Computer Randomly Restarts

Fourth Crash:

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e3327000, 0, bfa0e481, 1}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for nv4_disp.dll -

Could not read faulting driver name
Probably caused by : nv4_disp.dll ( nv4_disp+3b481 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e3327000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bfa0e481, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: e3327000

FAULTING_IP:
nv4_disp+3b481
bfa0e481 f3a5 rep movsd

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 00000000 to bfa0e481

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
00000200 00000000 00000000 00000000 00000000 nv4_disp+0x3b481
f3095a6c 80570593 f3095b28 f3095b2c f3095afc nt!KiCallUserMode+0x4
f3095ac8 bf813d09 00000002 f3095b0c 00000018 nt!KeUserModeCallback+0x87
f3095b4c bf813e25 bc668918 00000085 00000001 win32k!SfnDWORD+0xa8
f3095b94 bf814092 03668918 00000085 00000001 win32k!xxxSendMessageToClient+0x133
f3095be0 bf80f470 bc668918 00000085 00000001 win32k!xxxSendMessageTimeout+0x1a6
f3095c04 bf821ff4 bc668918 00000085 00000001 win32k!xxxSendMessage+0x1b
f3095c20 bf822506 bc668918 00000001 e3142eb0 win32k!xxxSendNCPaint+0x5c
f3095c3c bf8225f0 bc668918 e11b0018 f3095c80 win32k!xxxSimpleDoSyncPaint+0x96
f3095c58 bf8225cf bc668918 00000004 bf9a9340 win32k!xxxInternalDoSyncPaint+0x12
f3095c80 bf81f424 bc6406e8 00000004 00000000 win32k!xxxInternalDoSyncPaint+0x78
f3095cdc bf822257 00000001 00000000 00000000 win32k!xxxEndDeferWindowPosEx+0x23f
f3095cfc bf82fb59 bc668918 00000000 00000000 win32k!xxxSetWindowPos+0x101
f3095d30 bf82fed4 00000000 00000057 f3095d64 win32k!xxxShowWindow+0x250
f3095d54 804ddf0f 000201dc 00000001 00cff80c win32k!NtUserShowWindow+0xa1
f3095d54 7c90eb94 000201dc 00000001 00cff80c nt!KiFastCallEntry+0xfc
00cff7a4 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nv4_disp+3b481
bfa0e481 f3a5 rep movsd

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nv4_disp+3b481

MODULE_NAME: nv4_disp

IMAGE_NAME: nv4_disp.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4182eb4e

STACK_COMMAND: kb

BUCKET_ID: 0x50_nv4_disp+3b481

Followup: MachineOwner
---------

eax=00071e7f ebx=f5783000 ecx=00000032 edx=00000080 esi=e3327000 edi=f594ab34
eip=bfa0e481 esp=f3094f54 ebp=00000200 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nv4_disp+0x3b481:
bfa0e481 f3a5 rep movsd ds:e3327000=???????? es:f594ab34=f37394c4
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00000200 00000000 00000000 00000000 00000000 nv4_disp+0x3b481
f3095a6c 80570593 f3095b28 f3095b2c f3095afc nt!KiCallUserMode+0x4 (FPO: [2,3,4])
f3095ac8 bf813d09 00000002 f3095b0c 00000018 nt!KeUserModeCallback+0x87 (FPO: [Non-Fpo])
f3095b4c bf813e25 bc668918 00000085 00000001 win32k!SfnDWORD+0xa8 (FPO: [Non-Fpo])
f3095b94 bf814092 03668918 00000085 00000001 win32k!xxxSendMessageToClient+0x133 (FPO: [Non-Fpo])
f3095be0 bf80f470 bc668918 00000085 00000001 win32k!xxxSendMessageTimeout+0x1a6 (FPO: [Non-Fpo])
f3095c04 bf821ff4 bc668918 00000085 00000001 win32k!xxxSendMessage+0x1b (FPO: [Non-Fpo])
f3095c20 bf822506 bc668918 00000001 e3142eb0 win32k!xxxSendNCPaint+0x5c (FPO: [Non-Fpo])
f3095c3c bf8225f0 bc668918 e11b0018 f3095c80 win32k!xxxSimpleDoSyncPaint+0x96 (FPO: [Non-Fpo])
f3095c58 bf8225cf bc668918 00000004 bf9a9340 win32k!xxxInternalDoSyncPaint+0x12 (FPO: [Non-Fpo])
f3095c80 bf81f424 bc6406e8 00000004 00000000 win32k!xxxInternalDoSyncPaint+0x78 (FPO: [Non-Fpo])
f3095cdc bf822257 00000001 00000000 00000000 win32k!xxxEndDeferWindowPosEx+0x23f (FPO: [Non-Fpo])
f3095cfc bf82fb59 bc668918 00000000 00000000 win32k!xxxSetWindowPos+0x101 (FPO: [Non-Fpo])
f3095d30 bf82fed4 00000000 00000057 f3095d64 win32k!xxxShowWindow+0x250 (FPO: [Non-Fpo])
f3095d54 804ddf0f 000201dc 00000001 00cff80c win32k!NtUserShowWindow+0xa1 (FPO: [Non-Fpo])
f3095d54 7c90eb94 000201dc 00000001 00cff80c nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ f3095d64)
00cff7a4 00000000 00000000 00000000 00000000 0x7c90eb94

