locked
Multiple System Crashes related to opening font folder and opening outlook email RRS feed

  • Question

  • This week I started to have blue screen system crashes. THe crashes some times happen during random operation but consistantly happen when opening outlook email file or opening the font folder.

    I have run the System File Checker and the Memtest86. Both came up clean.

    Below is a dump file from a recent crash.

    Any help would be greatly appritiated.

    Thanks

     

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

    Copyright (c) Microsoft Corporation. All rights reserved.

     

     

    Loading Dump File [C:\Users\Public\Documents\Dumps\102910-25178-01.dmp]

    Mini Kernel Dump File: Only registers and stack trace are available

     

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols

    Executable search path is:

    Windows 7 Kernel Version 7600 MP (4 procs) Free x64

    Product: WinNt, suite: TerminalServer SingleUserTS Personal

    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621

    Machine Name:

    Kernel base = 0xfffff800`02c5e000 PsLoadedModuleList = 0xfffff800`02e9be50

    Debug session time: Fri Oct 29 22:28:33.156 2010 (UTC - 5:00)

    System Uptime: 0 days 6:22:21.608

    Loading Kernel Symbols

    ...............................................................

    ................................................................

    ................

    Loading User Symbols

    Loading unloaded module list

    ......

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    Use !analyze -v to get detailed debugging information.

     

    BugCheck 50, {fffff900c1edb800, 1, fffff80002e0293e, 0}

     

     

    Could not read faulting driver name

    Probably caused by : win32k.sys ( win32k!EngAllocMem+47 )

     

    Followup: MachineOwner

    ---------

     

    3: kd> !analyze -v

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    PAGE_FAULT_IN_NONPAGED_AREA (50)

    Invalid system memory was referenced.  This cannot be protected by try-except,

    it must be protected by a Probe.  Typically the address is just plain bad or it

    is pointing at freed memory.

    Arguments:

    Arg1: fffff900c1edb800, memory referenced.

    Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.

    Arg3: fffff80002e0293e, If non-zero, the instruction address which referenced the bad memory

            address.

    Arg4: 0000000000000000, (reserved)

     

    Debugging Details:

    ------------------

     

     

    Could not read faulting driver name

     

    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f060e0

     fffff900c1edb800

     

    FAULTING_IP:

    nt!ExAllocatePoolWithTag+56e

    fffff800`02e0293e 8803            mov     byte ptr [rbx],al

     

    MM_INTERNAL_CODE:  0

     

    CUSTOMER_CRASH_COUNT:  1

     

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

     

    BUGCHECK_STR:  0x50

     

    PROCESS_NAME:  csrss.exe

     

    CURRENT_IRQL:  0

     

    TRAP_FRAME:  fffff880067e9d30 -- (.trap 0xfffff880067e9d30)

    NOTE: The trap frame does not contain all registers.

    Some register values may be zeroed or incorrect.

    rax=00000000000000c7 rbx=0000000000000000 rcx=fffff900c1edaba0

    rdx=fffff900c1edab90 rsi=0000000000000000 rdi=0000000000000000

    rip=fffff80002e0293e rsp=fffff880067e9ec0 rbp=fffff880053a5cc0

     r8=0000000000000021  r9=fffff880053a6260 r10=fffff880053a5cc8

    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000

    r14=0000000000000000 r15=0000000000000000

    iopl=0         nv up ei ng nz na po nc

    nt!ExAllocatePoolWithTag+0x56e:

    fffff800`02e0293e 8803            mov     byte ptr [rbx],al ds:00000000`00000000=??

    Resetting default scope

     

    LAST_CONTROL_TRANSFER:  from fffff80002d4ef14 to fffff80002cce740

     

    STACK_TEXT: 

    fffff880`067e9bc8 fffff800`02d4ef14 : 00000000`00000050 fffff900`c1edb800 00000000`00000001 fffff880`067e9d30 : nt!KeBugCheckEx

    fffff880`067e9bd0 fffff800`02ccc82e : 00000000`00000001 fffff900`c1edb800 00000000`00000000 fffff680`00004080 : nt! ?? ::FNODOBFM::`string'+0x42837

    fffff880`067e9d30 fffff800`02e0293e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e

    fffff880`067e9ec0 fffff960`00128497 : fffff880`00000000 fffff900`c09c1cc8 fffff880`067ea050 00000000`00000000 : nt!ExAllocatePoolWithTag+0x56e

