win32k.sys issue or other

Twist86

Twist86

Active Member
So been getting random error messages over the past week when I boot my PC 3 times in the past 10 days. I wanted to pinpoint the issue before running tests as I have a lot of work to do today so can't run them till tomorrow.
Currently transferring all 300GB of stuff off my main HDD.
First error stated "Hardware Issue" via debugging tools and I didn't think to look on the second. Third said win32k.sys ( win32k+c1337 ).

BTW on debugging for windows where do I download the symbols? I only get limited information from my minidump enough to at least know which item is screwing up.
Here is my minidump
http://www.mediafire.com/?nu6oak8ai00by44
Sadly site wont allow .dmp files. I am pretty confident its my HDD but wanna make sure. Thank you.
 
To load symbols set the symbol path to SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols where c:\Symbols is the local folder where you want to store the symbols.

It's a driver issue but whether it's caused by a corrupted file or an actual bad driver I don't know. I see this error code coming up a lot with video driver issues (specifically nvidia) but I don't know if it lists win32k.sys when it is a video driver issue. I'm wondering if the win32k.sys listing is a mislabel and that it may be related to AVG.

Here's the analyze -v of your dump if you're interested.
Code: 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000171337, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88003b29fe0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP: 
win32k!HMAllocObject+43
fffff960`00171337 488bbd58010000  mov     rdi,qword ptr [rbp+158h]

CONTEXT:  fffff88003b29fe0 -- (.cxr 0xfffff88003b29fe0)
rax=0000000000000000 rbx=0000000000000020 rcx=fffff960003571b0
rdx=0000000000000000 rsi=0000000000008802 rdi=0000000000000000
rip=fffff96000171337 rsp=fffff88003b2a9c0 rbp=0000000000000000
 r8=0000000000000010  r9=0000000000000080 r10=0000000000000001
r11=fffffa8005831b60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000080 r15=0000000000000010
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
win32k!HMAllocObject+0x43:
fffff960`00171337 488bbd58010000  mov     rdi,qword ptr [rbp+158h] ss:0018:00000000`00000158=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  avgchsva.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff960001676d5 to fffff96000171337

STACK_TEXT:  
fffff880`03b2a9c0 fffff960`001676d5 : fffff900`c00df300 fffff880`03a19ca0 00000000`000088b8 00000000`000088b8 : win32k!HMAllocObject+0x43
fffff880`03b2aa10 fffff960`00164a6a : fffff900`c00df300 fffff880`03a19ca0 fffff8a0`00b2e650 fffff960`001727d0 : win32k!InternalSetTimer+0xb5
fffff880`03b2aa80 fffff960`0016f998 : fffff900`c00df300 fffff8a0`00b2e650 fffff8a0`00b2e650 00000000`00000000 : win32k!SetAppStarting+0x52
fffff880`03b2aac0 fffff960`00173e29 : 00000000`00004000 00000000`00000000 fffff900`c00df300 fffff900`c00df300 : win32k!xxxInitProcessInfo+0x160
fffff880`03b2ab40 fffff960`00174046 : fffffa80`05831b01 fffff900`c00df300 00000000`00000001 fffffa80`05831060 : win32k!xxxUserProcessCallout+0x3d
fffff880`03b2ab90 fffff800`02f29dbd : fffffa80`05831b60 fffffa80`05831060 fffff6fc`4001d098 fffff6fc`4001d0c8 : win32k!W32pProcessCallout+0x4e
fffff880`03b2abc0 fffff800`02c77b2a : fffffa80`05831b60 000007fe`fe510000 00000000`00000020 00000000`76d626e0 : nt!PsConvertToGuiThread+0xd1
fffff880`03b2abf0 fffff800`02c7f31f : fffffa80`0000023a 00000000`76e1ffaa 00000000`00000000 00000000`0012d238 : nt!KiConvertToGuiThread+0xa
fffff880`03b2ac20 000007fe`fd3b527a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x1c4
00000000`0012d238 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fd3b527a


FOLLOWUP_IP: 
win32k!HMAllocObject+43
fffff960`00171337 488bbd58010000  mov     rdi,qword ptr [rbp+158h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!HMAllocObject+43

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc5e0

STACK_COMMAND:  .cxr 0xfffff88003b29fe0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!HMAllocObject+43

BUCKET_ID:  X64_0x3B_win32k!HMAllocObject+43

Followup: MachineOwner
---------
 
There are also malware related issues pertaining to win32k.sys. I would start with the easiest thing and scan using Malwarebytes.
 
johnb35 said:
There are also malware related issues pertaining to win32k.sys. I would start with the easiest thing and scan using Malwarebytes.
Click to expand...

Recent scan was this morning with spybot/maleware/avg and nothing popped up.


Also thanks Cromewell I will be doing a format this weekend and will update my drivers and see what happens. I usually format every 3 months to avoid issues but been lazy this year :P
 
You must log in or register to reply here.
Back
Top