BSOD using windows , error 0x0000004e

can I anyone help me please

Code:

BugCheck D5, {fffff98033636fe0, 0, fffffa800952f606, 0}

Could not read faulting driver name
Probably caused by : em018_64.dat ( em018_64+3d606 )

Code:

0: kd> lmvm em018_64
start             end                 module name
fffffa80`094f2000 fffffa80`09564000   em018_64 T (no symbols)           
    Loaded symbol image file: em018_64.dat
    Image path: C:\Program Files\ESET\ESET NOD32 Antivirus\em018_64.dat
    Image name: em018_64.dat
    Timestamp:        Thu Oct 24 11:34:08 2013 (5268F7A0)
    CheckSum:         00000000
    ImageSize:        00072000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

This bugcheck was caused by the faulting driver (listed above), referencing freed special pool and then causing a page fault.

The problem was clearly caused by ESET, which you have now removed. Disable Driver Verifier if you haven't already. Instructions on how to do so, are provided with the Driver Verifier links in my previous post.

hi

i was holding on for 12 days and today it was back

i removed nod32 as it seems it was the problem now i don't what is the new problem

please can anyone help

Code:

BugCheck 1000007E, {ffffffffc0000005, fffff80002f667f2, fffff8800b2be858, fffff8800b2be0b0}

Probably caused by : ntkrnlmp.exe ( nt!RtlInterlockedClearBitRunEx+b2 )

Code:

fffff8800b2be858 -- (.exr 0xfffff8800b2be858)
ExceptionAddress: fffff80002f667f2 (nt!RtlInterlockedClearBitRunEx+0x00000000000000b2)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

Code:

0: kd> k
 # Child-SP          RetAddr           Call Site
00 fffff880`0b2bea98 fffff800`031163db nt!RtlInterlockedClearBitRunEx+0xb2
01 fffff880`0b2beaa0 fffff800`0311abb5 nt!MmDuplicateMemory+0x8bb <-- Hibernation File Write?
02 fffff880`0b2beb90 fffff800`031692ea nt!PopTransitionToSleep+0xd5 
03 fffff880`0b2bec00 fffff800`02ebd8e6 nt!PspSystemThreadStartup+0x5a
04 fffff880`0b2bec40 00000000`00000000 nt!KxStartSystemThread+0x16

Okay, there is clearly a problem, when the computer is set to sleep and the contents of memory are written to a possible hibernation file. This seems to be more of a driver issue, or possibly a hardware issue with the flipped bit within the r10 register.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• Driver Verifier - Enable and Disable

   Information

Additional Help - Using Driver Verifier to identify issues with Drivers

Code:

 fffff8800b2be0b0 -- (.cxr 0xfffff8800b2be0b0)
rax=00000000fffffffe rbx=ffffffffffffffff rcx=0000000000000000
rdx=fffff80003056180 rsi=fffff80003056180 rdi=0000058000000000
rip=fffff80002f667f2 rsp=fffff8800b2bea98 rbp=fffe7a8091024800
 r8=0000000000000000  r9=0000000000000001 r10=1ffff9800b282c40
r11=fffff80003056180 r12=0000000000000000 r13=0000000000000001
r14=fffff8800b2bebc0 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!RtlInterlockedClearBitRunEx+0xb2:
fffff800`02f667f2 f0412102        lock and dword ptr [r10],eax ds:002b:1ffff980`0b282c40=????????

Run the Small FFT's, Large FFT's and Blend Test for a few hours each. Do not let the temperature exceed 80*C.

• Hardware - Stress Test With Prime95

Enable "Round off checking" before the test (see first post below tutorial).

do u say if i stop using sleep and hibernate i will not see this bsod or it is beeter to do drive verifer with a lot of sleep and hibernate to know what driver is the problem or hardware?

When running Driver Verifier, just use your computer as you normally would. Disabling sleep or hibernate would be more of a work around, rather than a solution in my opinion, but you could try and see if it helps.

well
here it is a new hot dump

crashed now after a restart and didn't want to get into windows keept showinf this bsod

so i got into safe mode and disabled verifier

well we know what driver is causing the problems this time

and will new clean windows help?!

maybe this new chipset and haswell cpu need windows 8

It's not produced by Driver Verifier, and have you tried disabling Sleep or Hibernate? Personally, I don't use them at all, since Windows booting fast enough for me.

