none
Windows 8 crash dumps

    Question

  • On my desktop computer, Windows 8 is crashing after every few hours, when I revoke it remotely after some inactivity.

     

    For example, yesterday I was connected via RDC on my laptop. I had opened 4 projects in Visual Studio 2012. I went to sleep and both laptop leaving both laptop and desktop running .. waste of energy :< ... Next morning, when I tried maximized RDC window, the it crashed and RDC showed the disconnect dialog. I rushed to other room and it was dumping memory with sad face on screen. After the restart, I had to repair VS2012 pro installation.

     

    Few minutes later, while I was just browsing the web on it remotely (mostly TechNet and Sysinternal websites to diagnose this issue), it crashed again. :(

     

    Here is the folder containing the minidump files: http://sdrv.ms/T5ziU4

     

    Can anyone please look at those dumps and trace the problem?

    Friday, December 21, 2012 2:58 PM

Answers

  • the new dump shows memory corruption again:


    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff80067d0b187, Address of the instruction which caused the bugcheck
    Arg3: fffff8800b31bed0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    FAULTING_IP: 
    nt!MiProcessCrcList+cb
    fffff800`67d0b187 8b04c8          mov     eax,dword ptr [rax+rcx*8]
    
    CONTEXT:  fffff8800b31bed0 -- (.cxr 0xfffff8800b31bed0)
    rax=fffffa8000000020 rbx=fffffa800c3daef0 rcx=0003060000686aa8
    rdx=0000000000000001 rsi=000000000011c3fc rdi=fffffa800c000000
    rip=fffff80067d0b187 rsp=fffff8800b31c8d0 rbp=0000000000000009
     r8=fffff8800b31c8d0  r9=0000000000000000 r10=0000000000000001
    r11=fffff8800b31c8a0 r12=0000000000000001 r13=fffffa800c42dda0
    r14=fffffa800b37cb00 r15=fffffa8008a1b810
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    nt!MiProcessCrcList+0xcb:
    fffff800`67d0b187 8b04c8          mov     eax,dword ptr [rax+rcx*8] ds:002b:00182a80`03435560=????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from fffff80067d0adf2 to fffff80067d0b187
    
    STACK_TEXT:  
    nt!MiProcessCrcList
    nt!MmCombineIdenticalPages
    nt!NtSetSystemInformation
    nt!KiSystemServiceCopyEnd
    0x0
    
    
    FOLLOWUP_IP: 
    nt!MiProcessCrcList+cb
    fffff800`67d0b187 8b04c8          mov     eax,dword ptr [rax+rcx*8]
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nt!MiProcessCrcList+cb
    
    IMAGE_NAME:  memory_corruption
    
    BUCKET_ID_FUNC_OFFSET:  cb
    
    FAILURE_BUCKET_ID:  0x3B_nt!MiProcessCrcList
    

    How long have you used memtest? Run it several passes in deep diag mode.Also try to load the default BIOS settings and make sure the SPD RAM timings are ok.


    "A programmer is just a tool which converts caffeine into code"

    Tuesday, December 25, 2012 7:16 PM
    Answerer

All replies

  • SYSTEM_PTE_MISUSE (da)
    A driver has corrupted system PTEs.
    Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes
    to a DWORD 3 value and reboot.  If the same bugcheck occurs again the stack trace will
    identify the offending driver.
    Arguments:
    Arg1: 0000000000000504, Type of error.
    Arg2: fffff6fc4000c328
    Arg3: 0000000080000001
    Arg4: 0000000000001865
    
    Debugging Details:
    ------------------
    
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  0xDA
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  2
    
    LAST_CONTROL_TRANSFER:  from fffff800c5d5c167 to fffff800c5cf7340
    
    STACK_TEXT:  
    nt!KeBugCheckEx
    nt!MiReplenishBitMap
    nt!MiEmptyPteBins
    nt!MiReservePtes
    nt!MmCombineIdenticalPages
    nt!NtSetSystemInformation
    nt!KiSystemServiceCopyEnd
    0x0
    
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!MiReplenishBitMap+4ea
    fffff800`c5d5c167 cc              int     3
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt!MiReplenishBitMap+4ea
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  50ab0e64
    
    IMAGE_NAME:  memory_corruption
    
    BUCKET_ID_FUNC_OFFSET:  4ea
    
    FAILURE_BUCKET_ID:  0xDA_nt!MiReplenishBitMap
    

    Set the required key and reboot. Upload the new dumps.


    DPC_WATCHDOG_VIOLATION (133)
    The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
    or above.
    Arguments:
    Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
    	DISPATCH_LEVEL or above. The offending component can usually be
    	identified with a stack trace.
    Arg2: 0000000000000784, The watchdog period.
    Arg3: 0000000000000000
    Arg4: 0000000000000000
    
    Debugging Details:
    ------------------
    
    
    DPC_TIMEOUT_TYPE:  DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  0x133
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  d
    
    LOCK_ADDRESS:  fffff800b00e4760 -- (!locks fffff800b00e4760)
    
    Resource @ nt!PiEngineLock (0xfffff800b00e4760)    Available
    
    WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.
    