 

Crash Five:


Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f343d68c, f343d388, f7689157}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
Probably caused by : Ntfs.sys ( Ntfs!NtfsReleaseFcbWithPaging+9 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: f343d68c
Arg3: f343d388
Arg4: f7689157

Debugging Details:
------------------


EXCEPTION_RECORD: f343d68c -- (.exr fffffffff343d68c)
.exr fffffffff343d68c
ExceptionAddress: f7689157 (Ntfs!NtfsReleaseFcbWithPaging+0x00000009)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000010
Attempt to read from address 00000010

CONTEXT: f343d388 -- (.cxr fffffffff343d388)
.cxr fffffffff343d388
eax=00000000 ebx=f343d8fc ecx=8676e2c0 edx=8676e7e0 esi=00000000 edi=e155d970
eip=f7689157 esp=f343d754 ebp=f343d758 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Ntfs!NtfsReleaseFcbWithPaging+0x9:
f7689157 837e1000 cmp dword ptr [esi+0x10],0x0 ds:0023:00000010=????????
.cxr
Resetting default scope

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from f7689369 to f7689157

STACK_TEXT:
f343d758 f7689369 00000000 e155d8a8 f343d92c Ntfs!NtfsReleaseFcbWithPaging+0x9
f343d8a4 f7681f64 00000000 85bf69d0 f343d8fc Ntfs!NtfsCommonCreate+0xb4c
f343d984 804e19ee 8676e020 85bf69d0 85f8f180 Ntfs!NtfsFsdCreate+0x1ec
f343d994 f7705876 00000000 8668abf8 865e90e8 nt!IopfCallDriver+0x31
f343d9e0 804e19ee 8672c770 00000001 f343da40 sr!SrCreate+0x150
f343d9f0 f5b10273 f343da40 f304da00 00000000 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
f343db4c 8056e063 86754900 00000000 85c3e5f0 SYMEVENT!SYMEvent_GetVMDataPtr+0x6ad3
f343dbc4 805715e8 00000000 f343dc04 00000040 nt!ObpLookupObjectName+0x53c
f343dc18 8057f4c3 00000000 00000000 035ab801 nt!ObOpenObjectByName+0xea
f343dc94 8057f592 025ef508 80100080 025ef4a8 nt!IopCreateFile+0x407
f343dcf0 8057f5d5 025ef508 80100080 025ef4a8 nt!IoCreateFile+0x8e
f343dd30 804ddf0f 025ef508 80100080 025ef4a8 nt!NtCreateFile+0x30
f343dd30 7c90eb94 025ef508 80100080 025ef4a8 nt!KiFastCallEntry+0xfc
025ef464 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
Ntfs!NtfsReleaseFcbWithPaging+9
f7689157 837e1000 cmp dword ptr [esi+0x10],0x0

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Ntfs!NtfsReleaseFcbWithPaging+9

