BSOD 0x0000003B win32k.sys

[gerrardo]

Hello. My english is very bad,but I will try to explain. I left the computer On and when got home, see BSOD. WhoCrashed report:

windows version: Windows 7 Service Pack 1, 6.1, build: 7601
windows dir: C:\Windows
CPU: GenuineIntel Intel® Core™2 Duo CPU E8400 @ 3.00GHz Intel586, level: 6
2 logical processors, active mask: 3
RAM: 4293382144 total
VM: 2147352576, free: 1865183232


Crash Dump Analysis

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.


On Mon 2/6/2012 21:09:54 GMT your computer crashed
crash dump file: C:\Windows\Minidump\020612-13618-01.dmp
This was probably caused by the following module: win32k.sys (win32k+0x280AD7)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF960002A0AD7, 0xFFFFF88009B40FE0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.



Conclusion

1 crash dumps have been found and analyzed.
Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is actually responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

Any advice how to fix that? And the reason for the blue screen? Thanks in advance.

 

[writhziden]

Unfortunately, that information is very vague. Please follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html so that we can do a full analysis of your crash reports and provide informed troubleshooting steps.

 

[gerrardo]

When restart computer, dmp file missing in C:/Windows/Minidump. However, I performed what you say and attach .zip fith info from Perfmon and Windows_NT6_BSOD_jcgriff2.

Windows 7 Ultimate 64bit, installed 9/10/2011.

PC configuration:

P35 DS3R Rev 2.0
Intel C2D E8400
Asus 8800gt 512mb
Hitachi HDP725032GLA360
2x1 gb SuperT CL5 and 2x1gb Kingston DDR2 800 MHz
Fortron Blue Storm II - 500W

 

[writhziden]

Are you using a file cleaner (CCleaner, Windows disk cleaner, etc) of any type? These can delete .dmp files if used after a crash occurs. Please refrain from doing any temporary file cleaning until after we have resolved your crashes.

Also, make sure your minidumps are set up properly by following OPTION ONE 6. in http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

 

[gerrardo]

Yes, I use ccleaner, after crash. Sorry, but I see for first time BSOD under Windows 7 and don't know what to do.

 

[writhziden]

I imagine it was CCleaner that deleted the files. If you have only had one crash, I wouldn't worry about it. If they start to occur more often, then there is reason to be concerned. Just run normally for a few days and post back if you have any stability problems.

 

[gerrardo]

Thank you. And last question. This settings for minidump is correct, right ImageShack® - Online Photo and Video Hosting

 

[writhziden]

That is correct for minidump files. Thank you for configuring. Best of luck you will not need those and your system stays stable.

 

[gerrardo]

Hello, again. I restore memory.dmp file with Recuva. but is too big. Can I upload .dmp in rapidshare and paste link here to analyzing? Thanks.

The file is 446 mb

 

[writhziden]

That would be fine. We can download from rapidshare.

 

[gerrardo]

link https://rapidshare.com/files/2165076808/MEMORY.rar

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mike\Downloads\gerrardo\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c51000 PsLoadedModuleList = 0xfffff800`02e96670
Debug session time: Mon Feb  6 14:09:54.835 2012 (GMT-7)
System Uptime: 0 days 8:15:00.014
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdc018).  Type ".hh dbgerr001" for details
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960002a0ad7, fffff88009b40fe0, 0}

Page 99917 not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdc018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdc018).  Type ".hh dbgerr001" for details
Probably caused by : win32k.sys ( win32k!SFMLOGICALSURFACE::SetShape+157 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960002a0ad7, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88009b40fe0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 000007ff`fffdc018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdc018).  Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!SFMLOGICALSURFACE::SetShape+157
fffff960`002a0ad7 488b5508        mov     rdx,qword ptr [rbp+8]

