Windows 7 BSOD 50 (win32k.sys) every few minutes in normal or safe mode

[dmcmillen]

I'm prettly desperate here folks. Hard to stay up long enough to get anything done. I'm on an old laptop right now.

Win 7 64-bit Home Premium 6.1.7601 Service Pack 1 Build 7601 (6.1.7601.2.1.0.768.3)
12gb memory
nvidia GE Force 560 Ti video card
i7-960 4x2 processor
Gigabyte X58-UDR3 board
Award bios (latest)

Been running this machine for about 6 months with no problems until this am. Get a bsod 50 with win32k.sys as the culprit (2nd parameter = 1 and last parameter = 0). Same behavior in normal or safe mode. Have run memtest86+ 2 passes with no errors. I haven't made any changes recently to hardware and have installed some software yesterday that I don't believe would be the problem. Problem is intermittent and I cannot find any particular action that is causing the bsod. Right now the machine has been up for a while and Norton av is running in background, but definitely is not stable.

I would really appreciate some help here. Thanks - David

I am attaching the minidumps. Not sure if all the same so I'm attaching all of them to date. Sorry if too many.

Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed

 

[Trouble]

Hello and welcome to the forum.
Well all 13 (lucky number) of your dump files were identical in virtually every respect.
DUMP:

BugCheck 50, {fffff900c0ba0564, 1, fffff960000fdd46, 0}
[U][B]Could not read faulting driver name[/B][/U]
Probably caused by : win32k.sys ( win32k!fs__NewTransformation+52 )
Followup: MachineOwner
[U][B]PAGE_FAULT_IN_NONPAGED_AREA (50)[/B][/U]
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c0ba0564, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff960000fdd46, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
[U][B]Could not read faulting driver name[/B][/U]
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002913100
 fffff900c0ba0564 
FAULTING_IP: 
win32k!fs__NewTransformation+52
fffff960`000fdd46 44894408fc      mov     dword ptr [rax+rcx-4],r8d
MM_INTERNAL_CODE:  0
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  csrss.exe
CURRENT_IRQL:  0
TRAP_FRAME:  fffff88005d293b0 -- (.trap 0xfffff88005d293b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000004f10 rbx=0000000000000000 rcx=fffff900c0b9b658
rdx=fffff900c0b9b0d0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000fdd46 rsp=fffff88005d29540 rbp=fffff900c0a16af0
 r8=0000000073666e74  r9=0000000000000000 r10=0000000000000001
r11=fffff88005d29610 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
win32k!fs__NewTransformation+0x52:
fffff960`000fdd46 44894408fc      mov     dword ptr [rax+rcx-4],r8d ds:fffff900`c0ba0564=????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff8000268c9fc to fffff800026e0c40
STACK_TEXT:  
fffff880`05d29248 fffff800`0268c9fc : 00000000`00000050 fffff900`c0ba0564 00000000`00000001 fffff880`05d293b0 : nt!KeBugCheckEx
fffff880`05d29250 fffff800`026ded6e : 00000000`00000001 fffff900`c0ba0564 fffff900`c20db200 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`05d293b0 fffff960`000fdd46 : fffff900`c0a32ca0 fffff960`000cfd70 00000000`000001b8 fffff800`026ea82b : nt!KiPageFault+0x16e
fffff880`05d29540 fffff960`000fdc91 : 00000000`00000000 fffff900`c0b9b0d0 00000000`00000001 fffff900`c20c8f20 : win32k!fs__NewTransformation+0x52
fffff880`05d295f0 fffff960`000fd665 : fffff900`c0a16af0 00000000`00000001 00000000`00000000 fffff900`c0a32cb8 : win32k!bSetXform+0x599
fffff880`05d29670 fffff960`000fcfb0 : fffff900`c0a16af0 00000000`ffffffff 00000000`00000003 00000000`ffffffff : win32k!bGrabXform+0xa1
fffff880`05d296a0 fffff960`000fce2e : fffff8a0`037b8640 00000000`ffffffff fffff900`c0a32ca0 fffff900`c0a32ca0 : win32k!ttfdQueryFontData+0x120
fffff880`05d29700 fffff960`000d0c0e : fffff960`000fcdbc fffff900`c0a32ca0 00000000`00000003 00000000`00000002 : win32k!ttfdSemQueryFontData+0x72
fffff880`05d29760 fffff960`000ca46e : fffff880`05d29ad0 fffff900`c0b38614 00000000`00000000 fffff880`05d298b0 : win32k!PDEVOBJ::QueryFontData+0x82
fffff880`05d297f0 fffff960`000d0364 : fffff900`c0091000 fffff900`c20c8dc0 fffff900`c0b38614 00000000`00000000 : win32k!RFONTOBJ::bGetDEVICEMETRICS+0x6a
fffff880`05d29840 fffff960`00129cbc : fffff900`c0b38500 fffff880`05d29ad0 fffff880`05d299d0 fffff880`05d29b20 : win32k!RFONTOBJ::bRealizeFont+0x2fc
fffff880`05d29960 fffff960`000fb0e1 : 00000000`10018000 fffff900`00000000 000007fc`00000000 00000001`00000002 : win32k!RFONTOBJ::bInit+0x548
fffff880`05d29a80 fffff960`000fb077 : 00000000`00000000 fffff880`05d29ca0 00000000`70616d63 00000408`0a492800 : win32k!ulGetFontData2+0x31
fffff880`05d29af0 fffff960`000faf4d : 00000000`ffffffff 00000000`ffffffff 00000000`00000000 00000000`740daddc : win32k!ulGetFontData+0x7f
fffff880`05d29b40 fffff800`026dfed3 : ffffffff`b20107fc 00000000`00000000 00000000`0026e0c8 00000000`00000000 : win32k!NtGdiGetFontData+0x4d
fffff880`05d29bb0 00000000`74100b4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0026e0a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74100b4a
STACK_COMMAND:  kb
FOLLOWUP_IP: 
win32k!fs__NewTransformation+52
fffff960`000fdd46 44894408fc      mov     dword ptr [rax+rcx-4],r8d
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  win32k!fs__NewTransformation+52
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: win32k
IMAGE_NAME:  win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  4ecdcd5a
FAILURE_BUCKET_ID:  X64_0x50_win32k!fs__NewTransformation+52
BUCKET_ID:  X64_0x50_win32k!fs__NewTransformation+52
Followup: MachineOwner