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107eea

STACK_COMMAND: .cxr fffffffff343d388 ; kb

BUCKET_ID: 0x24_Ntfs!NtfsReleaseFcbWithPaging+9

Followup: MachineOwner
---------

eax=f7ac613c ebx=f343d68c ecx=00000000 edx=00000000 esi=861f9ef0 edi=c0000005
eip=80537832 esp=f343d164 ebp=f343d17c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80537832 5d pop ebp
ChildEBP RetAddr Args to Child
f343d17c f766a051 00000024 001902fe f343d68c nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f343d1ac f769537b 861f9ef0 f343d1d8 804e32f6 Ntfs!NtfsExceptionFilter+0x1cd (FPO: [Non-Fpo])
f343d1b8 804e32f6 f343d1e0 00000000 f343d1e0 Ntfs!NtfsFsdCreate+0x208 (FPO: [Non-Fpo])
f343d1e0 804dc5fd f343d68c f343d974 f343d388 nt!_except_handler3+0x61 (FPO: [EBP 0xf343d204] [3,0,7])
f343d204 804dc5ca f343d68c f343d974 f343d388 nt!ExecuteHandler2+0x26
f343d2b4 8050fec3 f343d68c f343d388 00000010 nt!ExecuteHandler+0x24
f343d670 804de998 f343d68c 00000000 f343d6e0 nt!KiDispatchException+0x13e (FPO: [Non-Fpo])
f343d6d8 804de944 f343d758 f7689157 badb0d00 nt!CommonDispatchException+0x4d (FPO: [0,20,0])
f343d700 f768486a 8676e7e0 00000036 00000000 nt!Kei386EoiHelper+0x18a
f343d738 f343d8fc f343d758 00000000 f7689157 Ntfs!NtfsFindPrefixHashEntry+0x235 (FPO: [Non-Fpo])
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0xf343d8fc

 

Crash Six:


Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80552ae5, f48e2820, 0}

*** ERROR: Module load completed but symbols could not be loaded for a347bus.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+107 )

Followup: Pool_corruption
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80552ae5, The address that the exception occurred at
Arg3: f48e2820, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!ExDeferredFreePool+107
80552ae5 893b mov [ebx],edi

TRAP_FRAME: f48e2820 -- (.trap fffffffff48e2820)
.trap fffffffff48e2820
ErrCode = 00000003
eax=e30c7000 ebx=00520054 ecx=000001ff edx=e30c7010 esi=867ed078 edi=00530049
eip=80552ae5 esp=f48e2894 ebp=f48e28d4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExDeferredFreePool+0x107:
80552ae5 893b mov [ebx],edi ds:0023:00520054=bc940050
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80552aca to 80552ae5

STACK_TEXT:
f48e28d4 80552aca 00000001 867ba360 865a2718 nt!ExDeferredFreePool+0x107
f48e2914 8057474b e3391748 00000000 f48e2950 nt!ExFreePoolWithTag+0x47f
f48e2924 8056eaee e3391748 f48e2901 00000000 nt!ObReleaseObjectSecurity+0x1a
f48e2950 80574958 e1f20788 865a2718 00000001 nt!ObCheckObjectAccess+0xd3
f48e299c 80573c4a e1037758 00097348 00000000 nt!CmpDoOpen+0x256
f48e2b94 8056e063 00097348 00000000 865a2718 nt!CmpParseKey+0x558
f48e2c0c 805715e8 00000000 f48e2c4c 00000040 nt!ObpLookupObjectName+0x53c
f48e2c60 8057401f 00000000 867ba320 f7801201 nt!ObOpenObjectByName+0xea
f48e2d34 f77f2fbc 0088f5a0 00000001 0088f4e4 nt!NtOpenKey+0x1af
WARNING: Stack unwind information not available. Following frames may be wrong.
f48e2d64 7c90eb94 badb0d00 0088f4cc 00000000 a347bus+0xdfbc
0088f524 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+107
80552ae5 893b mov [ebx],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

SYMBOL_NAME: nt!ExDeferredFreePool+107

MODULE_NAME: Pool_Corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+107

Followup: Pool_corruption
---------

eax=e30c7000 ebx=00520054 ecx=000001ff edx=e30c7010 esi=867ed078 edi=00530049
eip=80552ae5 esp=f48e2894 ebp=f48e28d4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExDeferredFreePool+0x107:
80552ae5 893b mov [ebx],edi ds:0023:00520054=bc940050
ChildEBP RetAddr Args to Child
f48e28d4 80552aca 00000001 867ba360 865a2718 nt!ExDeferredFreePool+0x107 (FPO: [Non-Fpo])
f48e2914 8057474b e3391748 00000000 f48e2950 nt!ExFreePoolWithTag+0x47f (FPO: [Non-Fpo])
f48e2924 8056eaee e3391748 f48e2901 00000000 nt!ObReleaseObjectSecurity+0x1a (FPO: [Non-Fpo])
f48e2950 80574958 e1f20788 865a2718 00000001 nt!ObCheckObjectAccess+0xd3 (FPO: [Non-Fpo])
f48e299c 80573c4a e1037758 00097348 00000000 nt!CmpDoOpen+0x256 (FPO: [Non-Fpo])
f48e2b94 8056e063 00097348 00000000 865a2718 nt!CmpParseKey+0x558 (FPO: [Non-Fpo])
f48e2c0c 805715e8 00000000 f48e2c4c 00000040 nt!ObpLookupObjectName+0x53c (FPO: [Non-Fpo])
f48e2c60 8057401f 00000000 867ba320 f7801201 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
f48e2d34 f77f2fbc 0088f5a0 00000001 0088f4e4 nt!NtOpenKey+0x1af (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f48e2d64 7c90eb94 badb0d00 0088f4cc 00000000 a347bus+0xdfbc
0088f524 00000000 00000000 00000000 00000000 0x7c90eb94