CONTEXT:  fffff88009b40fe0 -- (.cxr 0xfffff88009b40fe0)
rax=fffff88009b41a08 rbx=0000000000000000 rcx=fffff900c2f7a540
rdx=fffff900c00cc280 rsi=0000000000000000 rdi=fffff900c2f7a540
rip=fffff960002a0ad7 rsp=fffff88009b419c0 rbp=0000000000000018
 r8=000000003f12ff9c  r9=000000000000ff9a r10=000000000002fece
r11=fffff88009b419f0 r12=0000000000000001 r13=fffff900c00cc280
r14=fffff900c00cc280 r15=8000000000001000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
win32k!SFMLOGICALSURFACE::SetShape+0x157:
fffff960`002a0ad7 488b5508        mov     rdx,qword ptr [rbp+8] ss:0018:00000000`00000020=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff960001f7cf0 to fffff960002a0ad7

STACK_TEXT:  
fffff880`09b419c0 fffff960`001f7cf0 : 00000000`00000000 00000000`00000001 fffff900`c1fb79f0 fffff900`c23842a0 : win32k!SFMLOGICALSURFACE::SetShape+0x157
fffff880`09b41a10 fffff960`001730fe : fffff880`00000001 fffff800`00000001 00000000`000002cb 00000000`000003f7 : win32k!GreTransferSpriteStateToDwmState+0x1d0
fffff880`09b41b20 fffff960`00173b33 : 00000000`00000000 fffff880`09b41ca0 00000000`c0000001 fffff880`09b41ca0 : win32k!zzzComposeDesktop+0x52
fffff880`09b41bc0 fffff960`001082cb : 00000000`00000000 00000000`ff14b390 00000000`00280000 00000000`00000000 : win32k!zzzDwmStartRedirection+0xbf
fffff880`09b41bf0 fffff800`02ccced3 : fffffa80`051397e0 fffff880`09b41ca0 fffffa80`06583680 00000000`00000000 : win32k!NtUserDwmStartRedirection+0x6b
fffff880`09b41c20 00000000`76835f7a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01f0f5e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76835f7a


FOLLOWUP_IP: 
win32k!SFMLOGICALSURFACE::SetShape+157
fffff960`002a0ad7 488b5508        mov     rdx,qword ptr [rbp+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!SFMLOGICALSURFACE::SetShape+157

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ecdcd5a

STACK_COMMAND:  .cxr 0xfffff88009b40fe0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!SFMLOGICALSURFACE::SetShape+157

BUCKET_ID:  X64_0x3B_win32k!SFMLOGICALSURFACE::SetShape+157

Followup: MachineOwner
---------

Inconclusive. Possibly your graphics card since desktop window manager was the process running. The crash file was somewhat corrupted, so we are missing some info. Other possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
Thanks to Dave76 for help understanding possible causes.

 

[gerrardo]

Now testing my videocard with furmark - two times for 15 minutes. No problem. Test hard disk with hd tune pro - no errors. Everething is ok. Test with prime 95 - no errors.
What you mean with ''Corrupted hard disk file system''? Corrupted Windows? Or damaged hard disk? Sorry, but my english is terrible.

Any suggestions...for other test ot reinstall OS? Thank you.

 

[writhziden]

Corrupted hard disk file system means either the data on the disk is corrupted or how it is organized is corrupted. It could also mean bad sectors on the disk. Corrupted system files means that Windows files may be corrupted.

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html



Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.

 

[gerrardo]

Run Disk Check with both boxes checked for all HDDs

I do this for any partition - C and D. After restart, check partitions. After that, computer is autorestart and check again. That's normal - two checks and one restart beween?

In event viewer missing log for ''chkdsk''. There are only for ''wininit''!

edit: later, i will run sfc /scannow

 

[writhziden]

C: needs to be rechecked. It corrected file system errors on C:. Post back the wininit log again if you cannot find chkdsk.

 

[gerrardo]

In event viewer missing log for ''chkdsk'', again. There are only for ''wininit''. I start two times chkdsk.

Forgot to mention, I'm using external visual style and edited with resource hacker some system files, like explorer.exe, explorer frame.dll, shell32.dll, actioncenter.dll, pnidui.dll, sndvolsso.dll, to change tray icons and the view on windows explorer. But i make that from two years and never view blue screen before under windows 7.

 

[writhziden]

All came up clean. See how the system runs. If you have problems again, proceed with the system file check (SFC) tutorial.

 

[gerrardo]

Thank you. I will.

 

[writhziden]

You're welcome. Best of luck!