Blue Screen (Stop 0x50) after applying update KB2982791 to Windows 7 Home Premium 64 bit

Question

Yesterday I ran all the updates of the August patch day. Installation went smoothly. After rebooting everything worked fine. But when I shut down my notebook and switched it on a little later it came up with a blue screen with a Stop 0x50 in Win32k.sys. I could not even boot into safe mode as Windows failed to start no matter which mode chose.

So I restored from a backup, installed the updates again and... same effect. After restoring again I went through the updates and found update KB2982791 which relates to Win32k.sys and fonts. I also found this KB article (Stop error 0x50 in Win32k.sys) which says that a Stop 0x50 occurs because Win32k.sys crashes when the font cache is not correctly maintained. Quite a bizarre behaviour to crash the whole operating system because a cache seems to be invalid. A decent programmer would have just cleared the cache and continued.

Since security update KB2982791 relates to fonts, as well, I guess that MS has once again messed up an update.

From my experience with MS "support" I know that MS does not care about bug reports. So I just post this to inform people which may have been bitten by this bug. If possible, restore your OS or boot from CD and uninstall update KB2982791. Then things should work again. Oh, and after that switch off automatic updating...

Regards,

Frank

Answer 1

I can confirm that removing fntcache.dat fixed the issue.

My dad had this issue on his win7 x64 PC after the update that he received on 15-08-2014.

Checking the update history, He only received KB2982791, not the other mentioned suspects.

Removal of fntcache.dat via command prompt via de recovery disk solved the problem.

For anyone having issues removing the file with commandprompt, here is my quick guide:

1. Insert the recovery disk/windows installation disk.
2. Boot from disk by pressing F12 or whatever key is shown when your PC turns on that says "BOOT MENU" or something alike.
3. Select CD/Disk Drive
4. Let the windows files load, select a language and then select the restore option on the bottom.
5. Then select the top option to get a list of all the repair tools.
6. Click on command prompt on the bottom.
7. You'll see a letter, for example X:. This is your windows CD. We need to get to the windows installation on your hard drive, but even though this might have been C: when your PC was still working, it could very well be another letter now, so to try this out, first type:

wmic logicaldisk get name

to get a list of all your drives. Then access every disk you see in that list by typing:

cd /d A:

cd /d B:

cd /d C: 

and so on, each time checking what's on the drive by typing dir.

If you see a list that contains folders like "Windows" and "Program Files", you're most likely on your harddrive that contains your windows installation.

8. Now go to the system32 folder by typing:

cd windows

cd system32

9. Now check if the fntcache.dat file exists, by typing:

if exist fntcache.dat ( echo yes ) else ( echo no )

10. If you see "yes" below that line, this means that the file exists, and your problems will most likely be fixed very soon.
11. Type the following command to remove the file:

del fntcache.dat

12. Press <arrow up> twice, to repeat the "if exist fntcache..." command. This should now output "no".
13. If that's the case, reboot your computer and keep your fingers crossed. This worked for me :-)! Good luck. If it still doesn't work, I suggest you follow the steps to remove the entire faulty windows update by following the instructions elsewhere in this topic, that I'll also post below (my own version, for your convenience):
14. Once you know the letter of your windows drive (see my tutorial above), type the following command (replace C: with the letter of your drive that contains your windows installation):

dism /image:C:\ /get-packages

2. Search the results for the faulty security update KB2982791, and just to be sure, find KB2976897 and KB2970228 as well.
3. Write down the exact package names, and remove them with the following commands (replace drive letter again to fit your system, and replace the package names with how they're named on your system):

dism /image:C:\ /remove-package/PackageName:Package_for_KB2970228~31bf3856ad364e35~amd64~~6.1.1.2

dism /image:C:\ /remove-package/PackageName:Package_for_KB2982791~31bf3856ad364e35~amd64~~6.1.1.1

dism /image:C:\ /remove-package/PackageName:Package_for_KB2976897~31bf3856ad364e35~amd64~~6.1.1.0

4. You'll receive messages that state that the uninstallations were successfull.
5. Restart the computer into normal mode.

Answer 2

Hello,

I had the same problem on two computers, both win7 64bits.

I could solve it by booting from a DVD and removing the following file:

c:\Windows\System32\FNTCACHE.DAT

For sake of completeness, I first removed the files

c:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

c:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

But that didn't solve the problem. Then I removed the file I mentioned first. So, in the end all 3 files were removed, but I guess the first one is the culprit.

[Susan moderator here, I'm marking this ONLY as an answer so that it shows up at the top.  This is a workaround - NOT a real answer. We still don't understand why this is happening and what the root cause is.]

Answer 3

when i try to run the command: 

dism /image:C:\ /remove-package/PackageName:Package_for_KB2970228~31bf3856ad364e35~amd64~~6.1.1.2

It saids that windows is running and suggest me to use /online ...

I have attach as an external drive the hard drive with the windows 7 x64 with the issue

How can i run the command to remove the upgrades as an external drive with the command dism /online????

i found it googling:

C:\WINDOWS\system32>dism /online /remove-package/packagename:

C->Is the letter of the drive

Package_for_KB2919355~31bf3856ad364e35~amd64~~6.3.1.14 -> is the name of the package

Answer 4

On August 27, 2014, Microsoft revised security bulletin MS14-045 - Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege - to address known issues associated with installation of security update 2982791.

==================================
SUMMARY
==================================
To address known issues with security update 2982791, Microsoft rereleased MS14-045  to replace the 2982791 update with the 2993651 update for all supported releases of Microsoft Windows. Microsoft expired the original update 2982791 on August 15, 2014.

All customers should apply the 2993651 update, which replaces the expired 2982791 update. 

For more information about the known issues with the original 2982791 update, see the Known Issues section of Microsoft Knowledge Base Article 2982791.

==================================
ANSWERS TO FREQUENTLY ASKED QUESTIONS
==================================
Q: I already successfully installed the original 2982791 security update and am not experiencing any difficulties. Should I apply the replacement update 2993651, released on August 27, 2014? 

A: Yes. All customers should apply the 2993651 update, which replaces the expired 2982791 update. 

Q: Is it necessary to uninstall the expired 2982791 update before applying the replacement 2993651 update?

A: Technically, it is not necessary to uninstall the expired 2982791 update before applying the replacement 2993651 update; however, Microsoft strongly recommends it. Customers who do not remove the expired 2982791 update at some point will retain a listing for 2982791 under installed updates in Control Panel.

Q: I uninstalled the original 2982791 security update. Should I apply the replacement update 2993651, released on August 27, 2014? 

A: Yes. To be protected from CVE-2014-0318 and CVE-2014-1819, all customers should apply the rereleased update (2993651), which replaces the expired 2982791 update.

Q: What if I experienced difficulties restarting my system after installing the original security update 2982791? 

A: Customers who experienced difficulties restarting their systems after installing the original security update 2982791 should no longer experience this problem after installing the replacement update 2993651. 

==================================
ADDITIONAL INFORMATION
==================================
➢ Microsoft Security Bulletin MS14-045 - Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege - https://technet.microsoft.com/library/security/ms14-045 

➢ Microsoft KB Article 2993651 - MS14-045: Description of the security update for kernel-mode drivers: August 27, 2014 - http://support.microsoft.com/kb/2993651  

➢ Microsoft KB Article 2982791 - MS14-045: Description of the security update for kernel-mode drivers: August 12, 2014 - http://support.microsoft.com/kb/2982791

Answer 5

Yea, well I care.  Let's get an official support case opened up so that they can care.

email me at susan-at-msmvps.com (change the -at- to @) and I'll need a phone number to set up a call back from an engineer at Microsoft.