 

Crash Seven, this one was weird, it happened before Windows finished even finished loading:


Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f365468c, f3654388, f7689157}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
Probably caused by : Ntfs.sys ( Ntfs!NtfsReleaseFcbWithPaging+9 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: f365468c
Arg3: f3654388
Arg4: f7689157

Debugging Details:
------------------


EXCEPTION_RECORD: f365468c -- (.exr fffffffff365468c)
.exr fffffffff365468c
ExceptionAddress: f7689157 (Ntfs!NtfsReleaseFcbWithPaging+0x00000009)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000010
Attempt to read from address 00000010

CONTEXT: f3654388 -- (.cxr fffffffff3654388)
.cxr fffffffff3654388
eax=00000000 ebx=f36548fc ecx=867712c0 edx=867717e0 esi=00000000 edi=e100cd20
eip=f7689157 esp=f3654754 ebp=f3654758 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Ntfs!NtfsReleaseFcbWithPaging+0x9:
f7689157 837e1000 cmp dword ptr [esi+0x10],0x0 ds:0023:00000010=????????
.cxr
Resetting default scope

CUSTOMER_CRASH_COUNT: 7

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from f7689369 to f7689157

STACK_TEXT:
f3654758 f7689369 00000000 e100cc58 f365492c Ntfs!NtfsReleaseFcbWithPaging+0x9
f36548a4 f7681f64 00000000 85bff008 f36548fc Ntfs!NtfsCommonCreate+0xb4c
f3654984 804e19ee 86771020 85bff008 85bfb960 Ntfs!NtfsFsdCreate+0x1ec
f3654994 f7705876 00000000 8668abf8 8634b5a8 nt!IopfCallDriver+0x31
f36549e0 804e19ee 8672b770 00000001 f3654a40 sr!SrCreate+0x150
f36549f0 f5b10273 f3654a40 f3044a00 00000000 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
f3654b4c 8056e063 86754900 00000000 8637c5e8 SYMEVENT!SYMEvent_GetVMDataPtr+0x6ad3
f3654bc4 805715e8 00000000 f3654c04 00000040 nt!ObpLookupObjectName+0x53c
f3654c18 8057f4c3 00000000 00000000 f3944001 nt!ObOpenObjectByName+0xea
f3654c94 8057f592 00c6f508 80100080 00c6f4a8 nt!IopCreateFile+0x407
f3654cf0 8057f5d5 00c6f508 80100080 00c6f4a8 nt!IoCreateFile+0x8e
f3654d30 804ddf0f 00c6f508 80100080 00c6f4a8 nt!NtCreateFile+0x30
f3654d30 7c90eb94 00c6f508 80100080 00c6f4a8 nt!KiFastCallEntry+0xfc
00c6f464 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
Ntfs!NtfsReleaseFcbWithPaging+9
f7689157 837e1000 cmp dword ptr [esi+0x10],0x0

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Ntfs!NtfsReleaseFcbWithPaging+9