We've seen a few issues similar that involved these drivers;
GVTDrv64.sys 9/5/2006 Gigabyte EasyTune6
gdrv.sys 3/12/2009 Gigabyte Easy Saver - mobo power utility driver
Update, uninstall or search find and rename.
Additionally a couple more to update
wacommousefilter.sys 2/16/2007 from here Link Removed due to 404 Error
GEARAspiWDM.sys 5/18/2009 from here Driver updates - GEAR Software
Additionally if Blue Screens persist you need to seriously consider removing Norton / Symantec software. Use the programs uninstaller and follow that up with this Link Removed
And consider replacing with Link Removed due to 404 Error.
Regards
Randy

EDIT: Additionally before posting further please take some time and read this Link Removed
Please do not attach individual dump files put all attachments into a single folder and zip it up and upload it here.
Thanks.

 

[dmcmillen]

Trouble - thanks for the BSOD submittal information. I will follow those guidelines from now on. Those are some great utilities. Because win32k.sys provides kernel mode GDI support and communicates directly with the graphics driver, I updated my nvidia drivers and I have been without a bsod for several hours now. Took a couple of bsod's before I was successful. Got my fingers crossed. This was a bad one because it was bug checking so often and in safe mode as well that I couldn't get any troubleshooting done.

 

[dmcmillen]

Well I thought I had this fixed but bsod 50's started again this morning immediately after booting up. Occurring every few minutes in safe or normal mode. Seems to stay up if I don't do anything but I am unable to do any prolonged work in Outlook or Firefox before another bsod. I'm pretty desperate. Right now I'm on a very old laptop and was able to get the SF Diagnostic info, cpuz and rammon info done and over to this machine. I'm attaching the Seven Forums zip file. There have been 3 or 4 more bsod's since then.

Link Removed

Thanks for your help -- David

 

[Trouble]

Looked at your latest dump file 011312-13852-01.dmp and there is not indication that you have taken any of the steps regarding updating, uninstalling or renaming the five drivers that I enumerated in my first post in this thread.
Especially critical are the two .sys files being generated by the Gigabyte product(s) you have installed on of which is a known Blue Screen producer.
I would recommend re-reading my initial post and address the issues discussed there before proceeding further.
Nice job putting together all the data. Thank You.
Regards
Randy

 

[dmcmillen]

Thanks Randy. It's been very difficult to troubleshoot with the machine bsoding every few minutes. Very unpredictable. Right now I've been up for awhile using IE9 instead of FireFox and seems to be more stable. I will test that further.

I have been able to update the GEARaspiWDM.sys driver with the link you provided.

