BSOD everyday, win32k.sys ( win32k+e0604) error?

Route44 said:

0x3B errors are often caused by faulty video card drivers. I suggest doing the following...

1. Download Driver Sweeper free version to your desktop screen and install.

2. Download the latest diver(s) for your video card but don't install them.

3. Uninstall your video card drivers and reboot your PC into Safe Mode. Run Driver Sweeper but ONLY for the video card drivers. I had someone use it on their chipset drivers! If it doesn't find any video card drivers that is quite okay; just leave all other drivers alone.

4. Reboot and install new video card drivers.

Click to expand...

Just followed all those steps, and now I'm awaiting to see what happens. I'll let you know if this fixed it, or if I keep getting BSOD's.

Thanks a lot!

Route44 said:

0x3B errors are often caused by faulty video card drivers. I suggest doing the following...

1. Download Driver Sweeper free version to your desktop screen and install.

2. Download the latest diver(s) for your video card but don't install them.

3. Uninstall your video card drivers and reboot your PC into Safe Mode. Run Driver Sweeper but ONLY for the video card drivers. I had someone use it on their chipset drivers! If it doesn't find any video card drivers that is quite okay; just leave all other drivers alone.

4. Reboot and install new video card drivers.

Click to expand...

Route44,

After a whole day, I just got another BSOD - but this time it's one I haven't had before. I'll attach the minidump results:


Mini Kernel Dump File: Only registers and stack trace are available


Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e5b000 PsLoadedModuleList = 0xfffff800`03098e50
Debug session time: Sun Jan 30 12:49:47.898 2011 (UTC + 11:00)
System Uptime: 0 days 21:02:31.459
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88008ec0c68, fffff88008ec04d0, fffff88001212065}

Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireFcbWithPaging+95 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88008ec0c68
Arg3: fffff88008ec04d0
Arg4: fffff88001212065

Debugging Details:
------------------


EXCEPTION_RECORD: fffff88008ec0c68 -- (.exr 0xfffff88008ec0c68)
ExceptionAddress: fffff88001212065 (Ntfs!NtfsAcquireFcbWithPaging+0x0000000000000095)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff88008ec04d0 -- (.cxr 0xfffff88008ec04d0)
rax=fffffa8003eac300 rbx=0000000000000013 rcx=01cbc01ff9ddaf6c
rdx=0000000000000000 rsi=0000000000000012 rdi=fffffa80068bb1c0
rip=fffff88001212065 rsp=fffff88008ec0ea0 rbp=0000000000000002
r8=0000000000000702 r9=0000000000000012 r10=fffffa80068bb1c0
r11=fffff8a002ae3f02 r12=fffff8a0044aea98 r13=00000000c00000d8
r14=0000000000000200 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010217
Ntfs!NtfsAcquireFcbWithPaging+0x95:
fffff880`01212065 488b4958 mov rcx,qword ptr [rcx+58h] ds:002b:01cbc01f`f9ddafc4=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800031030e0
ffffffffffffffff

FOLLOWUP_IP:
Ntfs!NtfsAcquireFcbWithPaging+95
fffff880`01212065 488b4958 mov rcx,qword ptr [rcx+58h]

FAULTING_IP:
Ntfs!NtfsAcquireFcbWithPaging+95
fffff880`01212065 488b4958 mov rcx,qword ptr [rcx+58h]

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from fffff880012ade77 to fffff88001212065

STACK_TEXT:
fffff880`08ec0ea0 fffff880`012ade77 : 00000000`00000010 fffff8a0`044aeed0 fffff8a0`02ae3fbc fffff800`02fff600 : Ntfs!NtfsAcquireFcbWithPaging+0x95
fffff880`08ec0f00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFindPrefixHashEntry+0x44e


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsAcquireFcbWithPaging+95

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f

STACK_COMMAND: .cxr 0xfffff88008ec04d0 ; kb

FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+95

BUCKET_ID: X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+95

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88008ec0c68
Arg3: fffff88008ec04d0
Arg4: fffff88001212065

Debugging Details:
------------------


EXCEPTION_RECORD: fffff88008ec0c68 -- (.exr 0xfffff88008ec0c68)
ExceptionAddress: fffff88001212065 (Ntfs!NtfsAcquireFcbWithPaging+0x0000000000000095)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff88008ec04d0 -- (.cxr 0xfffff88008ec04d0)
rax=fffffa8003eac300 rbx=0000000000000013 rcx=01cbc01ff9ddaf6c
rdx=0000000000000000 rsi=0000000000000012 rdi=fffffa80068bb1c0
rip=fffff88001212065 rsp=fffff88008ec0ea0 rbp=0000000000000002
r8=0000000000000702 r9=0000000000000012 r10=fffffa80068bb1c0
r11=fffff8a002ae3f02 r12=fffff8a0044aea98 r13=00000000c00000d8
r14=0000000000000200 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010217
Ntfs!NtfsAcquireFcbWithPaging+0x95:
fffff880`01212065 488b4958 mov rcx,qword ptr [rcx+58h] ds:002b:01cbc01f`f9ddafc4=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

