Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD Woes


  • Please log in to reply
1 reply to this topic

#1 deepseadiver

deepseadiver

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:14 AM

Posted 29 April 2009 - 07:37 AM

I have been having issues with BSOD's and thanks to the tutorial from this site I have managed to debug the .dmp file, however I have no idea what Im looking at and was hoping some kind person could help decipher it for me.

Thank you for any support you can give.

E-System 4213
Celeron 530 (1.7GHZ)
1GB Ram
SiS Hi-Def Audio
SiS Mirage 3 GFX
WinXP
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Lappy\Desktop\Mini042809-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
Debug session time: Tue Apr 28 16:50:26.437 2009 (GMT+1)
System Uptime: 0 days 0:17:53.984
Loading Kernel Symbols
...............................................................
..........................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8062c26b, f79825d4, 0}

*** WARNING: Unable to verify timestamp for PCTCore.sys
*** ERROR: Module load completed but symbols could not be loaded for PCTCore.sys
Probably caused by : PCTCore.sys ( PCTCore+174cf )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8062c26b, The address that the exception occurred at
Arg3: f79825d4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8062c26b 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: f79825d4 -- (.trap 0xfffffffff79825d4)
ErrCode = 00000000
eax=0062201e ebx=0062201e ecx=84bc31e8 edx=000003fe esi=e1035b60 edi=00000fff
eip=8062c26b esp=f7982648 ebp=f7982690 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210246
nt!HvpGetCellMapped+0x5f:
8062c26b 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00622022=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: System

LOCK_ADDRESS: 80551360 -- (!locks 80551360)

Resource @ nt!PiEngineLock (0x80551360) Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE:
Lock address : 0x80551360
Thread Count : 0
Thread address: 0x00000000
Thread wait : 0x0

LAST_CONTROL_TRANSFER: from 80622cb1 to 8062c26b

STACK_TEXT:
f7982690 80622cb1 e1035b60 ffdfffff ddb3266c nt!HvpGetCellMapped+0x5f
f79826b0 8062449b ffffffff ddb3268c f7982878 nt!CmpFindSubKeyByName+0x33
f7982884 805b34b9 00371668 00000000 8410adf0 nt!CmpParseKey+0x3d9
f798290c 805afdeb 800018ec f798294c 00000240 nt!ObpLookupObjectName+0x119
f7982960 8061a3cb 00000000 84bc0680 f7982b00 nt!ObOpenObjectByName+0xeb
f7982a34 f734c4cf f7982bb8 00020019 f7982b14 nt!NtOpenKey+0x1af
WARNING: Stack unwind information not available. Following frames may be wrong.
f7982a7c 8053ca28 f7982bb8 00020019 f7982b14 PCTCore+0x174cf
f7982a7c 804fdd9d f7982bb8 00020019 f7982b14 nt!KiFastCallEntry+0xf8
f7982b00 8057f3c5 f7982bb8 00020019 f7982b14 nt!ZwOpenKey+0x11
f7982b2c 8057c094 f7982bb8 800018ec f7982ba0 nt!IopOpenRegistryKeyEx+0x39
f7982bcc 8057d989 0000003a 8476b714 00000000 nt!IopGetDeviceInterfaces+0x41a
f7982c40 80587dc8 8476b714 e3b23ba8 00000000 nt!IopDisableDeviceInterfaces+0xf1
f7982c58 80588c46 00000308 e3b23ba8 00000000 nt!IopSurpriseRemoveLockedDeviceNode+0xb6
f7982c6c 80588cbd 8476b680 00000003 e3b23ba8 nt!IopDeleteLockedDeviceNode+0x24
f7982ca0 8058e694 840daf10 02b23ba8 00000003 nt!IopDeleteLockedDeviceNodes+0x3f
f7982d34 8058ebf0 f7982d70 806d0778 e12f8900 nt!PiProcessQueryRemoveAndEject+0x4d2
f7982d50 8058ed49 f7982d70 840a6ee8 8055a3fc nt!PiProcessTargetDeviceEvent+0x2a
f7982d74 80533fe6 840a6ee8 00000000 84bc5640 nt!PiWalkDeviceList+0xfd
f7982dac 805c4cce 840a6ee8 00000000 00000000 nt!ExpWorkerThread+0x100
f7982ddc 805411c2 80533ee6 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
PCTCore+174cf
f734c4cf ?? ???

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: PCTCore+174cf

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: PCTCore

IMAGE_NAME: PCTCore.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 49b0b742

FAILURE_BUCKET_ID: 0x8E_PCTCore+174cf

BUCKET_ID: 0x8E_PCTCore+174cf

Followup: MachineOwner
---------

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,260 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:14 PM

Posted 29 April 2009 - 08:21 AM

Hi :thumbsup:.

Background info on Suspect 1: http://www.prevx.com/filenames/X3355835610...CTCORE.SYS.html

http://www.pctools.com/

I would suggest that software by PC Tools on your system...is now damaged and causing problems. I would try uninstalling same and then reinstalling anew, as a means of removing the damaged file(s).

Note: I am not particularly noteworthy when it comes to reading these logs, either...but I try to make sense of what seems obvious :flowers:. I can be wrong.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users