Physical Memory Dump in Windows 7

[evad991]

I bought my computer a little over a year ago, an HP Pavillion 6313w, at Wal-Mart. Up until the past week, I started receiving an error when completing a full scan using the Mcafee program that came with Verizon Internet Security Suite about dumping physical memory. A blue screen comes on, it completes the memory dump, and then restarts my computer. It'll ask how I want to start Windows and I'll check normally. It restarts and everything's fine again. No files are lost or anything. I just notice this whenever I complete a full anti-virus scan. I contacted Verizon via Live Chat and was told that my system is corrupt and would need to contact my system vendor. My computer is now out of warranty as of this past March. Is there any way to fix this problem without going through too much trouble or too much expense? One thing I have not done is back up my files and it shows one important message at the bottom. I'm not sure if this is related to a hardware problem. I did recently have some Windows updates completed. I complete a system restore back to about a month ago, but this did not resolve the issue. Any help would be much appreciated.

[smith6612]

Download this program and run it (you may need to give it Administrator Priveledges. Do so if UAC pops up): http://www.nirsoft.net/utils/bluescreenview.zip

From there, tell us what the Bug Check String is on the most recent crash dump file it sees. Additionally, if you look towards the bottom of the window, you will see a file or even a few files highlighted as Red. These are the files that were seen causing the crash. Tell us the name of the files that are causing the problem.

[evad991]

Most recent crash dump:

052911-17893-01.dmp 5/29/2011 12:50:35 PM KERNEL_DATA_INPAGE_ERROR 0x0000007a fffff6fb`800083f8 ffffffff`c000009c 00000000`6618f880 fffff700`0107fff8 ntoskrnl.exe ntoskrnl.exe+70700 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16792 (win7_gdr.110408-1633) x64 ntoskrnl.exe+70700     C:\Windows\Minidump\052911-17893-01.dmp 2 15 7600 293,312 

Second most recent crash dump:

052111-17487-01.dmp 5/21/2011 3:57:48 PM KERNEL_DATA_INPAGE_ERROR 0x0000007a fffff6fc`5001d018 ffffffff`c000009c 00000000`5fbec880 fffff8a0`03a03748 ntoskrnl.exe ntoskrnl.exe+70700 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16792 (win7_gdr.110408-1633) x64 ntoskrnl.exe+70700     C:\Windows\Minidump\052111-17487-01.dmp 2 15 7600 293,312 

This is highlighted in red:

ntoskrnl.exe ntoskrnl.exe+e5278 fffff800`0305b000 fffff800`03637000 0x005dc000 0x4d9fdd34 4/9/2011 12:14:44 AM Microsoft® Windows® Operating System NT Kernel & System 6.1.7600.16792 (win7_gdr.110408-1633) Microsoft Corporation C:\Windows\system32\ntoskrnl.exe 

[smith6612]

The error you're seeing is actually involving the Windows Kernel, which is basically the heart of the operating system. It isn't pointing out anything McAfee specific, so that makes troubleshooting this problem more difficult. For some reason it's going into a panic/crash whenever you attempt to run a scan. The specific error code you're receiving generally means that for whatever reason, data belonging to the Kernel could not be read from the Page File on the computer (virtual memory, stored on hard drive). Now this can be caused by hardware issues such as trouble with the hard disk (bad sector), bad RAM, or it could be caused by poorly written programs/drivers that hook into the Kernel/the Kernel's memory. Anti-virus software does tend to hook itself into the Kernel, so a bug (if this started after a McAfee update) might be causing this. I'd expect to see more postings online about this though if it were a bug.

The first thing to check over is to make sure that no other Antivirus software is installed. Probably is a silly question to ask, but I've seen a few PCs where a user or program may have installed a piece of software without the user knowing what it is. Use "Remove Programs" in the Control Panel to locate this software, and it would be made by companies such as Norton/Symantec, Avast (Alwil Software), Panda, ESET, and others.

The second item to do to rule out at least the bad disk portion of this error is to perform a chkdsk on your hard disk. Waht is suggesting this is the entry found in both BSODs, "ffffffff`c000009c" which suggests a failure to read data from the disk. Before doing this, make a backup of your files just to be on the safe side if anything does occur that results in the loss of data. Once you've backed up your files to a location such as a CD/DVD/Flash Disk or a secure online storage system, open up Command Prompt as Administrator (Start Menu > search "cmd." Right click cmd and choose Run as Administrator). Once it appears, run the following command:

chkdsk /f /r

Press Enter. You will be prompted that Windows is unable to perform a disk check and if you'd like to schedule a check for the next reboot. Press Y and schedule the disk check. Then, reboot your PC. Windows will start up differently, with the chkdsk utility starting up just before Windows loads to perform the disk check. This test will take a while to run, as not only is it going to check over your files for any issues, it will check the entire surface of the disk for bad blocks that may be causing this issue. Larger disks and slower spinning disks take longer to perform this kind of check, in addition to drives with more data on them so set aside roughly 1-2 hours to let the PC perform the check.

Once the system reboots, give it another reboot and then attempt to run a McAfee scan. If you are still getting a BSOD, re-run BlueScreenView and post up the latest BSOD you receive.

[evad991]

When I got the computer, Network Magic had a trial version on the computer that now turned into the free version. I rarely use it. Could this possibly be creating some sort of conflict? I checked and there does not seem to be any other anti-virus software installed on my computer. Thank you.

[smith6612]

Network Magic shouldn't be causing that issue, though if you rarely ever use it, you're free to remove it. It is for the most part a router and FIle Sharing Manager. As I would call it, unnecessary software.

Did you manage to run chkdsk as outlined above?

[evad991]

Sorry for not having gotten back to you sooner. I did recently follow the directions that you outlined for me and the issue has not come back after I did a full scan on McAfee. Hopefully that is what was needed to correct the problem. Thank you again for all of your help.

[smith6612]

Glad to hear. Let us know if you need any more help 🙂

[evad991]

Unfortunately, same thing is now happening again. I kept this message from before in case something should ever happen like it is now. I ran BlueScreenView and it is showing up both Ntfs.sys and ntoskrnl.exe as the problems. Here are the details:
 
Ntfs.sys Ntfs.sys+ef0cc fffff880`0123f000 fffff880`013e2000 0x001a3000 0x4d79997b 3/10/2011 11:39:39 PM      
 
ntoskrnl.exe ntoskrnl.exe+edb52 fffff800`03054000 fffff800`0363d000 0x005e9000 0x4e02aaa3 6/22/2011 10:53:23 PM Microsoft® Windows® Operating System NT Kernel & System [edited for privacy] (win7sp1_gdr.110622-1506) Microsoft Corporation C:\Windows\system32\ntoskrnl.exe 
 

Is there a way to fix these without the need to buy a new computer or spend a lot of money? Any help would be much appreciated. It seems to only do it when I'm doing a full scan with Verizon Internet Security Suite. Thanks.
 
 

[SHABBIR]

==================================================
Filename : ntkrnlpa.exe
Address In Stack : ntkrnlpa.exe+963d6
From Address : 0x83807000
To Address : 0x83c17000
Size : 0x00410000
Time Stamp : 0x4a5bc007
Time String : 14-07-2009 04:45:19
Product Name : Microsoft® Windows® Operating System
File Description : NT Kernel & System
File Version : 6.1.7600.16385 (win7_rtm.090713-1255)
Company : Microsoft Corporation
Full Path : C:\Windows\system32\ntkrnlpa.exe
==================================================