    fffff880`067e9fb0 fffff960`000e1d99 : fffff900`c09c1cc8 fffff880`067ea050 00000000`00000001 00000000`00810860 : win32k!EngAllocMem+0x47

    fffff880`067e9fe0 fffff960`000d913b : fffff900`c09c1c70 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0x121

    fffff880`067ea010 fffff960`000d92da : fffff900`c09c1c70 fffff900`00000001 fffff900`c09c1c70 fffff960`00246a30 : win32k!bReloadGlyphSet+0x24b

    fffff880`067ea6d0 fffff960`000d9232 : 00000000`00000000 fffff900`c09c1c70 fffff900`00000001 fffff900`c08754a4 : win32k!ttfdQueryFontTree+0x66

    fffff880`067ea720 fffff960`00124817 : fffff960`000d91d8 fffff900`c09c1fb0 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a

    fffff880`067ea760 fffff960`001246c3 : fffff880`067ea870 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63

    fffff880`067ea7e0 fffff960`000e0002 : fffff900`c008a010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ::pfdg+0xa3

    fffff880`067ea840 fffff960`00138df0 : fffff900`c0875390 fffff880`067eaad0 fffff880`067ea9d0 fffff880`067eab20 : win32k!RFONTOBJ::bRealizeFont+0x46

    fffff880`067ea960 fffff960`0010a861 : 00000000`10010000 fffff900`00000000 00000391`00000000 00000000`00000002 : win32k!RFONTOBJ::bInit+0x548

    fffff880`067eaa80 fffff960`0010a7eb : fffff900`c0081000 fffff880`067eaca0 00000000`322f534f 000007fe`f64943ee : win32k!ulGetFontData2+0x31

    fffff880`067eaaf0 fffff960`0010a701 : 00000000`ffffffff 00000000`ffffffff fffffa80`06f31d20 fffff960`00184e4a : win32k!ulGetFontData+0x7f

    fffff880`067eab40 fffff800`02ccd993 : 00000000`29010391 00000000`00000000 00000000`03d4ec78 00000000`00000000 : win32k!NtGdiGetFontData+0x8d

    fffff880`067eabb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

     

     

    STACK_COMMAND:  kb

     

    FOLLOWUP_IP:

    win32k!EngAllocMem+47

    fffff960`00128497 488bd8          mov     rbx,rax

     

    SYMBOL_STACK_INDEX:  4

     

    SYMBOL_NAME:  win32k!EngAllocMem+47

     

    FOLLOWUP_NAME:  MachineOwner

     

    MODULE_NAME: win32k

     

    IMAGE_NAME:  win32k.sys

     

    DEBUG_FLR_IMAGE_TIMESTAMP:  4c7dc13c

     

    FAILURE_BUCKET_ID:  X64_0x50_win32k!EngAllocMem+47

     

    BUCKET_ID:  X64_0x50_win32k!EngAllocMem+47

     

    Followup: MachineOwner

    ---------

     

    3: kd> lmvm win32k

    start             end                 module name

    fffff960`000c0000 fffff960`003cf000   win32k     (pdb symbols)          c:\symbols\win32k.pdb\DF87B2BDDFB24A56B7724EA95ABCB58F2\win32k.pdb

        Loaded symbol image file: win32k.sys

        Mapped memory image file: c:\symbols\win32k.sys\4C7DC13C30f000\win32k.sys

        Image path: \SystemRoot\System32\win32k.sys

        Image name: win32k.sys

        Timestamp:        Tue Aug 31 21:58:04 2010 (4C7DC13C)

        CheckSum:         00304788

        ImageSize:        0030F000

        File version:     6.1.7600.16667

        Product version:  6.1.7600.16667

        File flags:       0 (Mask 3F)

        File OS:          40004 NT Win32

        File type:        3.7 Driver

        File date:        00000000.00000000

        Translations:     0409.04b0

        CompanyName:      Microsoft Corporation

        ProductName:      Microsoft® Windows® Operating System

        InternalName:     win32k.sys

        OriginalFilename: win32k.sys

        ProductVersion:   6.1.7600.16667

        FileVersion:      6.1.7600.16667 (win7_gdr.100831-1503)

        FileDescription:  Multi-User Win32 Driver

        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    3: kd> .trap 0xfffff880067e9d30

    NOTE: The trap frame does not contain all registers.

