BSOD x7b... BugCheck B4 {88699008, 85cb1000, 85c9d000c 50000} Probable Cause: win32k.sys RRS feed

  • Question

  • Looking for any help!!!!  Multiple Laptops  Running Windows XP SP3. After, and only after SEP 12 was installed with Virtualization support, machines will randomly Blue screen.

    So far the only "Cure" is to boot up in Safe Mode and remove the Virtualization piece. Which defeats the purpose.

    Two different Models.  HP Elitebook 8740 and 8760. 

    Updated to the T with software updates including Video, bios, Intel chipset, etc.

    Funny thing is, the desktops are NOT doing this and they run fine.  What gives?

    Tuesday, March 6, 2012 9:24 PM

All replies

  • Your post is a bit different and confusing with the error info you have posted.  7b is the infamous error for INACCESSIBLE_BOOT_DEVICE.

    What is the SEP 12 install with Virtualization support?

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

    Tuesday, March 6, 2012 10:09 PM
  • Sep 12 is Symantec End Point Protection.... with Symantec Workspace Virtualization Agent.

    Errors as 7b with IDE in Bios, 7f with AHCI in Bios.  

    When the Virtualization Agent is removed, the Blue Screens Stop.  When you Run WinDBG for the minidump, it comes up with BugCheck B4.  

    So how do I find a fix since We will be virtualizing IE 7, when we move to Windows 7?

    Wednesday, March 7, 2012 1:30 PM
  • Here is a bug check when flipped to AHCI in BIOS....

    icrosoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [F:\8740\Mini030712-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_gdr.101209-1647
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
    Debug session time: Wed Mar  7 08:33:56.125 2012 (UTC - 5:00)
    System Uptime: 0 days 0:00:30.078
    Loading Kernel Symbols
    Loading User Symbols
    Loading unloaded module list
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007F, {8, ba348d70, 0, 0}

    *** WARNING: Unable to verify timestamp for fslx.sys
    *** ERROR: Module load completed but symbols could not be loaded for fslx.sys
    *** WARNING: Unable to verify timestamp for SYMDS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMDS.SYS
    *** WARNING: Unable to verify timestamp for Ironx86.SYS
    *** ERROR: Module load completed but symbols could not be loaded for Ironx86.SYS
    *** WARNING: Unable to verify timestamp for SRTSP.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SRTSP.SYS
    *** WARNING: Unable to verify timestamp for NAVEX15.SYS
    *** ERROR: Module load completed but symbols could not be loaded for NAVEX15.SYS
    Probably caused by : fslx.sys ( fslx+62df )

    Followup: MachineOwner

    3: kd> !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    This means a trap occurred in kernel mode, and it's a trap of a kind
    that the kernel isn't allowed to have/catch (bound trap) or that
    is always instant death (double fault).  The first number in the
    bugcheck params is the number of the trap (8 = double fault, etc)
    Consult an Intel x86 family manual to learn more about what these
    traps are. Here is a *portion* of those codes:
    If kv shows a taskGate
            use .tss on the part before the colon, then kv.
    Else if kv shows a trapframe
            use .trap on that value
            .trap on the appropriate frame will show where the trap was taken
            (on x86, this will be the ebp that goes with the procedure KiTrap)
    kb will then show the corrected stack.
    Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
    Arg2: ba348d70
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:

    BUGCHECK_STR:  0x7f_8



    PROCESS_NAME:  csrss.exe

    LAST_CONTROL_TRANSFER:  from b9c66b4e to b9c665d0

    ba315014 b9c66b4e e172a000 00010000 ba315034 Ntfs!NtfsCollateNames+0xf
    ba315044 b9c6685e e172a000 00010000 e19b1a98 Ntfs!NtfsFileCompareValues+0x51
    ba31527c b9c66a56 ba315640 e17ebd20 00000007 Ntfs!BinarySearchIndex+0x188
    ba3152a4 b9c6855e ba315640 e53f3e08 e19b1a98 Ntfs!FindFirstIndexEntry+0x19e
    ba3153cc b9c686f4 ba315640 e17ebeb8 e17ebd20 Ntfs!NtfsRestartIndexEnumeration+0x6c
    ba3155f0 b9c672e8 ba315640 87c58db8 8a030100 Ntfs!NtfsQueryDirectory+0x54a
    ba315624 b9c67253 ba315640 e17ebd20 8aa338a8 Ntfs!NtfsCommonDirectoryControl+0xbc
    ba31579c 804ef19f 8a030020 87c58db8 87c58db8 Ntfs!NtfsFsdDirectoryControl+0xad
    ba3157ac b9e0f09e 8aa33c18 8aa08228 8aa34260 nt!IopfCallDriver+0x31
    ba3157d8 804ef19f 8aa338a8 87c58db8 8a4628b0 fltMgr!FltpDispatch+0x152
    ba3157e8 b9da2459 ba31582c 804ef19f 8aa339e0 nt!IopfCallDriver+0x31
    ba3157f0 804ef19f 8aa339e0 87c58db8 87c58db8 sr!SrPassThrough+0x31
    ba315800 b9e0f09e 87c58fd8 8aa08228 880dabd8 nt!IopfCallDriver+0x31
    ba31582c 804ef19f 8aa34260 87c58db8 87c58db8 fltMgr!FltpDispatch+0x152
    ba31583c a8ce62df 880dabd8 87c58db8 87c58fd8 nt!IopfCallDriver+0x31
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ba315858 a8ce66d3 880dab20 00000000 8aa3a4e8 fslx+0x62df
    ba315878 804ef19f 880dab20 87c58fd8 806e7410 fslx+0x66d3
    ba315888 8057f98e ba3158f4 ba315998 80579e88 nt!IopfCallDriver+0x31
    ba31589c 80579ee5 880dab20 87c58db8 8aa3a4e8 nt!IopSynchronousServiceTail+0x70
    ba3158c0 8054167c 80000414 00000000 00000000 nt!NtQueryDirectoryFile+0x5d
    ba3158c0 805008a1 80000414 00000000 00000000 nt!KiFastCallEntry+0xfc
    ba315964 a8ceaa73 80000414 00000000 00000000 nt!ZwQueryDirectoryFile+0x11
    ba315a20 a8cee984 86771000 00000000 867ec3c2 fslx+0xaa73
    ba315a40 a8ce6dcb 8aa34260 89da43b0 00000043 fslx+0xe984
    ba315ad0 a8ce5edf 8aa34260 89d9a528 00000588 fslx+0x6dcb
    ba315b1c a8ce671b 880dab20 89d9a528 00000000 fslx+0x5edf
    ba315b3c 804ef19f 880dab20 89d9a748 89d9a528 fslx+0x671b
    ba315b4c b9e0ee9b 00000000 89d9a528 89d9a76c nt!IopfCallDriver+0x31
    ba315b70 b9e1b754 ba315b90 870f6020 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
    ba315bac 804ef19f 870f6020 89d9a528 89d9a528 fltMgr!FltpCreate+0x26a
    ba315bbc 80583220 8a9d7250 89d997fc ba315d54 nt!IopfCallDriver+0x31
    ba315c9c 805bf488 8a9d7268 00000000 89d99758 nt!IopParseDevice+0xa12
    ba315d14 805bba14 00000000 ba315d54 00000240 nt!ObpLookupObjectName+0x53c
    ba315d68 80576057 00000000 00000000 b1100000 nt!ObOpenObjectByName+0xea
    ba315de4 805769ce ba315f1c 00100080 ba315eb8 nt!IopCreateFile+0x407
    ba315e40 b9e01090 ba315f1c 00100080 ba315eb8 nt!IoCreateFile+0x8e
    ba315f10 b9dbb6e2 b9df9378 e1853943 00000000 SYMDS+0x4d090
    ba315f44 b9dbb92b ba315f5c e1a2db70 e18245a8 SYMDS+0x76e2
    ba315f80 b9dbe0fd e1a2db70 e18245a8 ba316028 SYMDS+0x792b
