328dcae : 00000000`00000001 fffff900`c2a33000 00000000`00000000 00000000`00001ade : nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`0a085c20 fffff960`00042364 : 00000000`00001ade fffff900`c2a33000 00000000`0000ffff fffff960`00041cc8 : nt!KiPageFault+0x16e
fffff880`0a085db0 fffff960`000422ab : fffff960`00042704 00000000`00000f02 00000000`0000037d 00000000`00002142 : win32k!sfac_GetLongGlyphIDs+0x84
fffff880`0a085e00 fffff960`000421da : 00000000`00e407c0 00000000`00002142 00000000`00001268 00000000`00001268 : win32k!sfac_GetWinNTGlyphIDs+0xbb
fffff880`0a085e70 fffff960`000420aa : 00000000`00000000 00000000`00000000 00000000`00e48fa6 00000000`00001288 : win32k!fs_WinNTGetGlyphIDs+0x6a
fffff880`0a085ec0 fffff960`00041e08 : 00000000`00e48fa6 fffff880`0a086000 00000000`00003043 00000000`00e40f02 : win32k!cjComputeGLYPHSET_MSFT_UNICODE+0x252
fffff880`0a085f80 fffff960`00039173 : fffff900`c0d0f380 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0xf8
fffff880`0a085fb0 fffff960`00039312 : fffff900`c0d0f380 fffff900`00000001 fffff900`c0d0f380 fffff960`001ac3e4 : win32k!bReloadGlyphSet+0x24b
fffff880`0a086670 fffff960`0003926a : 00000000`00000000 fffff900`c0d0f380 fffff900`00000001 fffff900`c0ce4d24 : win32k!ttfdQueryFontTree+0x66
fffff880`0a0866c0 fffff960`000860bb : fffff960`00039210 fffff900`c0d0f6f0 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a
fffff880`0a086700 fffff960`00085f67 : fffff880`0a086810 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63
fffff880`0a086780 fffff960`0004005a : fffff900`c0089010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ::pfdg+0xa3
fffff880`0a0867e0 fffff960`0009a70c : fffff900`c0ce4c10 fffff880`0a086a70 fffff880`0a086970 fffff880`0a086a40 : win32k!RFONTOBJ::bRealizeFont+0x46
fffff880`0a086900 fffff960`0003bf10 : 00000000`00008000 fffff900`00000000 00000000`00000000 fffff960`00000002 : win32k!RFONTOBJ::bInit+0x548
fffff880`0a086a20 fffff960`00046fbf : 00000000`00000000 fffff960`00046fa0 00000000`00000000 00000000`00000000 : win32k!GreGetTextMetricsW+0x4c
fffff880`0a086a60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtGdiGetTextMetricsW+0x1f


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!sfac_GetLongGlyphIDs+84
fffff960`00042364 44891e          mov     dword ptr [rsi],r11d

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!sfac_GetLongGlyphIDs+84

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  51aeb1a7

FAILURE_BUCKET_ID:  X64_0x50_VRF_win32k!sfac_GetLongGlyphIDs+84

BUCKET_ID:  X64_0x50_VRF_win32k!sfac_GetLongGlyphIDs+84

Followup: MachineOwner
---------

4: kd> !verifier

Verify Level fbb ... enabled options are:
    Special pool
    Special irql
    All pool allocations checked on unload
    Io subsystem checking enabled
    Deadlock detection enabled
    DMA checking enabled
    Security checks enabled
    Force pending I/O requests
    IRP Logging
    Miscellaneous checks enabled

Summary of All Verifier Statistics

RaiseIrqls                             0x0
AcquireSpinLocks                       0x1dfbc
Synch Executions                       0x2850
Trims                                  0x20e4b

Pool Allocations Attempted             0x84e22
Pool Allocations Succeeded             0x84e22
Pool Allocations Succeeded SpecialPool 0x84e22
Pool Allocations With NO TAG           0x45
Pool Allocations Failed                0x0
Resource Allocations Failed Deliberately   0x0

Current paged pool allocations         0xa3 for 0030B778 bytes
Peak paged pool allocations            0xb3 for 003131CC bytes
Current nonpaged pool allocations      0x4850 for 00EBD9A0 bytes
Peak nonpaged pool allocations         0x4994 for 00ECA600 bytes
I said you to take memtest as the first option, which you havent confirmed yet. Do it now!

