Solved BSOD x50 Ntoskernal

[albinosquirrel]

I have frequent BSODs x50 ntoskernal while doing anything. So far it has not crashed in Safe Mode with Networking.

Any help will be appreciated greatly.

 

[koolkat77]

Welcome

Do you use any security software?

Make scans with the following:

-Kaspersky TDSSKiller

• Anti-rootkit utility TDSSKiller

-ESET online scanner

• Free Online Virus Scanner | ESET

Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-
​

• Microsoft Security Essentials - Free Antivirus for Windows
  
  • Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
    • http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

:ar: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Perform a System File Check:

1. Click on the start rb:
2. Type CMD on Search
3. Left click and Run as Administrator
4. Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

Let us know the results.

:ar: BSOD Report

[FONT="Courier New"][SIZE="3"]*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c1dff000, 1, fffff96000062374, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!sfac_GetLongGlyphIDs+84 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c1dff000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff96000062374, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80005307100
GetUlongFromAddress: unable to read from fffff800053071c0
 fffff900c1dff000 

FAULTING_IP: 
win32k!sfac_GetLongGlyphIDs+84
fffff960`00062374 44891e          mov     dword ptr [rsi],r11d

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88007b69b40 -- (.trap 0xfffff88007b69b40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000002807184
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000062374 rsp=fffff88007b69cd0 rbp=00000000000001cb
 r8=000000000280724c  r9=000000000280716a r10=00000000000001cb
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
win32k!sfac_GetLongGlyphIDs+0x84:
fffff960`00062374 44891e          mov     dword ptr [rsi],r11d ds:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000507feec to fffff800050d7fc0

STACK_TEXT:  
fffff880`07b699d8 fffff800`0507feec : 00000000`00000050 fffff900`c1dff000 00000000`00000001 fffff880`07b69b40 : nt!KeBugCheckEx
fffff880`07b699e0 fffff800`050d60ee : 00000000`00000001 fffff900`c1dff000 00000000`00000000 00000000`000001c0 : nt! ?? ::FNODOBFM::`string'+0x4514f
fffff880`07b69b40 fffff960`00062374 : 00000000`000001c0 fffff900`c1dff000 00000000`0000ffff fffff960`00061ce8 : nt!KiPageFault+0x16e
fffff880`07b69cd0 fffff960`000622bb : fffff960`00062720 00000000`00000000 00000000`0000032c 00000000`0000038b : win32k!sfac_GetLongGlyphIDs+0x84
fffff880`07b69d20 fffff960`000621ea : 00000000`0280703c 00000000`0000038b 00000000`00001360 00000000`00000000 : win32k!sfac_GetWinNTGlyphIDs+0xbb
fffff880`07b69d90 fffff960`000620c2 : 00000000`00000000 00000000`00000000 00000000`02807166 00000000`00001380 : win32k!fs_WinNTGetGlyphIDs+0x6a
fffff880`07b69de0 fffff960`00061e20 : 00000000`02807166 fffff880`07b69f20 00000000`0000038a 00000000`02800000 : win32k!cjComputeGLYPHSET_MSFT_UNICODE+0x252
fffff880`07b69ea0 fffff960`0005916b : fffff900`c1cfe5a0 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0xf8
fffff880`07b69ed0 fffff960`0005930a : fffff900`c1cfe5a0 fffff900`00000001 fffff900`c1cfe5a0 fffff960`001cb664 : win32k!bReloadGlyphSet+0x24b
fffff880`07b6a590 fffff960`00059262 : 00000000`00000000 fffff900`c1cfe5a0 fffff900`00000001 fffff900`c1d6fe94 : win32k!ttfdQueryFontTree+0x66
fffff880`07b6a5e0 fffff960`000a5f63 : fffff960`00059208 fffff900`c1cfe8e0 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a
fffff880`07b6a620 fffff960`000a5e03 : fffff880`07b6a730 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63
fffff880`07b6a6a0 fffff960`00060066 : fffff900`c008a010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ::pfdg+0xa3
fffff880`07b6a700 fffff960`000ba58c : fffff900`c1d6fd80 fffff880`07b6a990 fffff880`07b6a890 fffff880`07b6a9e0 : win32k!RFONTOBJ::bRealizeFont+0x46
fffff880`07b6a820 fffff960`0008b035 : 00000000`10010000 fffff900`00000000 00000222`00000000 00000000`00000002 : win32k!RFONTOBJ::bInit+0x548
fffff880`07b6a940 fffff960`0008afcb : 00000000`00000000 fffff880`07b6ab60 00000000`656d616e 00000000`00000000 : win32k!ulGetFontData2+0x31
fffff880`07b6a9b0 fffff960`0008aea1 : 00000000`ffffffff 00000000`ffffffff fffffa80`0965d920 fffff960`00106aee : win32k!ulGetFontData+0x7f
fffff880`07b6aa00 fffff800`050d7253 : 00000000`02010222 00000000`00000000 00000000`0203f4b8 00000000`00000000 : win32k!NtGdiGetFontData+0x4d
fffff880`07b6aa70 000007fe`ffcc594a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0203f498 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`ffcc594a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!sfac_GetLongGlyphIDs+84
fffff960`00062374 44891e          mov     dword ptr [rsi],r11d

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!sfac_GetLongGlyphIDs+84

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50ad9b54

FAILURE_BUCKET_ID:  X64_0x50_win32k!sfac_GetLongGlyphIDs+84

BUCKET_ID:  X64_0x50_win32k!sfac_GetLongGlyphIDs+84

Followup: MachineOwner
---------[/SIZE][/FONT]