[SOLVED] Unable to verify checksum for win32k.sys

Apr 23, 2021
1
0
10
0
Hi, I was starting windows 10, when i got a BSOD. The Minidump file says the following:

icrosoft (R) Windows Debugger Version 10.0.21306.1007 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Usuario\Documents\042321-47750-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff8022e800000 PsLoadedModuleList = 0xfffff8022f42a3d0
Debug session time: Fri Apr 23 09:01:44.292 2021 (UTC - 5:00)
System Uptime: 7 days 9:48:23.418
Loading Kernel Symbols
...............................................................
................................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
..................................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff8022ebf5e40 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffba05cc8e5b00=0000000000000018
6: kd> !analyze -v
***
  • *
  • Bugcheck Analysis *
  • *
***

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: ffff98856aec74e0, Object type of the object whose reference count is being lowered
Arg2: ffff988579465080, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0000000000080000, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 3546

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 18165

Key : Analysis.Init.CPU.mSec
Value: 453

Key : Analysis.Init.Elapsed.mSec
Value: 18757

Key : Analysis.Memory.CommitPeak.Mb
Value: 83

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 18

BUGCHECK_P1: ffff98856aec74e0

BUGCHECK_P2: ffff988579465080

BUGCHECK_P3: 1

BUGCHECK_P4: 80000

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

STACK_TEXT:
ffffba05cc8e5af8 fffff8022ec32df2 : 0000000000000018 ffff98856aec74e0 ffff988579465080 0000000000000001 : nt!KeBugCheckEx
ffffba05cc8e5b00 fffff8022eb2a5f2 : 0000000000000000 0000000000000000 0000000000000000 ffff9885794654d8 : nt!ObfDereferenceObjectWithTag+0x1d1c42
ffffba05cc8e5b40 fffff8022ea25975 : ffff988579b3b5c0 ffff98856ae98ce0 ffff98856ae98ce0 ffff988500000000 : nt!PspReaper+0x72
ffffba05cc8e5b70 fffff8022eb17e85 : ffff988579b3b5c0 0000000000000080 ffff98856ae91040 0000000000000001 : nt!ExpWorkerThread+0x105
ffffba05cc8e5c10 fffff8022ebfd498 : ffffaa01b9936180 ffff988579b3b5c0 fffff8022eb17e30 0000000000000020 : nt!PspSystemThreadStartup+0x55
ffffba05cc8e5c60 0000000000000000 : ffffba05cc8e6000 ffffba05cc8e0000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+1d1c42

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.928

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1d1c42

FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {fa6b3516-71cb-1e92-b987-b8bebd3458ac}

Followup: MachineOwner
---------

6: kd> !blackboxbsd
Stream size mismatch (expected = 192, read = 176)
6: kd> !analyze -v
***
  • *
  • Bugcheck Analysis *
  • *
***

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: ffff98856aec74e0, Object type of the object whose reference count is being lowered
Arg2: ffff988579465080, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0000000000080000, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2827

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 2854

Key : Analysis.Init.CPU.mSec
Value: 4014

Key : Analysis.Init.Elapsed.mSec
Value: 300918

Key : Analysis.Memory.CommitPeak.Mb
Value: 84

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 18

BUGCHECK_P1: ffff98856aec74e0

BUGCHECK_P2: ffff988579465080

BUGCHECK_P3: 1

BUGCHECK_P4: 80000

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

STACK_TEXT:
ffffba05cc8e5af8 fffff8022ec32df2 : 0000000000000018 ffff98856aec74e0 ffff988579465080 0000000000000001 : nt!KeBugCheckEx
ffffba05cc8e5b00 fffff8022eb2a5f2 : 0000000000000000 0000000000000000 0000000000000000 ffff9885794654d8 : nt!ObfDereferenceObjectWithTag+0x1d1c42
ffffba05cc8e5b40 fffff8022ea25975 : ffff988579b3b5c0 ffff98856ae98ce0 ffff98856ae98ce0 ffff988500000000 : nt!PspReaper+0x72
ffffba05cc8e5b70 fffff8022eb17e85 : ffff988579b3b5c0 0000000000000080 ffff98856ae91040 0000000000000001 : nt!ExpWorkerThread+0x105
ffffba05cc8e5c10 fffff8022ebfd498 : ffffaa01b9936180 ffff988579b3b5c0 fffff8022eb17e30 0000000000000020 : nt!PspSystemThreadStartup+0x55
ffffba05cc8e5c60 0000000000000000 : ffffba05cc8e6000 ffffba05cc8e0000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+1d1c42

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.928

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1d1c42

FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {fa6b3516-71cb-1e92-b987-b8bebd3458ac}

Followup: MachineOwner
---------
Please help me, I have no idea of what happened
 

Ralston18

Titan
Moderator
Update your post to include full hardware specs and Windows 10 Edition/Version information.

Try the following:

Look in Reliability History for other error codes and warnings. Much more user friendly and the timeline format can be quite helpful.

Run the built-in Windows troubleshooters. The troubleshooters may find and fix something.

Run "sfc /scannow" and "dism" via the Command Prompt.

References:

https://www.lifewire.com/how-to-use-sfc-scannow-to-repair-windows-system-files-2626161

https://www.howtogeek.com/222532/how-to-repair-corrupted-windows-system-files-with-the-sfc-and-dism-commands/

Hopefully just a corrupted file.
 
Reactions: Adam0ne

Ralston18

Titan
Moderator
Update your post to include full hardware specs and Windows 10 Edition/Version information.

Try the following:

Look in Reliability History for other error codes and warnings. Much more user friendly and the timeline format can be quite helpful.

Run the built-in Windows troubleshooters. The troubleshooters may find and fix something.

Run "sfc /scannow" and "dism" via the Command Prompt.

References:

https://www.lifewire.com/how-to-use-sfc-scannow-to-repair-windows-system-files-2626161

https://www.howtogeek.com/222532/how-to-repair-corrupted-windows-system-files-with-the-sfc-and-dism-commands/

Hopefully just a corrupted file.
 
Reactions: Adam0ne

ASK THE COMMUNITY

TRENDING THREADS