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.
My System SpecsSystem Spec
30 Aug 2013   #8
Lancewiu

Windows 7 Ultimate x64
 
 

I ran it twice 8 passes each (or whatever the maximum number is before it stops). The first time was overnight and the second time was during work. There were no errors in either check. I haven't run it with individual cards though so if that's necessary I'll do that.
My System SpecsSystem Spec
30 Aug 2013   #9
Arc

Microsoft Community Contributor Award Recipient

Microsoft Windows 10 Pro Insider Preview 64-bit
 
 

Quote   Quote: Originally Posted by Lancewiu View Post
I ran it twice 8 passes each (or whatever the maximum number is before it stops). The first time was overnight and the second time was during work. There were no errors in either check. I haven't run it with individual cards though so if that's necessary I'll do that.
It never stops before the user stops it manually.

Run memtest one more time. When it completes 8 passes, take a camera snap, and upload the picture here. We need to see it.

If it is not the memory for sure, then it is the motherboard. Changing the motherboard involves changing the CPU and RAM too, in most of the cases. So better you make it surely sure that the RAM is not failing, before blaming the motherboard.
My System SpecsSystem Spec
30 Aug 2013   #10
muhahaa

Windows 7 x64
 
 

Perhaps this is a Windows security vulnerability in font processing. win32k!sfac_GetLongGlyphIDs+0x84 is a common crash signature. cf. here: BSOD Using Firefox, Win32k.sys related

I got one win32k!sfac_GetLongGlyphIDs+0x84 crash a few months ago myself too, and my hardware is working fine.
My System SpecsSystem Spec
Reply

 BSOD BCCode 50 and 19 ntoskrnl.exe and win32k.sys




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
BSOD randomly ntoskrnl and win32k.sys
Hello! I got bluescreens once or twice a day. It happens randomly. Now suddenly the code changed. From win32k.sys too IRLQ something. Check the two latest bluescreens dumps. I bought a new graphics card for 2 months ago. I dont know if it is something with that! Thanks in advance!
BSOD Help and Support
Win32k.sys and ntoskrnl.exe 0x3b BSOD
Hi, I recently built my first computer and I have been having a really annoying bluescreen which apparently caused by Win32k.sys and ntoskrnl.exe and is listed as a SYSTEM_SERVICE_EXCEPTION. I decided to try a fresh install of windows and everything was going fine, but again I get the error. I then...
BSOD Help and Support
Random BSOD ntoskrnl.exe and win32k.sys
Hello, I have begun getting BSOD's often. BSODviewer says that it is "ntoskrnl.exe" and some times also "Win32k.sys" together with "ntoskrnl.exe". I have tried Driver Verifier but it does not make any .dmp files when crash occur. I did not check Windows drivers in Driver Verifier and Windows would...
BSOD Help and Support
BSOD 0x0000003B win32k.sys, ntoskrnl.exe
hi I've been having BSOD for months now, at random times, most often when watching videos or listening music. When computer freezes, there's a strange buzzing noise coming from my speakers. I have allredy updated audio and graphic card drivers and tested ram and hard drive...
BSOD Help and Support
Windows 7 - win32k.sys+ntoskrnl.exe BSOD
Hi guys, My case is same as Ervin but we not a same person:shock: I wish someone can help me find out the problem:( You may download my dump file from attachment. Thank you.
BSOD Help and Support
BSOD ntoskrnl.exe win32k.sys
About three hours ago I started getting bsod's. So I uninstalled my Razer mouse drivers as these have given me grief previously. Now I am getting different ones. Checked my hardware and everything seems to be ok.
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 22:02.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App