win32k.sys blue screen

[JGood]

Hello,
I have a laptop running XP Pro SP2. When attempting to use dual
monitors (laptop screen and external monitor) with the Extended
Desktop feature, I get a BSOD with the following info:

STOP: 0x0000008E (0xC0000005, 0xBF9377A3, 0xA8B1F8Fc, 0x00000000)

win32k.sys - Address BF9377A3 base at BF8000001, Datestamp 48ce5235

It actually occurs whenever I try to change the Extended Desktop check
box or the Graphic Options | Output to.. setting. I renamed the
win32k.sys file and let Windows recreate it and also recreated the
page file (suggested solutions found elsewhere). This setup was
working fine until recently when the BSOD occured for the first time
after another external monitor was used. I checked the MS Update site
last week and there were no updates needed. I deleted all monitors
and dispaly adapters from Device Manager and restarted. The correct
monitors (drivers) were automaticly reinstalled.

Machine Info:
IBM/Lenovo X41 (not a Tablet) (problem occurs with or without a
docking sation)
1 GB RAM
Windows XP Pro SP2
External Monitor - Dell 1908FP - driver downloaded from MS Update site

Any help would be greatly appriciated! Thanks.

 

[Gerry]

Background information on Stop Error message 0x8E
http://msdn2.microsoft.com/en-us/library/ms794023.aspx

Please note this pararaph in the previos link. If the problem is
associated with Win32k.sys, the source of the error might be a
third-party remote control program. If such software is installed, you
can remove the service by starting the system by using the Recovery
Console and then deleting the offending system service file.

0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
A kernel mode program generated an exception which the error handler
didn't catch. These are nearly always hardware compatibility issues
(which sometimes means a driver issue or a need for a BIOS upgrade).
Source: http://aumha.org/a/stop.htm

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not checked.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JGood]

Hi Gerry (and any others),
Thanks for the info. This is not a
"KERNEL_MODE_EXCEPTION_NOT_HANDLED" error, so it doesn't look like the
link to backgroud info will provide a solution. Also, what exactly is
meant by a "remote control program". I doubt anything installed would
qualify as such, but if you could elaborate on this I would appricaite
it. However, I took a few more troubleshooting steps: no yellow
question marks anywhere in Device Manager, in Event Viewer I found
numerous cryptic errors which contained "Microsoft.VC80.MFCLOC" or
similar text - I'm clueless about this (related to problem or not?),
ran Sigverif.exe and the only unsigned drivers were in C:windows
\system32\spool\drivers\w32x86\3 - I belive these are all printer
driver related files from HP and Canon, finally I put the hard drive
from the problem laptop into an identical laptop (same exact model and
hardware) and still get the same BSOD, then I ran manufacture diags on
the hard drive and it passed. Any further light you can shed will be
appricaited. Thanks!

-James

 

[Gerry]

James

It is not uncommon to see more than one Stop Error report so you may see
an 0x0000008E error one moment and something else next time.

"remote control program".
http://en.wikipedia.org/wiki/Remote_control_software

You mentioned Extended Desktop feature earlier. Please elaborate.

"Microsoft.VC80.MFCLOC"
You need to post complete Event Viewer reports.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly should they occur
again. Right click on the My Computer icon on the Desktop and select
Properties, Advanced, Start-Up and Recovery, System Failure and uncheck
box before Automatically Restart.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JGood]

Gerry,

All BSODs are 0x0000008E errrors. The only thing that changes from
BSOD to BSOD is the 3rd of the 4 addresses in parentheses after the
0x8E. The info after win32k.sys is also always identical (see first
post). This may not be helpful, however.

There are no third-party remote control programs installed (only
Windows Remote Desktop).

The Extended Desktop feature is used for dual monitor systems such as
desktop machines with two (or more) video adapters and monitors, and
for laptops with built-in LCD screens using an external monitor on the
VGA port (such as my problem machine). What I was refering to eariler
is the checkbox beside "Extend my Windows desktop onto this monitor"
on the Settings tab of Dispaly Properties. A BSOD will always happen
when I right-click the desktop, then do Graphic Options | Output to..
and choose any option that isn't already checked.

As for the Event Viewer errors, I'll have to wait until Monday to get
the full text. Thanks for the tip.

I had already disabled auto restart on failure - I can't read that
fast!

Thanks again, James

 

[Gerry]

I liik forward to seeing the Event Viewer reports.


--



Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JGood]

Hi Gerry,
The following 3 errors occur frequently (several times a day) in the
System section of Event Viewer. It's always the same 3 and usually
they are repeated several times in a row. The most recent are below:

Event Type: Error
Event Source: SideBySide
Event Category: None
Event ID: 32
Date: 11/17/2008
Time: 8:09:05 AM
User: N/A
Computer: CTXNLLVG5170
Description:
Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last
Error was The referenced assembly is not installed on your system.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




Event Type: Error
Event Source: SideBySide
Event Category: None
Event ID: 59
Date: 11/17/2008
Time: 8:09:05 AM
User: N/A
Computer: CTXNLLVG5170
Description:
Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference
error message: The referenced assembly is not installed on your
system.
..

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




Event Type: Error
Event Source: SideBySide
Event Category: None
Event ID: 59
Date: 11/17/2008
Time: 8:09:05 AM
User: N/A
Computer: CTXNLLVG5170
Description:
Generate Activation Context failed for C:\WINDOWS\WinSxS
\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-
ww_dec6ddd2\MFC80.DLL. Reference error message: The operation
completed successfully.
..

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Thanks - James

 

[Gerry]

James

There seem to be a number of possibilities for the two Event ID:59
errors. Search the link for " referenced assembly is not installed"
http://www.eventid.net/display.asp?eventid=59&eventno=4228&source=SideBySide&phase=1

This link covers Event ID:32 but with much in common with the previous
one:
http://www.eventid.net/display.asp?eventid=32&eventno=4229&source=SideBySide&phase=1

Do you have Logitech's QuickCam software v10 or Sage Line 50?

Two Microsoft Knowledge Base Articles mentioned in the previous links
above:

Many instances of Error events 59 and 32 are logged in the System log on
a Windows Server 2003-based terminal server
http://support.microsoft.com/kb/914061/en-us
Are you running Windows Server 2003?

Event ID error messages are logged in the event log when you start
Microsoft Dynamics CRM 3.0 Mobile Deployment Manager on a Microsoft
Dynamics CRM server
http://support.microsoft.com/kb/923014/en-us
Are you using Microsoft Dynamics CRM 3.0 Mobile Deployment Manager

I am not sure what the above is but it led me to:
http://support.microsoft.com/kb/834789

Is there a reason for not installing the SP3 update as you may find hot
fixes in the update.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JGood]

Hi Martin,

Many Thanks for this info. I don't have time to apply this fix today,
but I'll give it a shot next week. I'll bet that will fix it.

-James