none
Frequent BSods, cannot access minidump files

    Question

  • I recently upgraded my Dell XPS M1530 laptop from Vista 32-bit to Windows 7 64-bit. It worked well for the first few days, but now I'm getting BSoDs left and right. Every time the BSoD has appeared, its only been up for maybe 3 seconds before it goes blank. I believe the error message I have been getting most often has been the "Kernel Data Inpage Error", but the screen usually comes up and disappears so quickly that I do not have enough time to copy down the error message or error number. I would upload my minidump, but for some reason I am being denied access. I have admin privileges and am on the only user account for this computer, so I am unsure of why this is happening as well. 

    Any suggestions on how to correct these issues? I realize I haven't provided that much info, but if anyone can let me know what I need to provide, I can certainly post that as well.
    Tuesday, January 12, 2010 4:21 AM

Answers

  • Hi Abeeline,

     

    Would you please upload more minidump files for our further analyzing?


    In addition, I would like to suggest you check if the PCTCore64.sys still exist in
    %SystemRoot%\System32\drivers folder? If so, remove it to check the issue.

     

    Regards,

     

     


    Arthur Li - MSFT
    Friday, January 15, 2010 4:44 AM
    Moderator
  • Consider running a chkdsk /r on the hard drive.

    Running a chkdsk /r has the potential to take a long time and, as a general precaution, back up any critical files beforehand.

    BTW, here is some general info on your error:

    http://technet.microsoft.com/en-us/library/cc957628.aspx


    Friday, January 15, 2010 4:44 AM
  • Hi,

    I agree with auggy .

    I would guess that any swap operation leads to this problem.
    Or due to bad CPU conditions(dust/heat).






    Loading Dump File [010910-16785-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    [---]

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 7A, {fffff6fc4001c348, ffffffffc0000185, 839abbe0, fffff88003869000}

    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+34cde )

    Followup: MachineOwner
    ---------

    0: kd> !thread
    GetPointerFromAddress: unable to read from fffff80002b0f000
    THREAD fffffa8003705040  Cid 0004.0068  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0
    Not impersonating
    GetUlongFromAddress: unable to read from fffff80002a4db74
    Owning Process            0       Image:         <Unknown>
    Attached Process          fffffa80036e6040       Image:         System
    fffff78000000000: Unable to get shared data
    Wait Start TickCount      4104439     
    Context Switch Count      44087            
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
    UserTime                  00:00:00.000
    KernelTime                00:00:00.000
    Win32 Start Address nt!KeSwapProcessOrStack (0xfffff800028cd5e8 )
    Stack Init fffff88003140db0 Current fffff880031405a0
    Base fffff88003141000 Limit fffff8800313b000 Call 0
    Priority 23 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5

    [---]

    0: kd> u 0xfffff800028cd5e8
    nt!KeSwap ProcessOrStack:
    fffff800`028cd5e8 fff3            push    rbx
    fffff800`028cd5ea 4883ec30        sub     rsp,30h
    fffff800`028cd5ee 65488b0c2588010000 mov   rcx,qword ptr gs:[188h]
    fffff800`028cd5f7 ba17000000      mov     edx,17h
    fffff800`028cd5fc e8a7fdffff      call    nt!KeSetPriorityThread (fffff800`028cd3a8)
    fffff800`028cd601 33db            xor     ebx,ebx
    fffff800`028cd603 488d0db6a42000  lea     rcx,[nt!KiSwapEvent (fffff800`02ad7ac0)]
    fffff800`028cd60a 4533c9          xor     r9d,r9d



    Loading Dump File [011110-17238-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    [---]

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C2, {7, 1097, 5040103, fffff8a001dcbf10}

    Unable to load image \SystemRoot\system32\drivers\PCTCore64.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for PCTCore64.sys
    *** ERROR: Module load completed but symbols could not be loaded for PCTCore64.sys
    GetPointerFromAddress: unable to read from fffff80002af40e0
    Probably caused by : PCTCore64.sys ( PCTCore64+209d9 )

    Followup: MachineOwner
    ---------

    0: kd> !thread
    GetPointerFromAddress: unable to read from fffff80002af4000
    THREAD fffffa800472d760  Cid 0004.0484  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0
    Not impersonating
    GetUlongFromAddress: unable to read from fffff80002a32b74
    Owning Process            0       Image:         <Unknown>
    Attached Process          fffffa80036cc040       Image:         System
    fffff78000000000: Unable to get shared data
    Wait Start TickCount      4248        
    Context Switch Count      3488            
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
    UserTime                  00:00:00.000
    KernelTime                00:00:00.000
    Win32 Start Address PCTCore64 (0xfffff8800117bddc )
    Stack Init fffff880055d7db0 Current fffff88007e62540
    Base fffff880055d8000 Limit fffff880055d2000 Call 0
    Priority 16 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5

    [---]

    0: kd> u 0xfffff8800117bddc
    PCTCore64+0x25ddc:
    fffff880`0117bddc ??              ???
                              ^ Memory access error in 'u 0xfffff8800117bddc'



    I hope more dumps could help us with further analysis.

    Best


    Friday, January 15, 2010 12:50 PM

All replies

  • Hi,

     

    Since Windows Vista 32-bit cannot upgrade to Windows 7 64-bit, I would like to confirm that did you perform a Clean Install for Windows 7 64-bit?

     

    I would like to suggest you reset the virtual memory first to check the issue.

     

    1.Open System by clicking the Start button, right-clicking Computer, and then clicking Properties.

    2.In the left pane, click Advanced system settings. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

    3.On the Advanced tab, under Performance, click Settings.