FOLLOWUP_IP:
Ntfs!NtfsAcquireFcbWithPaging+95
fffff880`01212065 488b4958 mov rcx,qword ptr [rcx+58h]

FAULTING_IP:
Ntfs!NtfsAcquireFcbWithPaging+95
fffff880`01212065 488b4958 mov rcx,qword ptr [rcx+58h]

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from fffff880012ade77 to fffff88001212065

STACK_TEXT:
fffff880`08ec0ea0 fffff880`012ade77 : 00000000`00000010 fffff8a0`044aeed0 fffff8a0`02ae3fbc fffff800`02fff600 : Ntfs!NtfsAcquireFcbWithPaging+0x95
fffff880`08ec0f00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFindPrefixHashEntry+0x44e


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsAcquireFcbWithPaging+95

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f

STACK_COMMAND: .cxr 0xfffff88008ec04d0 ; kb

FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+95

BUCKET_ID: X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+95

Followup: MachineOwner

Any ideas?

Nothing definitive was cited but your error code with explanation is 0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the system to read and write to NTFS file system drives. There may be a physical problem with the disk, or an Interrupt Request Packet (IRP) may be corrupted. Other common causes include heavy hard drive fragmentation, heavy file I/O, problems with some types of drive-mirroring software, or some antivirus software.

A good standard proceedure here is to run a harddrive diagnostics. Have you ever done this before? If not what is the make of the harddrive?

Route44 said:

Nothing definitive was cited but your error code with explanation is 0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the system to read and write to NTFS file system drives. There may be a physical problem with the disk, or an Interrupt Request Packet (IRP) may be corrupted. Other common causes include heavy hard drive fragmentation, heavy file I/O, problems with some types of drive-mirroring software, or some antivirus software.

A good standard proceedure here is to run a harddrive diagnostics. Have you ever done this before? If not what is the make of the harddrive?

Click to expand...

Well, I've ran Chkdsk even though the hard drive is brand new... and it has found nothing.

What other tests do you recommend?

ChkDsk only does so much. For diagnostic purposes it would still be good to run a complete harddrive diagnostics. I've seen new harddrives like new memory die an early death.

Ahh you wouldn't believe it, but I got ANOTHER BSOD... never got this one before.

Dump:

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80011b8d80
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41790

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: FlashUtil10m_A

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80002ee6f9e to fffff80002e73740

STACK_TEXT:
fffff880`0923c5c8 fffff800`02ee6f9e : 00000000`0000001a 00000000`00041790 fffffa80`011b8d80 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0923c5d0 fffff800`02ea6df9 : 00000000`00000000 00000000`7587ffff 00000000`00000000 fffff800`03002888 : nt! ?? ::FNODOBFM::`string'+0x33906
fffff880`0923c790 fffff800`02e4681c : ffffffff`ffffffff fffff880`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0923c8b0 fffff800`03158dcf : fffff8a0`041f3580 fffff880`0923cc20 00000000`00000000 fffffa80`04716aa0 : nt!MmCleanProcessAddressSpace+0x228
fffff880`0923c900 fffff800`03131635 : 00000000`40010004 00000000`00000001 00000000`7efd8000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`0923c9c0 fffff800`02e501db : 00000000`00000000 00000000`00000000 fffff880`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`0923c9f0 fffff800`02e50620 : 00000000`778a1c04 fffff880`0923ca70 fffff800`0313174c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0923ca70 fffff800`02e72a37 : 00000000`00000001 fffffa80`047e1c60 00000000`00000000 fffff880`0923cc00 : nt!KiInitiateUserApc+0x70
fffff880`0923cbb0 00000000`743a2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`00cbf038 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x743a2dd9


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+33906
fffff800`02ee6f9e cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+33906

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9

FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

Followup: MachineOwner
---------


This is interesting, PROCESS_NAME: FlashUtil10m_A ???

I'm getting more and more confused by the second.. Lol.

FlashUtil10m_A belongs to the Philips Flash Utility. You have three different error codes each citing a different probable cause. This can often point to memory issues.

Do the following: Find the voltage specs of your RAM and compare it to the voltage setting in your BIOS. Do they match? How about the timings? If there is a descrepancy set manually to RAM specs in the BIOS.

Well, Memory voltages etc is all fine, tried upping the voltage to 1.5 etc to monitor any differences... made no difference at all. Got 2 Blue screens this morning.

