Annoying BSODs.

Our server is shutting down from time to time - sometime the middle of the day other times at night. Here are the last few memory dumps:

Dump #1

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!NtQueryVirtualMemory+247
80582282 8b4e0c mov ecx,[esi+0xc]

TRAP_FRAME: f2e54c30 -- (.trap fffffffff2e54c30)
ErrCode = 00000000
eax=000116c0 ebx=116c0000 ecx=53646156 edx=00000001 esi=53646156 edi=1b45fea4
eip=80582282 esp=f2e54ca4 ebp=f2e54d44 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!NtQueryVirtualMemory+0x247:
80582282 8b4e0c mov ecx,[esi+0xc] ds:0023:53646162=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 804e7a8c to 80582282

STACK_TEXT:
f2e54d44 804e7a8c ffffffff 116c0000 00000000 nt!NtQueryVirtualMemory+0x247
f2e54d44 7ffe0304 ffffffff 116c0000 00000000 nt!KiSystemService+0xcb
1b45fdc4 77f42feb 77e4dedf ffffffff 116c0000 SharedUserData!SystemCallStub+0x4
WARNING: Frame IP not in any known module. Following frames may be wrong.
1b45fde8 77e4df0c ffffffff 116c0000 1b45fea4 0x77f42feb
1b45fe00 005d93df 116c0000 1b45fea4 0000001c 0x77e4df0c
1b45fedc 00505d8f 77e41a24 01015ac0 77e5a1b4 0x5d93df
1b45ff8c 004c1516 00000000 00000000 01015ac0 0x505d8f
1b45ffa8 00678f17 00000000 00000000 1b45ffec 0x4c1516
1b45ffb8 77e4a990 01015ac0 00000000 00000000 0x678f17
1b45ffec 00000000 00678ef8 01015ac0 00000000 0x77e4a990


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!NtQueryVirtualMemory+247
80582282 8b4e0c mov ecx,[esi+0xc]

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!NtQueryVirtualMemory+247

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4222691c

FAILURE_BUCKET_ID: 0x8E_nt!NtQueryVirtualMemory+247

BUCKET_ID: 0x8E_nt!NtQueryVirtualMemory+247

Followup: MachineOwner


Dump #2

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000d, type of pool violation the caller is guilty of.
Arg2: 8572eec0
Arg3: cc646641
Arg4: 84985b00

Debugging Details:
------------------


FAULTING_IP:
afd!AfdFreeEndpointResources+17d
f47a18be 895e7c mov [esi+0x7c],ebx

BUGCHECK_STR: 0xc2_d

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 805575eb to 8053f4b0

STACK_TEXT:
f78decdc 805575eb 000000c2 0000000d 8572eec0 nt!KeBugCheckEx+0x19
f78ded30 f47a18be 8572eec0 00000028 f479f748 nt!ExFreePoolWithTag+0x442
f78ded4c f47a19dd 84945570 84945618 f479c465 afd!AfdFreeEndpointResources+0x17d
f78ded58 f479c465 84945618 85949b20 8568d2b0 afd!AfdFreeEndpoint+0x1d
f78ded70 805754b5 8568d2b0 00000000 8057031c afd!AfdDoWork+0x48
f78ded80 804ec5f0 856288d0 00000000 85949b20 nt!IopProcessWorkItem+0xf
f78dedac 8059942a 856288d0 00000000 00000000 nt!ExpWorkerThread+0xe9
f78deddc 80500a04 804ec535 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
afd!AfdFreeEndpointResources+17d
f47a18be 895e7c mov [esi+0x7c],ebx

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: afd!AfdFreeEndpointResources+17d

MODULE_NAME: afd

IMAGE_NAME: afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e800802

FAILURE_BUCKET_ID: 0xc2_d_afd!AfdFreeEndpointResources+17d

BUCKET_ID: 0xc2_d_afd!AfdFreeEndpointResources+17d

Followup: MachineOwner

Dump #3

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000063, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f6bb133b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000063

CURRENT_IRQL: 2

FAULTING_IP:
WUSB20XP+4633b
f6bb133b ?? ???