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107eea

STACK_COMMAND: .cxr fffffffff3654388 ; kb

BUCKET_ID: 0x24_Ntfs!NtfsReleaseFcbWithPaging+9

Followup: MachineOwner
---------

eax=f7ac613c ebx=f365468c ecx=00000000 edx=00000000 esi=86174988 edi=c0000005
eip=80537832 esp=f3654164 ebp=f365417c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80537832 5d pop ebp
ChildEBP RetAddr Args to Child
f365417c f766a051 00000024 001902fe f365468c nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f36541ac f769537b 86174988 f36541d8 804e32f6 Ntfs!NtfsExceptionFilter+0x1cd (FPO: [Non-Fpo])
f36541b8 804e32f6 f36541e0 00000000 f36541e0 Ntfs!NtfsFsdCreate+0x208 (FPO: [Non-Fpo])
f36541e0 804dc5fd f365468c f3654974 f3654388 nt!_except_handler3+0x61 (FPO: [EBP 0xf3654204] [3,0,7])
f3654204 804dc5ca f365468c f3654974 f3654388 nt!ExecuteHandler2+0x26
f36542b4 8050fec3 f365468c f3654388 00000010 nt!ExecuteHandler+0x24
f3654670 804de998 f365468c 00000000 f36546e0 nt!KiDispatchException+0x13e (FPO: [Non-Fpo])
f36546d8 804de944 f3654758 f7689157 badb0d00 nt!CommonDispatchException+0x4d (FPO: [0,20,0])
f3654700 f768486a 867717e0 00000036 00000000 nt!Kei386EoiHelper+0x18a
f3654738 f36548fc f3654758 00000000 f7689157 Ntfs!NtfsFindPrefixHashEntry+0x235 (FPO: [Non-Fpo])
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0xf36548fc

 

crash 1) double free, second free was from ntoskrnl, who was a victim
crash 2) corrupt free list, symevent was a victim
crash 3) corrupt pfn list. this one is more intersting, because it would be a nasty bug to do this
crash 4) corrupt memory
crash 5) corrupt memory
crash 6) same as crash1
crash 7) memory corruption


Ok, enough dumps for now. I am leaning away from this being a bad driver, and more towards bad ram. crash 2,3,4,5 are generally not seen with just a malfunctioning driver.

As of right now, i'd say 50% chance of this being flaky ram. 10% chance of it being a bad motherboard or cpu (MAKE SURE you have the latest BIOS), 20% chance of it being a particularly nasty driver bug.

Do you have access to some different RAM sticks?
Can you make it crash in safe mode?
Update your bios.

 

Thanks for the response. The BIOS is completely up to date. I do not have access to different RAM, but could I bring it in to a computer store to get it tested? The RAM passes the memory tests I run on my comp, but I have heard that those tests aren't always accurate. But if it is the RAM, it should be under warranty from Geill, so that's no prob, and the MoBo is also under warranty. I have not tried to see if it crashes in safe mode, and because the crashes are so irregular there's not a good way to check this. Sometimes I go a day w/o a crash, but when the crashes start, they seem to come like 6 or 7 times in a row, then I'm back to stable for a while. So, what should I do? I could RMA the MoBo tomorrow before I leave for Xmas break, or I could bring the RAM home with me and try to get it tested over break and then RMA if it's a problem. I just want to figure out what to do quickly, before my flight leaves tomorrow. I really really really appreciate the help people have given me on this forum.

 

could I bring it in to a computer store to get it tested?
Yes, but as you say, with the intermittant nature of the crashes, it would be a lot more fun if you could run for a couple days with replacement ram rather than a 5 minute test with a hardware analyzer the shop is going to do. If you go to a hole in the wall shop, they may let you borrow a stick, or buy it with the understanding you might be bringing it back.

I have not tried to see if it crashes in safe mode, and because the crashes are so irregular there's not a good way to check this
This would eliminate it being a driver issue for the most part. You know your crash pattern better to know if this is a feasible test.

 

One thing I just realized is that my computer has never, and I mean NEVER, crashed while I was in the middle of playing a game. Not like a game in an internet browser, but a real 3D game, like HL2 or something. For the months these crashes have been going on, the computer may be as unstable as heck, but as soon as I load up a game the system is stable until I exit the game. I don't what this means, or if it means anything, but maybe it means that whatever my problem is, it's something that is not active while the video card is engaged. Does this make any sense?

 

OK, I've got to go catch my flight home for Christmas break in about an hour and a half. I have decided to RMA the MoBo to Newegg. This decision was made easier by the fact that this afternoon the MoBo fan started making the dying-camel noise again, and I when I open up the case to look at the fan I see it is spinning at all of 10 rpm (practically, it is spinning very very very slowly). So, I'm RMA'ing the MoBo, and I am taking the RAM home with me to have a computer shop test it for errors. I am talking to the Geil people about RMA, but it looks that that might not be possible since I didn't buy the memory from a retailer, I bought it from another individual. I just e-mailed that guy hoping he has the original invoice, b/c if he does than Geil will honor the lifetime warranty. I'd like to thank everyone on this forum who has been helping with this, and I will post an update in January once I get the new MoBo and see how things are working.
Adam