Win2k3 Server random BSOD Win32k.sys


I have a 2k3 enterprise SP2 server running on a VMware ESX 3.5. Every few days I am getting a BSOD, which does not seem to be related to any specific action. Intially the dump file pointed to symevent.sys, so, I suspected Symantec AV, and removed it. Now I am still getting the BSOD, but the dump has changed, and is now pointing to Win32k.sys. See output below. This is now getting very urgent, so any help appreciated.

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [W:\WINDOWS\Minidump\Mini110408-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Nov  4 11:53:23.572 2008 (GMT+0)
System Uptime: 0 days 2:18:56.204
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {bcfb0ba0, 0, bf8b8449, 0}

Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!GdiThreadCallout+2a )

Followup: MachineOwner

Stack Trace
b855dc58 bf8b703b win32k!GdiThreadCallout+0x2a
b855dc64 bf8b7e98 win32k!bSpBltFromScreen+0x35
b855dc80 8094c2ac win32k!UnlockCaptureWindow+0x14
b855dd0c 8094c63f nt!PpInitializeNotification+0x8a
b855dd24 8094c839 nt!PiProcessQueryRemoveAndEject+0x3ce
b855dd54 8088978c nt!PiProcessQueryRemoveAndEject+0x600
b855dd64 7c8285ec nt!RtlIpv6StringToAddressExA+0x1a6
WARNING: Frame IP not in any known module. Following frames may be wrong.
b855dd78 00000000 0x7c8285ec

Thank you
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Its also referring to ntoskrnl.exe
Why not get the updated win32k.sys from SP2 (as the version on your CD may be the outdated version)
and stick it on a floppy along with ntpskrnl.
Boot to the recovery console rename the old existing files then copy the new files and see what happens

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
atitcAuthor Commented:
I can give it a try, as it is an older version of SP 2 that I downloaded some time ago.

atitcAuthor Commented:
Thanks, this pointed me in the right direction. What I ended up doing was just downloading the latest version of SP2 and re-applied it to the server. Since then the problem seems to have gone away.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.