Code:

BugCheck 50, {fffff901c066f94c, 0, fffff960000bcc73, 5}

Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!bLoadFontFile+1f3 )

Code:

1: kd> !irql
Debugger saved IRQL for processor 0x1 -- 0 (LOW_LEVEL)

The page fault wasn't a result of a bad IRQL level, it leads me to believe it may be more of a miscalled instruction.

Code:

1: kd> k
Child-SP          RetAddr           Call Site
fffff880`025990f8 fffff800`02f0f5b3 nt!KeBugCheckEx
fffff880`02599100 fffff800`02e90cee nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`02599260 fffff960`000bcc73 nt!KiPageFault+0x16e
fffff880`025993f0 fffff960`000bca37 win32k!bLoadFontFile+0x1f3
fffff880`025994e0 fffff960`000bb69e win32k!ttfdSemLoadFontFile+0x6b
fffff880`02599540 fffff960`000bb58c win32k!PDEVOBJ::LoadFontFile+0x7e
fffff880`025995d0 fffff960`000bbc67 win32k!vLoadFontFileView+0x4bc
fffff880`02599660 fffff960`000be92c win32k!PUBLIC_PFTOBJ::bLoadFonts+0x587
fffff880`02599790 fffff960`000be7d1 win32k!GreAddFontResourceWInternal+0x114
fffff880`02599820 fffff800`02e91e53 win32k!NtGdiAddFontResourceW+0x151
fffff880`025999d0 000007fe`fd5aa86a nt!KiSystemServiceCopyEnd+0x13
00000000`00d5f868 00000000`00000000 0x000007fe`fd5aa86a

Code:

1: kd> uf win32k!bLoadFontFile+0x1f3
win32k!bLoadFontFile:
fffff960`000bca80 6644894c2420    mov     word ptr [rsp+20h],r9w
fffff960`000bca86 4489442418      mov     dword ptr [rsp+18h],r8d
fffff960`000bca8b 48894c2408      mov     qword ptr [rsp+8],rcx
fffff960`000bca90 53              push    rbx
fffff960`000bca91 56              push    rsi
fffff960`000bca92 57              push    rdi
fffff960`000bca93 4154            push    r12
fffff960`000bca95 4155            push    r13
fffff960`000bca97 4156            push    r14
fffff960`000bca99 4157            push    r15
fffff960`000bca9b 4881ecb0000000  sub     rsp,0B0h
fffff960`000bcaa2 418bf8          mov     edi,r8d
fffff960`000bcaa5 4c8bf2          mov     r14,rdx
fffff960`000bcaa8 33db            xor     ebx,ebx
fffff960`000bcaaa 895c244c        mov     dword ptr [rsp+4Ch],ebx
fffff960`000bcaae 4c8bac2418010000 mov     r13,qword ptr [rsp+118h]
fffff960`000bcab6 49895d00        mov     qword ptr [r13],rbx
fffff960`000bcaba 4c8bfb          mov     r15,rbx
fffff960`000bcabd 8bc3            mov     eax,ebx
fffff960`000bcabf 895c2440        mov     dword ptr [rsp+40h],ebx
fffff960`000bcac3 8b8c2410010000  mov     ecx,dword ptr [rsp+110h]
fffff960`000bcaca 3bcb            cmp     ecx,ebx
fffff960`000bcacc 7427            je      win32k!bLoadFontFile+0x75 (fffff960`000bcaf5)

So, it will jump to a certain function when the condition is true, hence the reason for the cmp instruction between the ecx and ebx register.

Code:

win32k!bLoadFontFile+0x75:
fffff960`000bcaf5 be01000000      mov     esi,1
fffff960`000bcafa 448ba42410010000 mov     r12d,dword ptr [rsp+110h]
fffff960`000bcb02 4489642450      mov     dword ptr [rsp+50h],r12d

This function mostly moves data between registers.

It again, seems like drivers referencing bad addresses to me. Turn off hibernation and sleep for now.

so u are saying u can't find the drive that is making the problem
u know this is not a good solutions to turn off sleep and hibernate

also i don't use hibernate at all only automatic sleep when i am away from computer

can u suggest what to do other than verifier?

how we can solve this problem

well here is new dump with diffrent error

this is shown after installing BlueStacks (android emulator for pc)

i feel that the video card the onboard need a relief by installing new vga card with it's own memory

what u say about that?