Win32kfull.sys blue screen

[Iketsu31425]

Hello, I've been having an issue that has been following me from Windows 8.1 to 10 now. Essentially what happens is at random intervals I will be unable to open things on my desktop, open things on my taskbar, or the start menu, unable to right click, and now when this happens I get a blue screen shortly after that says: Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\win32kfull.sys

I have tried doing numerous things including multiple runs of dism/sfc and running memtest86 overnight just in case it was a hardware issue, scanning for infections (as per recommendation of one of the users in the Windows 8 forum), and making a new user account. Any help in this matter would be greatly appreciated.

Thanks in advance.

One quick update: The one thing in event viewer that seems to be constant is Event ID 243 from source Win32k which I searched and found: Desktop Heap Allocation Failed. But I'm unsure if that has anything to do with the issue I am facing.

 

[Colif]

download and run this: http://www.resplendence.com/whocrashed
it reads error logs and outputs them in a form we can read
it may point to the cause but mostly just points at windows

Paste results here if its not obvious what cause is

 

[Colif]

BTW, do you have an AMD card? 71% of the errors attributed to that sys file are ATI driver related... its why I ask.

If so, try this: http://www.tomshardware.com/faq/id-2767677/clean-graphics-driver-install-windows.html

 

[Iketsu31425]

Thanks for the response.

On Sat 4/16/2016 5:25:09 AM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\041616-8109-01.dmp
This was probably caused by the following module: win32kfull.sys (win32kfull!SetRedirectedWindow+0x15F)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF960EB8998BB, 0xFFFFD000235219D0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\win32kfull.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Full/Desktop Win32k Kernel Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

That's what Whocrashed says.

And yes I do have an AMD card an R9 280x

The only thing with the GPU driver solution is that this issue started in Windows 8.1, so I don't think it's a 10 driver issue.

 

[Colif]

well, fix works for 7, 8.1 & 10 so its worth a try.

try running these: http://answers.microsoft.com/en-us/windows/wiki/windows_10-update/system-file-check-sfc-scan-and-repair-system-files/bc609315-da1f-4775-812c-695b60477a93 - they will tell us if its windows or not.

its likely drivers and since win32kfull.sys runs the desktop, graphics are a obvious choice... but still, make sure you have up to date drivers as it could be any of them...

 

[Iketsu31425]

I'll give the full GPU driver install a shot.

I have run sfc and dism multiple times and they haven't found anything, so I don't think it's Windows.

Update: Alright, I've now done the GPU full reinstall, now I play the waiting game to see if this problem rears its ugly head yet again. Since it's intermittent, idk when that'll happen, but if it does I'll update this thread. If anybody else has any suggestions please please do not hesitate to reply.

 

[Colif]

Sorry, i forgot you ran sfc/dism already.

Its hard to work out an error with just one thing

 

[Iketsu31425]

Alright. I just had the issue pop up yet again. No blue screen this time but the same symptoms. Computer starts to bug out, can't click on anything on the task bar, can't right click, and right clicking on apps crashes them. This is getting very frustrating. I will say I found some more stuff in event viewer.

The User Data Access_4354c service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

The User Data Storage_4354c service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

The Contact Data_4354c service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

The Sync Host_4354c service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Those are all of the most recent errors in event viewer before I noticed the issue, but again, I have 0 idea if any of those correspond with the issue I'm having. The Desktop Heap Allocation Failure (Event id 243 win32k) also popped up about 25 minutes before those errors above.

 

[Colif]

As per Microsoft: "Windows NT uses a special memory heap for all Windows-based programs running on the desktop. The desktop heap is used for all objects (windows, menus, pens, icons, etc.). When a large number of Windows-based programs are running, this heap may run out of memory. When there is not enough memory to satisfy an allocation request, the system normally returns an error and notifies the user that they are running low on memory. Some programs do not handle the failure gracefully, and in some cases there may not be enough memory to create the error message dialog box. As a result, the requested operation fails without any indication".

at least it explains what the heap is...

I not seen this error before but I not giving up now...

do you get these errors in safe mode??