    4.Click the Advanced tab, and then, under Virtual memory, click Change.

    5.Clear the Automatically manage paging file size for all drives check box and restart the computer.

    6.Restart the computer and repeat the above steps, then check the Automatically manage paging file size for all drives check box.

    7.Restart the computer again to check the result.

     

    If the issue persists, please take the ownership and modify the permission of %SystemRoot%\Minidump folder to full control for your administrator account. Then upload the minidump files for further analyzing.

     

    Regards,


    Arthur Li - MSFT
    Wednesday, January 13, 2010 4:27 AM
    Moderator
  • I reset the virtual memory, but I am still having the same issues.

    I uploaded the minidump files to my Skydrive, located here: http://cid-28af888c96db5853.skydrive.live.com/browse.aspx/minidump
    Thursday, January 14, 2010 3:26 AM
  • One of the minidump files showed that the PCTCore64.sys caused the crash.

    The PCTCore64.sys appears to be a PC Tools driver.

    Can you uninstall PC Tools and see if the BSODs resolve?
    Thursday, January 14, 2010 5:56 AM
  • Auggy,

    I removed the PC Tools driver a few days ago and I am still having the BSODS. Any other suggestions?

    Thanks!
    Thursday, January 14, 2010 5:29 PM
  • Hi Abeeline,

     

    Would you please upload more minidump files for our further analyzing?


    In addition, I would like to suggest you check if the PCTCore64.sys still exist in
    %SystemRoot%\System32\drivers folder? If so, remove it to check the issue.

     

    Regards,

     

     


    Arthur Li - MSFT
    Friday, January 15, 2010 4:44 AM
    Moderator
  • Consider running a chkdsk /r on the hard drive.

    Running a chkdsk /r has the potential to take a long time and, as a general precaution, back up any critical files beforehand.

    BTW, here is some general info on your error:

    http://technet.microsoft.com/en-us/library/cc957628.aspx


    Friday, January 15, 2010 4:44 AM
  • Hi,

    I agree with auggy .

    I would guess that any swap operation leads to this problem.
    Or due to bad CPU conditions(dust/heat).






    Loading Dump File [010910-16785-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    [---]

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 7A, {fffff6fc4001c348, ffffffffc0000185, 839abbe0, fffff88003869000}

    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+34cde )

    Followup: MachineOwner
    ---------

    0: kd> !thread
    GetPointerFromAddress: unable to read from fffff80002b0f000
    THREAD fffffa8003705040  Cid 0004.0068  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0
    Not impersonating
    GetUlongFromAddress: unable to read from fffff80002a4db74
    Owning Process            0       Image:         <Unknown>
    Attached Process          fffffa80036e6040       Image:         System
    fffff78000000000: Unable to get shared data
    Wait Start TickCount      4104439     
    Context Switch Count      44087            
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
    UserTime                  00:00:00.000
    KernelTime                00:00:00.000
    Win32 Start Address nt!KeSwapProcessOrStack (0xfffff800028cd5e8 )
    Stack Init fffff88003140db0 Current fffff880031405a0
    Base fffff88003141000 Limit fffff8800313b000 Call 0
    Priority 23 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5

    [---]

    0: kd> u 0xfffff800028cd5e8
    nt!KeSwap ProcessOrStack:
    fffff800`028cd5e8 fff3            push    rbx
    fffff800`028cd5ea 4883ec30        sub     rsp,30h
    fffff800`028cd5ee 65488b0c2588010000 mov   rcx,qword ptr gs:[188h]
    fffff800`028cd5f7 ba17000000      mov     edx,17h
    fffff800`028cd5fc e8a7fdffff      call    nt!KeSetPriorityThread (fffff800`028cd3a8)
    fffff800`028cd601 33db            xor     ebx,ebx
    fffff800`028cd603 488d0db6a42000  lea     rcx,[nt!KiSwapEvent (fffff800`02ad7ac0)]
    fffff800`028cd60a 4533c9          xor     r9d,r9d



    Loading Dump File [011110-17238-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    [---]

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C2, {7, 1097, 5040103, fffff8a001dcbf10}

    Unable to load image \SystemRoot\system32\drivers\PCTCore64.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for PCTCore64.sys
    *** ERROR: Module load completed but symbols could not be loaded for PCTCore64.sys
    GetPointerFromAddress: unable to read from fffff80002af40e0
    Probably caused by : PCTCore64.sys ( PCTCore64+209d9 )

    Followup: MachineOwner
    ---------

    0: kd> !thread
    GetPointerFromAddress: unable to read from fffff80002af4000
    THREAD fffffa800472d760  Cid 0004.0484  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0
    Not impersonating
    GetUlongFromAddress: unable to read from fffff80002a32b74
    Owning Process            0       Image:         <Unknown>
    Attached Process          fffffa80036cc040       Image:         System
    fffff78000000000: Unable to get shared data
    Wait Start TickCount      4248        
    Context Switch Count      3488            
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
    UserTime                  00:00:00.000
    KernelTime                00:00:00.000
    Win32 Start Address PCTCore64 (0xfffff8800117bddc )
    Stack Init fffff880055d7db0 Current fffff88007e62540
    Base fffff880055d8000 Limit fffff880055d2000 Call 0
    Priority 16 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5

    [---]

    0: kd> u 0xfffff8800117bddc
    PCTCore64+0x25ddc:
    fffff880`0117bddc ??              ???
                              ^ Memory access error in 'u 0xfffff8800117bddc'



    I hope more dumps could help us with further analysis.

    Best


    Friday, January 15, 2010 12:50 PM