BSOD and PCTGNTDI64.SYS

[gweglarz]

* Ran memtest86 for 24 hours - all OK.
* Ran Prime 95 for 24 hours for 24 hours - all OK
* Took out ram and blew compressed air into slots and blew dust off of on all internal components. Reseated Ram

Boot up this mporning and got an error with PCTGNTDI64.SYS. Rebooted and got a BSOD with no driver identified.

I had the pagefiles.sys size set to zero as recommended somewhere else on this forum

Any help would be appreciated.


Thanks,

Geoffrey

 

[Lemur]

Please follow these directions:
http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

 

[Tews]

Your .dmp file shows pctgntd184.sys (part of the PCTools suite) as the cause of your crash.. The product must be removed from your system.

Use Revo --> http://www.revouninstaller.com/revo_..._download.html

After installation, RIGHT-click on Revo icon, select "Run as Administrator".

Upon removal of PC Tools firewall, re-boot. Reset Windows Firewall.

Microsoft Security Essentials --> http://www.microsoft.com/Security_Essentials/

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8800464de7c, fffff8800875b670, 0}

Unable to load image pctgntdi64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for pctgntdi64.sys
*** ERROR: Module load completed but symbols could not be loaded for pctgntdi64.sys
Probably caused by : pctgntdi64.sys ( pctgntdi64+1e7c )

Followup: MachineOwner
---------

 

[gweglarz]

Thanks, here are the latest dump files

Thanks, I'll try that here are the latest dump files with no driver mentioned.

Geoffrey

 

[cluberti]

Well, actually the dump file does pinpoint a driver - the same one as before:

3: kd> !thread
GetPointerFromAddress: unable to read from fffff800030c6000
THREAD fffffa8006c00060  Cid 0568.0578  Teb: 000007fffffd8000 Win32Thread: fffff900c0873010 RUNNING on processor 3
IRP List:
    Unable to read nt!_IRP @ fffffa8004049e10
Not impersonating
GetUlongFromAddress: unable to read from fffff80003004b74
Owning Process            fffffa8006a0d740       Image:         svchost.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      25686        
Context Switch Count      1495                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x0000000077428e70
Stack Init fffff8800875cdb0 Current fffff8800875c7d0
Base fffff8800875d000 Limit fffff88008752000 Call 0
Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0875ada8 fffff800`02e8dca9 : 00000000`0000003b 00000000`c0000005 fffff880`0464de7c fffff880`0875b670 : nt!KeBugCheckEx
fffff880`0875adb0 fffff800`02e8d5fc : fffff880`0875be08 fffff880`0875b670 00000000`00000000 fffff800`02ebcc90 : nt!KiBugCheckDispatch+0x69
fffff880`0875aef0 fffff800`02eb440d : fffff800`030b2158 fffff800`02fd7a94 fffff800`02e1e000 fffff880`0875be08 : nt!KiSystemServiceHandler+0x7c
fffff880`0875af30 fffff800`02ebba90 : fffff800`02fde1a0 fffff880`0875afa8 fffff880`0875be08 fffff800`02e1e000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0875af60 fffff800`02ec89ef : fffff880`0875be08 fffff880`0875b670 fffff880`00000000 fffffa80`0400ad70 : nt!RtlDispatchException+0x410
fffff880`0875b640 fffff800`02e8dd82 : fffff880`0875be08 00000000`00000011 fffff880`0875beb0 fffff880`04693040 : nt!KiDispatchException+0x16f
fffff880`0875bcd0 fffff800`02e8c68a : 00000000`000007ff 00000000`00000150 fffffa80`087f23c0 00000000`00000001 : nt!KiExceptionDispatch+0xc2
fffff880`0875beb0 fffff880`0464de7c : fffffa80`04bb8000 fffffa80`06251b10 fffffa80`04b0f8c0 fffffa80`087f22e0 : nt!KiGeneralProtectionFault+0x10a (TrapFrame @ fffff880`0875beb0)
fffff880`0875c040 fffffa80`04bb8000 : fffffa80`06251b10 fffffa80`04b0f8c0 fffffa80`087f22e0 fffffa80`0400ad70 : pctgntdi64+0x1e7c
fffff880`0875c048 fffffa80`06251b10 : fffffa80`04b0f8c0 fffffa80`087f22e0 fffffa80`0400ad70 fffff880`0464e17a : 0xfffffa80`04bb8000
fffff880`0875c050 fffffa80`04b0f8c0 : fffffa80`087f22e0 fffffa80`0400ad70 fffff880`0464e17a fffff880`04693040 : 0xfffffa80`06251b10
fffff880`0875c058 fffffa80`087f22e0 : fffffa80`0400ad70 fffff880`0464e17a fffff880`04693040 fffffa80`058f1470 : 0xfffffa80`04b0f8c0
fffff880`0875c060 fffffa80`0400ad70 : fffff880`0464e17a fffff880`04693040 fffffa80`058f1470 fffffa80`0400ad70 : 0xfffffa80`087f22e0
fffff880`0875c068 fffff880`0464e17a : fffff880`04693040 fffffa80`058f1470 fffffa80`0400ad70 00000000`00000011 : 0xfffffa80`0400ad70
fffff880`0875c070 fffff880`04693040 : fffffa80`058f1470 fffffa80`0400ad70 00000000`00000011 001f01ff`00000000 : pctgntdi64+0x217a
fffff880`0875c078 fffffa80`058f1470 : fffffa80`0400ad70 00000000`00000011 001f01ff`00000000 00000000`00000000 : pctgntdi64+0x47040
fffff880`0875c080 fffffa80`0400ad70 : 00000000`00000011 001f01ff`00000000 00000000`00000000 fffffa80`06c00060 : 0xfffffa80`058f1470
fffff880`0875c088 00000000`00000011 : 001f01ff`00000000 00000000`00000000 fffffa80`06c00060 fffffa80`0437d070 : 0xfffffa80`0400ad70
fffff880`0875c090 001f01ff`00000000 : 00000000`00000000 fffffa80`06c00060 fffffa80`0437d070 fffffa80`087f22e0 : 0x11
fffff880`0875c098 00000000`00000000 : fffffa80`06c00060 fffffa80`0437d070 fffffa80`087f22e0 fffff880`04691a18 : 0x1f01ff`00000000
 
3: kd> lmvim pctgntdi64
start             end                 module name
fffff880`0464c000 fffff880`0469c000   pctgntdi64 T (no symbols)           
    Symbol file: pctgntdi64.sys
    Image path: pctgntdi64.sys
    Image name: pctgntdi64.sys
    Timestamp:        Thu Feb 04 13:46:08 2010 (4B6B15F0)
    CheckSum:         0004C70B
    ImageSize:        00050000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[gweglarz]

PcTools

I have the PCTopols Spyware Doctor with anti virus. I can't just uninstall the firewall. Can i just remove the reference to the driver in the registry? Or do I have to uninstall the whole program and find another anti-virus program?

Geoffrey

 

[Tews]

You can do what ever you wish, however both .dmp files are pretty conclusive... PCtools is causing your problems.. You can keep the program, and continue with your problems, or you can uninstall it and see if your problem continues.. I recommend that you uninstall it and replace it with Microsoft Security Essentials.. It is an excellent anti-virus and its free..

MSE Download