BSOD: 0x50 and win32k.sys

[ComicCajun]

This is my first post, but I am in dire need of some help so here goes:

The BSOD that appeared was: Page_fault_in_nonpaged_area
and the code is: 0x00000050. It also gave me the system file "win32k.sys" as a possible problem.
I called dell tech. support and they suggested that I completely reinstall the OS to get rid of any future problems, but I would really prefer to do that only as a last resort so my questions are:
1) Is there a way to simply rename or replace win32k.sys to win32k.old and have Vista create a brand new, clean version of that file? And if so, how do I grant myself permission to do it because I did try and it said access denied.

2)If #1 won't work, is there a way to run the start-up repair function from the Vista CD to repair this file? I did try it, but every time I ran it, the screen that I received was "Please unplug any camera accessories blah blah blah" but I didn't have any portable devices connected...

3) Am I screwed and is reinstalling my only way out?

Thanks for your time.

 

[zigzag3143]

This is my first post, but I am in dire need of some help so here goes:

The BSOD that appeared was: Page_fault_in_nonpaged_area
and the code is: 0x00000050. It also gave me the system file "win32k.sys" as a possible problem.
I called dell tech. support and they suggested that I completely reinstall the OS to get rid of any future problems, but I would really prefer to do that only as a last resort so my questions are:
1) Is there a way to simply rename or replace win32k.sys to win32k.old and have Vista create a brand new, clean version of that file? And if so, how do I grant myself permission to do it because I did try and it said access denied.

2)If #1 won't work, is there a way to run the start-up repair function from the Vista CD to repair this file? I did try it, but every time I ran it, the screen that I received was "Please unplug any camera accessories blah blah blah" but I didn't have any portable devices connected...

3) Am I screwed and is reinstalling my only way out?

Thanks for your time.

Hi and welcome

dell and support are mutually exclusive (i have a dell). there are tons of things we can do before a re-install is required.

First its safe and easy. run a system file check, goto start>search>type cmd>in window typs sfc /scannow

Let me know how that goes

good luck

Ken

 

[ComicCajun]

it's running now. btw, thanks for the quick reply, ken.

 

[zigzag3143]

CC

glad your running. when it settles down run the sfc.

Ken

 

[ComicCajun]

results of sfc /scannow were:
Windows Resource protection found corrupt files but was unable to fix some of them.
details are included in CBS.log

and I would post the log here, but when I try and open any of the files I keep getting access denied.

 

[zigzag3143]

CC

can you drag it to the desktop? are you running as admin?

 

[ComicCajun]

I am admin, and I was able to copy and paste to desktop. I do have the files but they have a huge amount of information on them. Would you like me to attach them here?

 

[zigzag3143]

I am admin, and I was able to copy and paste to desktop. I do have the files but they have a huge amount of information on them. Would you like me to attach them here?

Sure zip them and upload it. how big is it? more than 1 Mb? if more than 1 mb it might not let you upload it

Ken

 

[ComicCajun]

About 3mbs? hopefully, I did it right

 

[zigzag3143]

CC

Its fine. Big but fine. let me look thru it.

 

[zigzag3143]

CC

The smallest is 28 Mb, the persistant.log is over 50 Mb. I dont have anything that will open that. Let me go see if i can find something that will

Ken

You are working ok right now, correct?

how long did it take notepad to open the smaller one?

 

[ComicCajun]

I opened them with notepad? perhaps that'll work?
And yes, currently, there are no problems. but the problems are strange and they come and go so I can't really force the BSODs to appear since I don't know what's causing them.
btw, thanks again for doing helping me out.

 

[Frostmourne]

Since win32k.sys is a system file, can you open up C:\Minidump or C:\Windows and look for a .dmp file. Upload it or take a look at the guide in my sig. That shoulld help determine the problem

 

[ComicCajun]

Thanks for the reply frostmourne, but I opened the.dmp file and all I got as crazy symbols (i opened it with notepad).
So i'll upload it here and maybe you guys can figure it out xD (sorry I'm a bit of a newb).
UPDATE: I tried to upload the .dmp and it says "invalid file"?

UPDATE 2:
I loaded it up with Windbg and here is what it says:
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff800`02064000 PsLoadedModuleList = 0xfffff800`02228dd0
Debug session time: Tue Sep 22 13:28:03.258 2009 (GMT-7)
System Uptime: 0 days 0:27:21.238
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff96000066ed0, fffffa6005572bd0, 0}

Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : win32k.sys ( win32k+6ed0 )

 

[Frostmourne]

The guide in my sig explains it, but you need WinDbg, available here:

http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx

 

[Frostmourne]

You need to set up symbols, set the file path to:

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

 

[zigzag3143]

CC

Are you having any connectivity problems, like wifi dropping, slow transfers, etc?

Sfc fixed all the errors but a few in the TCPIP stack. if your network is working, I wouldnt worry abt it

BTW I dont know if are aware that you have your visitor messages, and private messages turned off. there is no way to message you

 

[ComicCajun]

@zigzag: Umm no internet problems so I guess that's fine, and I went to profile privacy and it said "everyone" so I'm unsure how to turn messages on (again..I apologize for my newbness). But would you say that all in all, my win32k is fixed?

@frostmourne: figured out how to change the symbol path. this is now what I see:
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.18005.amd64fre.lh_sp2rtm.090410-1830
Machine Name:
Kernel base = 0xfffff800`02064000 PsLoadedModuleList = 0xfffff800`02228dd0
Debug session time: Tue Sep 22 13:28:03.258 2009 (GMT-7)
System Uptime: 0 days 0:27:21.238
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff96000066ed0, fffffa6005572bd0, 0}

Probably caused by : win32k.sys ( win32k!BRUSHMEMOBJ::BRUSHMEMOBJ+0 )

Followup: MachineOwner
---------

 

[Frostmourne]

Even if its fixed the .dmp should prove interesting. To set the symbol path, open WindDbg and then navigate to here:

 

[ComicCajun]

sorry frostmourne. The minute you post how to fix it, I post the results in an updated post before hand xD. Next time, I'll do better to look before I ask. But anywho, the results of the new dmp are above your post.