 

[Colif]

This should help: link matches part of last message

lol. i accidentally reported my last message,,,

 

[Iketsu31425]

I have not tried a boot into safe mode yet aside from when I did the GPU driver uninstall. With the issue being intermittent I would just be waiting around for hours for the problem to reproduce itself.

I read that link and it talks about an Apple Application, but I most certainly don't have any Apple Applications on this computer.

 

[Colif]

could it be they are wrong about it being an apple application, cause look the error on that site and look at this from your post and tell me its not exactly the same:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

now i read it, its not exactly same, but the codes are...

its possible they misidentified the cause. I don't like editing registry so you can wait and see if anyone else has a better idea

 

[Colif]

Here be a different answer from Microsoft: https://social.technet.microsoft.com/Forums/windows/en-US/7742f039-70af-49b5-b37e-9597da743971/event-id-10016-the-applicationspecific-permission-settings-do-not-grant-local-activation?forum=win10itprogeneral

 

[Iketsu31425]

I'm not even fully sure that that specific error has anything to do with this issue. Could just be something small, I don't really remember seeing that one every time I've had a crash problem. But I'm pretty certain I have seen the Error 243 from win32k nearly every time.

 

[Colif]

it may not, I was just using what you gave me.

it seems it comes back to where we started...

Cause

This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

Microsoft

 

[Iketsu31425]

The good news is, even though the right click error occurred again, the blue screen did not accompany it this time. So the bluescreen might have been fixed by the GPU Driver wipe down. But the underlying issue still remains.

 

[Colif]

whatever it is, its killing all your background applications off

try this: http://windows.microsoft.com/en-us/windows-10/run-the-troubleshooter-for-windows-apps

fun fact, these errors don't occur in win 10 unless you upgraded. Fresh install, no dcom errors... wow, MS help suggest you do a full install to fix them.

event id 10016 matches dcom errors.. your description doesn't mention them but I find it where ever I look on google.

 

[Iketsu31425]

Checking event viewer it seems that the computer was good for about 5 hours before this event popped up again.

The description for Event ID 243 from source Win32k cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:


The specified resource type cannot be found in the image file

This corresponds with the problem as I can no longer open taskbar icons, right click, etc. So now I'm pretty much 100% sure they're related.

Update: Ran that troubleshooter and it found no errors.

 

[Colif]

i don't think component is corrupt or sfc/dism would have reported it and fixed it. Its something else doing this. It could be a corrupt driver.

there is the driver verifier but I am not sure how it works: http://www.tenforums.com/tutorials/5470-driver-verifier-enable-disable-windows-10-a.html

it might find your cause

 

[Iketsu31425]

I read something about desktop heap allocation size being an issue. It's apparently something that one can change in the registry. Could it be as simple as my system is not allocating enough memory to that specific area?

 

[Colif]

have you got a custom size for your page file or just let windows set its own?

its strange you are running out of resources. those events you posted earlier with things closed unexpectedly could be system closing them to get space. I assume you don't have high ram usage? you might want to see whats using most resources in the Resource monitor

 

[Iketsu31425]

I don't have a custom size, I just let Windows set its own. As far as resource monitor goes, I don't have a very high memory usage. About 29% which is to be expected with some of the apps I run in the background (game clients, skype, etc.)

I have 12GB of system memory, so I never thought I'd run into an issue with it. But it might have something to do with the amount allocated to the desktop heap?

 

[Colif]

i don't know enough about the desktop heap to know whats going on here.

in all likelihood the easiest way to fix this is a clean install of win 10. As i said before, these errors are relics of your previous install. They shouldn't happen on win 10 once no remains of 8.1 exist.

I will leave that to you as maybe someone else has a better idea of what is going on and can fix this for you. I have to go soon as its 3.20am here. I will look at thread when I wake up.

 

[Iketsu31425]

Just wanted to give a quick update. I got the win32kfull.sys bluescreen again just now. So I don't think the GPU driver installation fixed the issue.

I'm at a loss, but I thank you for trying your best to help me out. Please if anybody else knows anything about this error, don't hesitate to reply.

 

[Colif]

I sent you a pm