1

So at the company I work in, we have had this Blue Screen (SYSTEM_SERVICE EXCEPTION) show up with the file win32kfull.sys mentioned below that code. I have the crash dump, which says

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: 9

CPU_MICROCODE: 6,9e,9,0 (F,M,S,R)  SIG: 5E'00000000 (cache) 5E'00000000 (init)

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

ANALYSIS_SESSION_TIME:  02-20-2018 13:48:59.0052

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

LAST_CONTROL_TRANSFER:  from ffff81d66a06c08b to ffff81d66a06a1df

STACK_TEXT:  
fffffe8a`486f7a90 ffff81d6`6a06c08b : 00000000`00000001 00000000`00000005 ffff81a1`c5abf020 00000000`00000000 : win32kfull!NtGdiBitBltInternal+0xbaf
fffffe8a`486f7d60 fffff801`f4189c53 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32kfull!NtGdiBitBlt+0x5b
fffffe8a`486f7dd0 00007ffa`cba91184 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`060dd518 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`cba91184


THREAD_SHA1_HASH_MOD_FUNC:  670d79681f0fd9a3e0080ae7550a6d0a34550263

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  8edcfca753f5b3b60aee903a393a94482f1a64fd

THREAD_SHA1_HASH_MOD:  136701d13e4a364d33459c1674fd03c4bb31651c

FOLLOWUP_IP: 
win32kfull!NtGdiBitBltInternal+baf
ffff81d6`6a06a1df 488b87280b0000  mov     rax,qword ptr [rdi+0B28h]

FAULT_INSTR_CODE:  28878b48

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32kfull!NtGdiBitBltInternal+baf

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32kfull

IMAGE_NAME:  win32kfull.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  0

IMAGE_VERSION:  10.0.16299.15

STACK_COMMAND:  .cxr 0xfffffe8a486f70a0 ; kb

BUCKET_ID_FUNC_OFFSET:  baf

FAILURE_BUCKET_ID:  0x3B_win32kfull!NtGdiBitBltInternal

BUCKET_ID:  0x3B_win32kfull!NtGdiBitBltInternal

PRIMARY_PROBLEM_CLASS:  0x3B_win32kfull!NtGdiBitBltInternal

TARGET_TIME:  2018-02-07T20:14:08.000Z

OSBUILD:  16299

OSSERVICEPACK:  15

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2017-09-28 21:53:04

BUILDDATESTAMP_STR:  160101.0800

BUILDLAB_STR:  WinBuild

BUILDOSVER_STR:  10.0.16299.15

ANALYSIS_SESSION_ELAPSED_TIME:  12af

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x3b_win32kfull!ntgdibitbltinternal

FAILURE_ID_HASH:  {74c89bd2-272e-133c-315e-e8d721e74279}

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

^ This pesky BSOD is affecting 16 computers and here are the steps I have taken so far:

  1. Updated all drivers using 'Snappy Driver'. Updated all drivers from official Lenovo on another PC by manually downloading every single one.
  2. Ran dskchk, no problems found.
  3. Ran DISM (Deployment Image Servicing and Management) command: DISM.exe /Online /Cleanup-image /Restorehealth
  4. Updated manually GPU drivers (Integrated Intel) then reverted to older ones too.

None of that has solved this so far. Also, this began solely AFTER the feature update to 1709. And it happens specifically when restarting or signing off. These computers have 8 GB of RAM, and an Intel i5 7500. The model is Lenovo Thinkcentre m710q. Any help is appreciated.

  • Have you used windbg to provide more insight into the BSOD? You do know you are not using the current 1709 build, right? – Ramhound Feb 20 '18 at 19:17
  • I copied all of that exactly from the dump. The only other info on top is BugCheck 3B, {c0000005, ffff81d66a06a1df, fffffe8a486f70a0, 0} Probably caused by : win32kfull.sys ( win32kfull!NtGdiBitBltInternal+baf ) ^ And yes I know this is not the current build. Are you saying updating it could solve this? – Ravi Feb 20 '18 at 19:24
  • @Ravi there we updates that were causing BSOD on 1709. Microsoft released newer updates/builds to resolve this. – Unfundednut Feb 20 '18 at 21:31
  • update the GPU driver – magicandre1981 Feb 23 '18 at 15:24
  • I did all of that. I don't know why it still persists. Should I roll back GPU drivers few months back? – Ravi Feb 23 '18 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.