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 804eaa22 to 8053f4b0

STACK_TEXT:
f78b6b74 804eaa22 0000000a 00000063 00000002 nt!KeBugCheckEx+0x19
f78b6b74 f6bb133b 0000000a 00000063 00000002 nt!KiTrap0E+0x21f
WARNING: Stack unwind information not available. Following frames may be wrong.
f78b6c00 843f0114 f78b6d2c 84000001 00000003 WUSB20XP+0x4633b
f78b6c1c f6bb1083 8481f15c 8557e56c 00000072 0x843f0114
f78b6c34 f6bb129b f6bb2d90 8481f15c f78b6c0b WUSB20XP+0x46083
f78b6c54 f6ba43d7 f6bb2d90 8481f15c f728139d WUSB20XP+0x4629b
f78b6c70 f6ba5279 f6bb2c00 8481f15c 8481f0e8 WUSB20XP+0x393d7
f78b6c84 f6b90615 f6bb2c00 8481f15c 00000001 WUSB20XP+0x3a279
f78b6ca8 f6b8c222 f6bb2c00 8481f0e8 8481805d WUSB20XP+0x25615
f78b6cbc f6b89487 f6bb2c00 8481f0e8 85576000 WUSB20XP+0x21222
f78b6cf0 f6b80f83 85576000 843f00ec f78b6d2c WUSB20XP+0x1e487
f78b6d10 f6b74dc8 85576000 f78b6d2c 85576000 WUSB20XP+0x15f83
f78b6d34 f6b76eb5 855d1008 85576000 85577cc8 WUSB20XP+0x9dc8
f78b6d74 f728b81a 855dd338 85576000 804ec5f0 WUSB20XP+0xbeb5
f78b6d80 804ec5f0 855dd338 00000000 8594b620 NDIS!ndisWorkItemHandler+0xa
f78b6dac 8059942a 855dd338 00000000 00000000 nt!ExpWorkerThread+0xe9
f78b6ddc 80500a04 804ec535 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
WUSB20XP+4633b
f6bb133b ?? ???

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: WUSB20XP+4633b

MODULE_NAME: WUSB20XP

IMAGE_NAME: WUSB20XP.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3ffc825a

FAILURE_BUCKET_ID: 0xD1_WUSB20XP+4633b

BUCKET_ID: 0xD1_WUSB20XP+4633b

Followup: MachineOwner

Dump #4

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000a, Attempt to free some other component's protected pool.
Arg2: 84baff70, Address of pool
Arg3: 656c69e8, Pool allocation's tag
Arg4: 656c6946, Quota process pointer (bad).

Debugging Details:
------------------

***** Debugger could not find nt in module list, module list might be corrupt.



"nt.*" was not found in the image list.
Debugger will attempt to load "nt.*" at given base 00000000.

Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results. Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to load image nt.*, Win32 error 2
Unable to add module at 00000000

BUGCHECK_STR: 0xc2_a

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

LAST_CONTROL_TRANSFER: from 00000000 to 8053f4b0

STACK_TEXT:
f78d2c94 00000000 00000000 00000000 00000000 0x8053f4b0


STACK_COMMAND: kb

FOLLOWUP_IP:
+ffffffff8053f4b0
8053f4b0 5d pop ebp

FAULTING_SOURCE_CODE:


FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: CORRUPT_MODULELIST

Followup: MachineOwner

Dump #5

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffc, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804e7c69, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: fffffffc

FAULTING_IP:
nt!KiServiceExit2+0
804e7c69 fa cli

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x50

CURRENT_IRQL: 1

CLI_FAULT_INSTR:
nt!KiServiceExit2+0
804e7c69 fa cli

LAST_CONTROL_TRANSFER: from 8053035c to 8053f4b0

STACK_TEXT:
f2b62c88 8053035c 00000050 fffffffc 00000001 nt!KeBugCheckEx+0x19
f2b62cd8 804ea8c7 00000001 fffffffc 00000000 nt!MmAccessFault+0x723
f2b62cd8 804e7c69 00000001 fffffffc 00000000 nt!KiTrap0E+0xc4
f2b62d64 804e7c35 00000000 00000000 00000000 nt!KiServiceExit2
f2b62dd0 00000000 032df2a0 00000023 00000000 nt!KiSystemCallExit3+0x76
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x0


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!KiServiceExit2+0
804e7c69 fa cli

FAULTING_SOURCE_CODE:


FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiServiceExit2+0

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: CLI_FAULT

BUCKET_ID: CLI_FAULT

Followup: MachineOwner

 

Also where are my manners, thank you for the help in advance-

 

Hi,

It is hardware error. Your last minidump is crashed with CLI_FAULT and it is the sign of faulty ram or PSU. Run memtest to stress test ram. What is the wattage of your PSU?

>>>
SYMBOL_NAME: nt!KiServiceExit2+0
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: CLI_FAULT
BUCKET_ID: CLI_FAULT
<<<