I have not found a way to update the Gigabyte drivers. I uninstalled EasyTune6 which is supposed to be associated with GVTDrv64.sys, but after uninstalling, rebooting and rerunning the driver list, the same driver was still there. I then tried to install the newer version of EasyTune that I downloaded from Gigabyte but it would not install asking me to uninstall EasyTune6 first. I then ran a registry cleaner and searched the registry and could find no traces of EasyTune. I then installed the original EasyTune6 from the original Gigabyte cd and uninstalled, redownloaded the newer one and tried to install again with no success.

For gdrv.sys which is supposed to be associated with gigabyte Easy Saver, I uninstalled Easy Saver, rebooted and generated another driver list and the old gdrv.sys driver was still there. I then installed the new version of Easy Saver and that did not change the driver.

I called Gigabyte but they only provide the utilities and there is no support for them. They couldn't even give me information on drivers or how to update them. I have googled the drivers but the only hits are the driver updated sw packages which I have not had good luck with.

On the wacom driver, I have an old tablet that wacom instructed me to install this set of drivers so it would work under win 7. I will have to wait until Monday to talk to them about an update to this driver. Not possible to do anything online since no online support for this tablet.

Any suggestions on the Gigabyte drivers???

Thanks for your help,

David

 

[Elmer]

Any suggestions on the Gigabyte drivers???

If I can butt in,

Uninstall both the Gigabyte utilities (says a lot if even they don't offer support!). Don't update them, you don't want them.

Generate a driver list. Still there? Go to C:\Windows\System32\drivers and locate the GVTDrv64.sys and the gdrv.sys, change .sys to .old, this will "break" them and prevent them from loading. At a later date you can delete them.

Wacom? I don't think there is an update for that driver, although there may be now, not looked for over 6 months. If you don't use your mouse on the Wacom tablet (well, why would you? You've a bigger screen in front of you to use the mouse on) you can quite safely disable that driver by changing its file extension from sys to old. That will break it and prevent it from loading.

 

[dmcmillen]

Ok, I have updated the GEARaspiWDM.sys driver, uninstalled the 2 gigabyte utilities (EasyTune6 and Easy Saver), renamed the 2 gigabyte drivers to .old, rebooted, verified that the 2 drivers were gone, and within 5 minutes of working in Outlook and Firefox got another bsod 50. I am continuing to test because it seems if I use IE9 instead of FF I stay up.

I'm trying to attach the new zip file but the size puts me over the 10mb limit and I don't see how to delete any of them unless I edit each post and delete them there, but that would destroy the integrity of the thread. I tried renaming the upload file thinking it might overwrite the existing but that didn't work either. Need some help here please.

David

 

[Trouble]

Create a new folder on your desktop for your most recent dump files.
Open C:\Windows\Minidump
Select your most recent dump files(s)
Right click and choose copy
Paste them into the folder you created on your desktop, zip it up and attach it here.
We likely have or do not need the older ones as now it is the more current ones we should be attempting to analyze.
Regards
Randy

 

[dmcmillen]

I have finally solved this problem. It is definitely an obscure solution. First, I narrowed the problem down to Firefox, and found the thread below with the solution which has to do with a windows font problem. I agree with the solver that I do not understand why the problem manifests only with Firefox, but I can tell you that as long as I did not bring Firefox up everything ran ok. If I ran Firefox, within 5 minutes would get a bsod 50. I have no idea what triggered this, possible the Photoshop install, although that was more than a week ago. Since the fix, I have been up for several hours with no bsods. You'll need to scroll down in the thread to the solution by Niva.

Firefox Causes "BLUE SCREEN CRASH" | Firefox Support Forum | Firefox Help

As to the adding of a new attachment, the problem is not creating the new zip file on my end. The problem is that the forum would not let me upload the new file because the size of it added to the attachments already there went over the 10mb limit, thus it did not upload the file. I did not see any way to delete the old attachments to make room.

Thanks for the help,

David

 

[Trouble]

Well that is good news and glad to hear that you were able to resolve your issue. Thanks for posting back and updating your thread with the solution that worked for you.
What version of Firefox were you using?
As far as managing your attachments you should be able to do that by using the "Settings" link in the top right corner of the site pages.
In the left column under the Miscellaneous heading click the Attachments link.
You should be able to clean up attachments by selecting and clicking the Delete Selected button.
Thanks Again and we hope to continue to see you around the forum.
Regards
Randy

 

[Elmer]

And a Thanks from me as well. Have bookmarked your solution. Never know when this obscure problem will show up again.