Heres minidump on the latest:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff9600016aaa9, Address of the instruction which caused the bugcheck
Arg3: fffff8800aa5d160, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
win32k!WantImeWindow+29
fffff960`0016aaa9 f6422004 test byte ptr [rdx+20h],4

CONTEXT: fffff8800aa5d160 -- (.cxr 0xfffff8800aa5d160)
rax=fffffa80060f7b28 rbx=fffff900c06c20a0 rcx=fffff900c0600b90
rdx=0000000000000d10 rsi=0000000000000000 rdi=fffff900c2060bb0
rip=fffff9600016aaa9 rsp=fffff8800aa5db38 rbp=0000000000000000
r8=fffff900c2060bb0 r9=0000000076f9f982 r10=fffff96000170700
r11=fffff8800aa5dbe8 r12=000000007ee7c000 r13=0000000013c7fd20
r14=0000000013c7f0a0 r15=00000000742f2450
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
win32k!WantImeWindow+0x29:
fffff960`0016aaa9 f6422004 test byte ptr [rdx+20h],4 ds:002b:00000000`00000d30=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff9600016f8d8 to fffff9600016aaa9

STACK_TEXT:
fffff880`0aa5db38 fffff960`0016f8d8 : fffffa80`0644b610 fffff680`0018ee40 fffffa80`06959980 00000000`00000000 : win32k!WantImeWindow+0x29
fffff880`0aa5db40 fffff960`0017073b : 00000000`00000000 00000000`00000000 fffff880`0aa5dca0 00000000`17d86620 : win32k!xxxDestroyWindow+0xc8
fffff880`0aa5dbf0 fffff800`02ed2993 : 00000000`00000001 00000000`0cfa33f0 00000000`1abb5b01 00000000`7ee7c000 : win32k!NtUserDestroyWindow+0x3b
fffff880`0aa5dc20 00000000`742f2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`13c7f028 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x742f2dd9


FOLLOWUP_IP:
win32k!WantImeWindow+29
fffff960`0016aaa9 f6422004 test byte ptr [rdx+20h],4

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!WantImeWindow+29

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4cbe5d3e

STACK_COMMAND: .cxr 0xfffff8800aa5d160 ; kb

FAILURE_BUCKET_ID: X64_0x3B_win32k!WantImeWindow+29

BUCKET_ID: X64_0x3B_win32k!WantImeWindow+29

Followup: MachineOwner
---------

Attach those two minidumps the next time you psot. Use the Manage Attachments button. Please don't Zip them.

Route44 said:

Attach those two minidumps the next time you psot. Use the Manage Attachments button. Please don't Zip them.

Click to expand...

I just tried, and it doesn't allow me to attach those files because of their extension. What would you like me to do?

Here are the steps in order to create smaller Minidump files. You should then be able to attach but we'll have to wait for another BSOD. My suspicion is corrupted memory, however. Have ever run Memtest? Also, find the voltage specs of your RAM and compare it to the voltage setting in your BIOS. Do they match? How about the timings?

For Windows 7:

Go to the Control Panel, choose 'System And Security', and then click 'System', and then click the 'Advanced System Settings' link.

In the opened window, click the 'Advanced' tab and then inside the 'Startup And Recovery' frame, click the 'Settings' button.

In the opened 'Startup And Recovery' window, there is 'Write Debugging Information' section. You should set the combo-box in this section to 'Small memory dump', and then click 'ok' to confirm the change.

Route44,

I just encountered my first BSOD in a few days.

I have resized the dump files, however in the windows\minidump directory, it is stil saved as the same extension (.dmp) and size?

Any idea?

The Zip option provided in the Manage Attachments button at the bottom when you go to post should be able to compress in order to attach.

Route44 said:

The Zip option provided in the Manage Attachments button at the bottom when you go to post should be able to compress in order to attach.

Click to expand...

Okay. Just attached the last 3 crashes over the past 2 days, in a Winrar .zip file.

Hope this helps you. Memory voltage is per supplier specs, and I've tried adjusting it from 1.25 to 1.65 etc but it makes no difference.

Since day one, fresh install of new retail edition of Windows 7 Home Premium, I have had Internet Explorer/Chrome/Firefox crash all the time, amongst all my BSODs. Could this be a motherboard/corrupt BIOS issue? I have upgraded BIOS also.

Lost for words at the moment!! Very angry with this thing!

Sorry Altama87 for the delay but I had enabled a setting on my firewall that prevented me from reading minidump files.

Memory corruption was cited in one, corrupted pool in another, and a Windows OS driver in the third.

Question: Does your motherboard have onboard video capabilities?

Hey Route44,

No problems!

And
1) No onboard graphics, I have a 9800GTX dedicated card.
2) I have checked all drivers... everything seems to be up to date, and onboard sound is also disabled due to having dedicated sound card.
3) I have performed Memtest about 4 times, hasn't detected anything... :/

I dont know what to do!!!!

Given up hey... Lol.