    ba315fa0 b9dbe3db e18ae1b4 e17c9820 e16c4238 SYMDS+0xa0fd
    ba315fb4 b9dc961e 00000000 e16c4238 e16c4238 SYMDS+0xa3db
    ba3160f0 b9dc6874 e17c9820 e16c4238 a8f10000 SYMDS+0x1561e
    ba316108 b9dc6907 b9df8428 b9df9020 a8f10000 SYMDS+0x12874
    ba31623c b9dfd587 e17c9820 00000000 e185500c SYMDS+0x12907
    ba31625c a8f060a2 e17c9820 00000000 00000000 SYMDS+0x49587
    ba31629c a8effdf4 ba3162c4 ba316304 ba31632c Ironx86+0x120a2
    ba3162e8 a8f04343 e18f2670 ba316304 00000000 Ironx86+0xbdf4
    ba316364 a8f04a48 75706552 e18f2670 00000006 Ironx86+0x10343
    ba316398 a8f568dd 75706552 e18f2670 00000006 Ironx86+0x10a48
    ba3163ec a8f26f3b 75706552 00000006 ba316448 SRTSP+0x3f8dd
    ba316484 a8f703b8 e56c2238 0000000d ba3164bc SRTSP+0xff3b
    ba316494 a8d5d12d e182cbc8 00000001 e56c2238 SRTSP+0x593b8
    ba3164bc a8dce353 00000014 e1856fe0 00000002 NAVEX15+0xf12d
    ba3164d8 a8dbde36 00000000 00000002 e56c1230 NAVEX15+0x80353
    ba316508 a8dbc5a3 00000000 00000081 e56ca074 NAVEX15+0x6fe36
    ba31654c a8d5676f a8ec58f0 e56c3ee8 00000000 NAVEX15+0x6e5a3
    ba31658c a8d5d286 ba3165f0 a8ec58f0 e56c3e20 NAVEX15+0x876f
    ba3165f8 a8f6eadf e53f21f0 e56c3e20 e56c3ee8 NAVEX15+0xf286
    ba316654 a8f5e30d 00000002 e56c3e08 e56c3fe8 SRTSP+0x57adf
    ba3166d4 a8f5f611 00000001 00000002 e56c3e08 SRTSP+0x4730d
    ba3166ec a8f605d6 ba31679c e56c3e08 e56c3e08 SRTSP+0x48611
    ba316708 a8f60745 00000000 ba31679c 00000000 SRTSP+0x495d6
    ba316724 a8f3d66e ba9990f8 88173858 8817390c SRTSP+0x49745
    ba316778 b9e0bef3 881738b4 ba31679c 00000000 SRTSP+0x2666e
    ba3167e0 b9e0e338 00173858 00000000 88173858 fltMgr!FltpPerformPostCallbacks+0x1c5
    ba3167f4 b9e0e867 88173858 89dfab78 ba316834 fltMgr!FltpProcessIoCompletion+0x10
    ba316804 b9e0eef9 8aa34260 89dfab78 88173858 fltMgr!FltpPassThroughCompletion+0x89
    ba316834 b9e1b754 ba316854 00000000 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x269
    ba316870 804ef19f 8aa34260 89dfab78 89dfadb4 fltMgr!FltpCreate+0x26a
    ba316880 a8ce5b7d 89dfab78 880cc4c0 880cc4e0 nt!IopfCallDriver+0x31
    ba3168a4 a8ce5ef4 8aa34260 89dfab78 89dfad98 fslx+0x5b7d
    ba3168d8 a8ce671b 880dab20 89dfab78 00000000 fslx+0x5ef4
    ba3168f8 804ef19f 880dab20 89dfad98 89dfab78 fslx+0x671b
    ba316908 b9e0ee9b 00000000 89dfab78 89dfadbc nt!IopfCallDriver+0x31
    ba31692c b9e1b754 ba31694c 870f6020 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b


    a8ce62df ??              ???


    SYMBOL_NAME:  fslx+62df

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: fslx

    IMAGE_NAME:  fslx.sys


    FAILURE_BUCKET_ID:  0x7f_8_fslx+62df

    BUCKET_ID:  0x7f_8_fslx+62df

    Followup: MachineOwner

    Wednesday, March 7, 2012 1:59 PM
  • See info @ http://msdn.microsoft.com/en-us/library/windows/hardware/ff557201%28v=vs.85%29.aspx

    From the way I read it, either the laptops have a hardware problem or there is a bug in the Symantec code.

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

    Wednesday, March 7, 2012 2:53 PM