    Some register values may be zeroed or incorrect.

    rax=00000000000000c7 rbx=0000000000000000 rcx=fffff900c1edaba0

    rdx=fffff900c1edab90 rsi=0000000000000000 rdi=0000000000000000

    rip=fffff80002e0293e rsp=fffff880067e9ec0 rbp=fffff880053a5cc0

     r8=0000000000000021  r9=fffff880053a6260 r10=fffff880053a5cc8

    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000

    r14=0000000000000000 r15=0000000000000000

    iopl=0         nv up ei ng nz na po nc

    nt!ExAllocatePoolWithTag+0x56e:

    fffff800`02e0293e 8803            mov     byte ptr [rbx],al ds:00000000`00000000=??

     

    Saturday, October 30, 2010 3:37 PM

Answers

  • Hi,

     

    After checking this issue, I find it is related to win32k.sys. I suggest you could try the following steps:

     

    1.    Test the issue in Safe Mode whit networking.

     

     2. If you install some programs or drivers recently, you could disable them temporarily to check the result.

    Meanwhile, I would like the share the following links with you:

     

    "0x0000003B" Stop error occurs in Windows Server 2008 R2 and in Windows 7 when an application or a service performs a GUI-related operation

     

    However, this is related to kernel crash issue, we need to debug the crashed system dump and analyze the related source code if needed. Unfortunately, debugging is beyond what we can do in the forum. I'd like to recommend that you contact Microsoft Customer Support Service (CSS) for assistance so that this problem can be resolved efficiently. To obtain the phone numbers for specific technology request please take a look at the web site listed below:

     

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

     

    If you are outside the US please see http://support.microsoft.com for regional support phone numbers.

     

    Hope it helps.

     

    Alex Zhao

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

     

    • Marked as answer by Cloud_TS Friday, November 12, 2010 10:31 AM
    Thursday, November 4, 2010 1:19 PM
  • Sorry took me so long to reply. I have been working the issue through another forum.

    I have found the solution to my system crashes.

    Apperently I had a corrupt font folder. I think my wife may have installed a bad font.

    She does a lot of desktop publishing and occasionally adds fonts to the system.

    She had 805 fonts in the folder

    I could not replace the font folder mannually so I ran the MS Office repair option under the setup application.

    The repair application replaced the corupted font folder with the default folder.

    This fixed my system crash problems.

    I have been running for about a week since the fix and have had no further problems.

    Thanks for your reply.

    • Marked as answer by jaloboda Sunday, November 21, 2010 2:29 PM
    Sunday, November 21, 2010 2:24 PM

All replies

  • Hi,

     

    After checking this issue, I find it is related to win32k.sys. I suggest you could try the following steps:

     

    1.    Test the issue in Safe Mode whit networking.

     

     2. If you install some programs or drivers recently, you could disable them temporarily to check the result.

    Meanwhile, I would like the share the following links with you:

     

    "0x0000003B" Stop error occurs in Windows Server 2008 R2 and in Windows 7 when an application or a service performs a GUI-related operation

     

    However, this is related to kernel crash issue, we need to debug the crashed system dump and analyze the related source code if needed. Unfortunately, debugging is beyond what we can do in the forum. I'd like to recommend that you contact Microsoft Customer Support Service (CSS) for assistance so that this problem can be resolved efficiently. To obtain the phone numbers for specific technology request please take a look at the web site listed below:

     

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

     

    If you are outside the US please see http://support.microsoft.com for regional support phone numbers.

     

    Hope it helps.

     

    Alex Zhao

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

     

    • Marked as answer by Cloud_TS Friday, November 12, 2010 10:31 AM
    Thursday, November 4, 2010 1:19 PM
  • Sorry took me so long to reply. I have been working the issue through another forum.

    I have found the solution to my system crashes.

    Apperently I had a corrupt font folder. I think my wife may have installed a bad font.

    She does a lot of desktop publishing and occasionally adds fonts to the system.

    She had 805 fonts in the folder

    I could not replace the font folder mannually so I ran the MS Office repair option under the setup application.

    The repair application replaced the corupted font folder with the default folder.

    This fixed my system crash problems.

    I have been running for about a week since the fix and have had no further problems.

    Thanks for your reply.

    • Marked as answer by jaloboda Sunday, November 21, 2010 2:29 PM
    Sunday, November 21, 2010 2:24 PM