BSOD due to win32k.sys

[mks]

Hi everyone

I tried googling my problem with no result, even lounge doesn't offer any help (by using searching capability given by lounge off-course).

I am running Windows XP SP3 with all latest updates (using WSUS Offline Updates), and not connected to internet ever.

I strongly preach and use limited user accounts, all my and my family's accounts are limited accept one (viz. root), which is password protected, and usually not logged in (I use "runas" instead)

Usually I prefer to Hibernate my computer, and it runs fine every time.

Problem occurs when I try to log-off last user (many users are logged in simultaneously using "Switch User" instead of "Log Off")

OR

when I try to shutdown the PC (which implies that all users will get logged-off)

Then (not always, but more than 50% of the time) a BSOD occurs stating PAGE_FAULT_IN_NON_PAGED_AREA citing win32k.sys as culprit.

Can anybody help?

TIA

Kamran
Islamabad, Pakistan

[jockmullin]

Hi Kamran

How much memory does your system have?

Using fast user switching in conjunction with hibernation means the computer is swapping user memory out to the paging file and then putting all of memory into hibernation. This plus disk caching means a lot of disk activity related to memory management. Power sawing options and disk fragmentation can mean all this takes a long time to happen and the timing of events may be critical. Disk or memory problems (bad sectors or marginal memory locations) may come into play as well.

Personally I never use fast user switching because it can tie up a lot of system resources if idle users have applications and files left open. First of all try just getting your users to log off rather than switching users for a few days to see if that helps. Next try not using hibernation and see what the impact is there - shut down the computer for a couple of days. Also run memory and disk diagnostics and defragment the disk. Check your virtual memory settings and ensure you have lots of paging work space and the volume on which the paging file resides has lots of non-fragmented free space.

Basically it sounds like something is corrupting your memory contents, and overtaxing virtual memory may be a factor.

Jock

[mks]

Thanks Jock for your reply

> How much memory does your system have?

I have 512 MB of RAM (PC is Dell Optiplex GX270)

> Using fast user switching in conjunction with hibernation means
> the computer is swapping user memory out to the paging file
> and then putting all of memory into hibernation. This plus disk
> caching means a lot of disk activity related to memory management.
> Power saving options and disk fragmentation can mean all this
> takes a long time to happen and the timing of events may be critical.
> Disk or memory problems (bad sectors or marginal memory locations)
> may come into play as well.

You may be right, but my observation is that hibernation (and restore) takes just a couple of seconds. And as long as I hibernate the PC no problem occurs. But only when, and if, I shutdown my computer (not necessarily after hibernating previously) or if all users gets logged off.

> First of all try just getting your users to log off rather than switching users for a few days to see if that helps.

This results in BSOD many times (not every time though)

> Next try not using hibernation and see what the impact is there - shut down the computer for a couple of days.

It didn't help at all. I tried it for some time, but BSOD remains.

> Also run memory and disk diagnostics and defragment the disk.

Will try some memory diagnostic tool (although I never felt memory problem during my work), however, I routinely defragment my disk(s).

> Check your virtual memory settings and ensure you have lots of paging work space and the volume on which the paging file resides has lots of non-fragmented free space.

Already done.


Thanks anyway, will wait for further guideline while I get some memory diagnostic tool.

Kamran, Islamabad

[Deadeye81]

Hi Kamran,

Check the Event Viewer Windows Logs (under Administrative Tools) - the Application Log and the System Log for any critical errors at the time of the BSOD's. Sometimes the cause of the fault will be logged in one of those logs. The Win32k.sys error can be generated by various faulting drivers or files.

Also, check in Control Panel>System>Advanced>Startup and Recovery Settings to be sure Automatically restart under System failure is unchecked, and the Small memory dump (64 KB) is enabled under Write debugging information. When the BSOD occurs, it will dump memory contents into the Small dump directory, and you can download and run Nirsoft's BlueScreenView to see what it identifies as the cause of the BSOD. It may give a more specific file name or driver that caused the fault.

And as Jock suggested, running a memory diagnostic tool is a good measure to take as well. Memtest86 can be downloaded here. Faulting memory modules, video drivers, hard disk issues, DVD drive hardware problems, overheating, faulty power supply and others can generate the Win32k.sys error.

In fact, if your Dell has not been opened and cleaned for some time, I would inspect the interior, use a can of compressed air for use in electronics, to clean out the CPU heat sink/fan assembly and the rest of the computer, and confirm all fans are functional, check all device connections to be sure they are seated firmly, including the RAM sticks.

You might also run 'chkdsk /r' without the quote marks from the Recovery Console by booting to your Windows XP installation disk. Also, identify the hard drive manufacturer from Device Manager and download their hard disk diagnostics tool from their support site.