[leinukv5]

hi every one..

i need help, i have an error code in my screen..

A problem has been shut detected and windows has been shutdown to prevent damage to your computer. The problem seems to be cause by the following file:
win32k.sys PAGE_FAULT_IN_NONPAGED_AREA

Technical Information:
*** STOP: 0x00000050 (0xE1B60304, 0x00000000, 0xBF8AF5D9, 0x00000001)
*** win32k.sys - address BF8AF5D9 base at BF800000 Date stamp 47b0cdb5

Beginning dump memory of physical memory

or...

Technical Information:
*** vidstub.sys address BA41F189 base at BA41E000, date stamp 408d4b3d

Beginning dump memory of physical memory

What should i do?
please i need help..

best regards
JBU

leinuk

[Advertisements]

Have you installed any new hardware or software lately? If so try booting into Safe Mode, press the F8 key when the Windows boot screen comes up, and uninstall it. In any case try booting into Safe Mode and tell us what happens. There are several things that can cause this, one is faulty memory, a faulty hard drive or corrupt files. Going into Safe Mode may let you find out more.

[Tyger]

Have you installed any new hardware or software lately? If so try booting into Safe Mode, press the F8 key when the Windows boot screen comes up, and uninstall it. In any case try booting into Safe Mode and tell us what happens. There are several things that can cause this, one is faulty memory, a faulty hard drive or corrupt files. Going into Safe Mode may let you find out more.

[leinukv5]

hi tyger,

thank you for your suggestion, but i've install many software lately.
well.. 2 days ago, i've install the "lost via domus, assassin creed, ghost recon," games. is this included.
And after i log in with safe mode in to my XP, there's nothing happen, everything seems fine.
What should i do next, to find what kind of software, that my pc crash?

Thank u
Best regards
JBU

Leinuk

[leinukv5]

hello there, did anyone could help me?

after i check the problem error with Windbg, here's the log


Microsoft ® Windows Debugger Version 6.8.0004.0 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini040608-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3.3311) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sun Apr 6 19:45:24.734 2008 (GMT+7)
System Uptime: 0 days 0:21:37.416
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
................................................................................
.................................................................................
.....
Loading User Symbols
Loading unloaded module list
.........
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Unable to load image dxg.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dxg.sys
*** ERROR: Module load completed but symbols could not be loaded for dxg.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e6cc3304, 0, bf8af5d9, 1}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
*** WARNING: Unable to verify timestamp for avipbb.sys
*** ERROR: Module load completed but symbols could not be loaded for avipbb.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************


Probably caused by : SYMEVENT.SYS ( SYMEVENT+12d25 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e6cc3304, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf8af5d9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************



FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45833e2a

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
e6cc3304

FAULTING_IP:
win32k+af5d9
bf8af5d9 8b0e mov ecx,dword ptr [esi]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from bf008af2 to bf8af5d9

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
aacda7e8 bf008af2 e1044080 e84a4754 aacda824 win32k+0xaf5d9
aacda830 bf009033 00000001 e8b93b70 aacda8b8 dxg+0x8af2
aacda84c bf892266 e84a4008 00000001 e8ceb9c8 dxg+0x9033
aacda86c bf8acbeb aacdaa0c e17b6680 00000000 win32k+0x92266
aacda898 bf8ad5eb e17b6680 e1318390 e6ed1370 win32k+0xacbeb
aacdaa10 bf8b3f2e 00000000 00000000 00000001 win32k+0xad5eb
aacdab04 bf8b6199 00000000 e1c042d8 00000000 win32k+0xb3f2e
aacdab48 bf876850 00000000 00000000 00000000 win32k+0xb6199
aacdab88 bf819c94 00000001 aacdabb0 bf819d58 win32k+0x76850
aacdab94 bf819d58 89477d80 00000001 00000000 win32k+0x19c94
aacdabb0 805d2477 89477d80 00000001 89477d80 win32k+0x19d58
aacdac54 805d28c8 c0000005 89477d80 00000000 nt+0xfb477
aacdac74 805d2aa3 89477d80 c0000005 c0000001 nt+0xfb8c8
aacdaca0 ae201d25 00000000 c0000005 f7b1bf17 nt+0xfbaa3
aacdad10 8ae6be6c e1a9b080 ffffffff c0000005 SYMEVENT+0x12d25
aacdad24 f752c971 ffffffff c0000005 aacdad64 0x8ae6be6c
aacdad54 8054161c 00000000 c0000005 0013ffa8 avipbb+0x5971
aacdad64 7c90e4f4 badb0d00 0013feb4 ab7d4d98 nt+0x6a61c
aacdad68 badb0d00 0013feb4 ab7d4d98 ab7d4dcc 0x7c90e4f4
aacdad6c 0013feb4 ab7d4d98 ab7d4dcc 00000000 0xbadb0d00
aacdad70 ab7d4d98 ab7d4dcc 00000000 00000000 0x13feb4
aacdad74 ab7d4dcc 00000000 00000000 00000000 0xab7d4d98
aacdad78 00000000 00000000 00000000 00000000 0xab7d4dcc


STACK_COMMAND: kb

FOLLOWUP_IP:
SYMEVENT+12d25
ae201d25 ?? ???

SYMBOL_STACK_INDEX: e

SYMBOL_NAME: SYMEVENT+12d25

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

1: kd> lmvm SYMEVENT
start end module name
ae1ef000 ae212000 SYMEVENT T (no symbols)
Loaded symbol image file: SYMEVENT.SYS
Image path: SYMEVENT.SYS
Image name: SYMEVENT.SYS
Timestamp: Sat Dec 16 07:30:34 2006 (45833E2A)
CheckSum: 0001D49E
ImageSize: 00023000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0


Could anyone give me a suggestion and advice, what should i do next?

thank u
best regards
JBU


leinuk

[Ztruker]

Boot to Safe Mode, do a System Restore to a few days before the problem started happening, see if that resolves it.

[Josho495]

I had the same problem.

I was getting blue screens with the same errors (below)

win32k.sys PAGE_FAULT_IN_NONPAGED_AREA

*** STOP: 0x00000050

Computer was infected with Malware.

Nothing to do with Hardware.

I tried system restore too but to no avail.

See if you can post a hijack log or something.

Someone should be able to help you out!


Good Luck

Josh