Blue Screen of Death

mastermind12343 · 05 Nov 2010

I have a dell latitude e6510, it came with windows vista 32 bit. I upgraded the ram to 8 gigs(from 2 gigs) and updated to windows 7 64 bit home premium that i bought via MS student discount store online.

Attached are all the files that the posting rules require. Also, here is what the popup screen read when i restarted the computer after the crash:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.256.48
Locale ID: 1033

Additional information about the problem:
BCCode: 7f
BCP1: 0000000000000008
BCP2: 0000000080050031
BCP3: 00000000000006F8
BCP4: FFFFF88010D97033
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

wish · 05 Nov 2010

Hi,
Two of your dumps point to PCTCore64.sys as the cause. It related to PC Tools software and better to uninstall it.

For troubleshooting purpose, remove Avast and replace it with MSE.
http://www.microsoft.com/security_essentials/

Then update these drivers:

Code:

wacommousefilter.sys Fri Feb 16 10:12:17 2007 --> Wacom(tablet) Mouse Filter
adfs.SYS     Thu Jun 26 13:52:37 2008 --> Adobe software
 e1k62x64.sys Thu Nov 05 17:36:23 2009 --> Intel Ethernet
 iaStorV.sys  Wed Apr 08 09:57:17 2009  --> Intel raid storage
 hamachi.sys  Thu Feb 19 02:36:41 2009 -->  LogMeIn Hamachi Virtual Network interface driver

Log

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a002f04000, 0, fffff8000328bb1e, 0}

Unable to load image \SystemRoot\system32\drivers\PCTCore64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PCTCore64.sys
*** ERROR: Module load completed but symbols could not be loaded for PCTCore64.sys

Could not read faulting driver name
Probably caused by : PCTCore64.sys ( PCTCore64+2dc10 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a002f04000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8000328bb1e, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fd0e0
 fffff8a002f04000 

FAULTING_IP: 
nt!RtlpUpcaseUnicodeStringPrivate+66
fffff800`0328bb1e 420fb70c48      movzx   ecx,word ptr [rax+r9*2]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88001f8c4b0 -- (.trap 0xfffff88001f8c4b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a002f01f30 rbx=0000000000000000 rcx=0000000000000000
rdx=000000000000e000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000328bb1e rsp=fffff88001f8c640 rbp=fffff88001f8cb40
 r8=0000000000004c00  r9=0000000000001068 r10=fffff98000020654
r11=0000000000000332 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
nt!RtlpUpcaseUnicodeStringPrivate+0x66:
fffff800`0328bb1e 420fb70c48      movzx   ecx,word ptr [rax+r9*2] ds:4220:fffff8a0`02f04000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003345f14 to fffff800032c5740

STACK_TEXT:  
fffff880`01f8c348 fffff800`03345f14 : 00000000`00000050 fffff8a0`02f04000 00000000`00000000 fffff880`01f8c4b0 : nt!KeBugCheckEx
fffff880`01f8c350 fffff800`032c382e : 00000000`00000000 fffff8a0`02f01f20 fffffa80`09e31c00 00000000`00000801 : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`01f8c4b0 fffff800`0328bb1e : 00000000`00000000 fffff8a0`02f01f20 00000000`00000004 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`01f8c640 fffff800`0330bf49 : fffff880`01f8c6a0 fffff880`01f8c9d0 fffff880`01f8c901 fffff880`01389630 : nt!RtlpUpcaseUnicodeStringPrivate+0x66
fffff880`01f8c680 fffff880`01398c10 : fffff880`01f8c9d0 fffff880`01f8c7f8 fffff880`01f8cb40 fffff880`01f8c7f8 : nt!RtlIsNameInExpression+0x59
fffff880`01f8c6c0 fffff880`01f8c9d0 : fffff880`01f8c7f8 fffff880`01f8cb40 fffff880`01f8c7f8 fffff880`03107101 : PCTCore64+0x2dc10
fffff880`01f8c6c8 fffff880`01f8c7f8 : fffff880`01f8cb40 fffff880`01f8c7f8 fffff880`03107101 fffffa80`06a221a0 : 0xfffff880`01f8c9d0
fffff880`01f8c6d0 fffff880`01f8cb40 : fffff880`01f8c7f8 fffff880`03107101 fffffa80`06a221a0 fffffa80`06a221a0 : 0xfffff880`01f8c7f8
fffff880`01f8c6d8 fffff880`01f8c7f8 : fffff880`03107101 fffffa80`06a221a0 fffffa80`06a221a0 00000021`16637e24 : 0xfffff880`01f8cb40
fffff880`01f8c6e0 fffff880`03107101 : fffffa80`06a221a0 fffffa80`06a221a0 00000021`16637e24 00000000`00000000 : 0xfffff880`01f8c7f8
fffff880`01f8c6e8 fffffa80`06a221a0 : fffffa80`06a221a0 00000021`16637e24 00000000`00000000 00000000`00000001 : 0xfffff880`03107101
fffff880`01f8c6f0 fffffa80`06a221a0 : 00000021`16637e24 00000000`00000000 00000000`00000001 00000000`00000000 : 0xfffffa80`06a221a0
fffff880`01f8c6f8 00000021`16637e24 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : 0xfffffa80`06a221a0
fffff880`01f8c700 00000000`00000000 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : 0x21`16637e24


STACK_COMMAND:  kb

FOLLOWUP_IP: 
PCTCore64+2dc10
fffff880`01398c10 ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  PCTCore64+2dc10

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: PCTCore64

IMAGE_NAME:  PCTCore64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bafde56

FAILURE_BUCKET_ID:  X64_0x50_PCTCore64+2dc10

BUCKET_ID:  X64_0x50_PCTCore64+2dc10

Followup: MachineOwner
---------

reventon · 05 Nov 2010

wish said:

Two of your dumps point to PCTCore64.sys as the cause. It related to PC Tools software and better to uninstall it.

Just to expand a bit on that, that driver is usually part of PC Tools firewall which I have seen cause these kinds of BSODs before.

Use Revo Uninstaller to remove it - Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

mastermind12343 · 05 Nov 2010

I don't have PC tools installed on my computer. Is this something that comes standard or something? Also, how do i uninstall it with revo, it doesn't show up in the list of installed applications

CarlTR6 · 05 Nov 2010

I find this on your system:

PCTools KDS Kernel Boot Running OK TRUE FALSE 86,016 102,400 0 3/28/2010 5:55:18 PM C:\Windows\system32\drivers\PCTCore64.sys 16,384

Do you have Spyware Doctor installed? It is PCTools software.

PC Tools Auxiliary Service sdAuxService Stopped Manual Own Process c:\program files (x86)\spyware doctor\pctsauxs.exe Normal LocalSystem
PC Tools Security Service sdCoreService Stopped Manual Own Process c:\program files (x86)\spyware doctor\pctssvc.exe Normal LocalSystem

Use Revo to uninstall it. What firewall are you running? I agree with reventon. One of your dumps has an error code of 7F. This error code is many times associated with a third party firewall.

Follow Wish's spot on advice regarding the drivers. Out of date drivers can and do cause conflicts, memory corruptions and BSOD's. A couple of those drivers are really obsolete.