    
    WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.
    
    1 total locks
    
    PNP_TRIAGE: 
    	Lock address  : 0xfffff800b00e4760
    	Thread Count  : 0
    	Thread address: 0x0000000000000000
    	Thread wait   : 0x0
    
    LAST_CONTROL_TRANSFER:  from fffff800affe219b to fffff800afe89340
    
    STACK_TEXT:  
    nt!KeBugCheckEx
    nt! ?? ::FNODOBFM::`string'
    nt!KeUpdateRunTime
    hal!HalpTimerClockInterrupt
    nt!KiInterruptDispatchNoLockNoEtw
    nt!MiTryLockLeafPage
    nt!MiUnlinkStandbyBatch
    nt!MmCheckCachedPageStates
    nt!CcFetchDataForRead
    nt!CcMapAndCopyFromCache
    nt!CcCopyReadEx
    Ntfs!NtfsCopyReadA
    fltmgr!FltpPerformFastIoCall
    fltmgr!FltpPassThroughFastIo
    fltmgr!FltpFastIoRead
    nt!NtReadFile
    nt!KiSystemServiceCopyEnd
    nt!KiServiceLinkage
    nt!CmpFileRead
    nt!HvpReadFileImageAndBuildMap
    nt!HvLoadHive
    nt!HvInitializeHive
    nt!CmpInitializeHive
    nt!CmpInitHiveFromFile
    nt!CmpCmdHiveOpen
    nt!CmLoadKey
    nt!NtLoadKeyEx
    nt!KiSystemServiceCopyEnd
    nt!KiServiceLinkage
    nt!PiDrvDbLoadHive
    nt!PiDrvDbLoadNodeWorkerCallback
    nt!ExpWorkerThread
    nt!PspSystemThreadStartup
    nt!KiStartSystemThread
    
    
    
    

    You should also check the RAM and HDD.

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  2
    
    LAST_CONTROL_TRANSFER:  from fffff801e7eb5216 to fffff801e7b25d9a
    
    STACK_TEXT:  
    nt!MiSharePage
    nt!MiProcessCrcList
    nt!MmCombineIdenticalPages
    nt!NtSetSystemInformation
    nt!KiSystemServiceCopyEnd
    0x0
    
    
    IMAGE_NAME:  memory_corruption
    
    BUCKET_ID_FUNC_OFFSET:  8a
    
    FAILURE_BUCKET_ID:  0x3B_nt!MiSharePage
    
    BUCKET_ID:  0x3B_nt!MiSharePage
    

    Also update the BIOS from F7 to F9:

    BiosVersion = F7
    BiosReleaseDate = 11/29/2007
    SystemManufacturer = Gigabyte Technology Co., Ltd.
    SystemProductName = P35-DS3L
    


    "A programmer is just a tool which converts caffeine into code"

    Friday, December 21, 2012 4:40 PM
    Answerer
  • Thanks for your help!

    I updated BIOS and plug the key. I ran memory diagnostic test and the results are fine.

    I waited for few days for system to crash (or to get a new dump file). Few minutes back, when I tried to access it remotely, as the remote session is created and the login screen appeared the system went down. I have uploaded the file _new_122312-54038-01.dmp. Please take a look to spot the issue.

    Sunday, December 23, 2012 8:56 PM
  • You still have memory related crashes.

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff80280b3a13d, Address of the instruction which caused the bugcheck
    Arg3: fffff8800aabbd20, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    FAULTING_IP: 
    nt!MiIdentifyPfn+15d
    fffff802`80b3a13d f0410fba6f481f  lock bts dword ptr [r15+48h],1Fh
    
    CONTEXT:  fffff8800aabbd20 -- (.cxr 0xfffff8800aabbd20)
    rax=0000000000000001 rbx=fffffa8000bd3180 rcx=0000000000000002
    rdx=fffff80280b3a0f5 rsi=fffff8a0041eeca1 rdi=fffffa8006056e40
    rip=fffff80280b3a13d rsp=fffff8800aabc720 rbp=0000000000000000
     r8=000000000003f108  r9=4700f00901420000 r10=0240000000054f3f
    r11=fffff80280a0e000 r12=00003f100003f147 r13=fffff8800aabc9d0
    r14=fffffa8000215ad8 r15=23009e0504420000
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
    nt!MiIdentifyPfn+0x15d:
    fffff802`80b3a13d f0410fba6f481f  lock bts dword ptr [r15+48h],1Fh ds:002b:23009e05`04420048=????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  2
    
    LAST_CONTROL_TRANSFER:  from fffff80280b3a9cc to fffff80280b3a13d
    
    STACK_TEXT:  
    nt!MiIdentifyPfn
    nt!MiIdentifyPfnWrapper
    nt!PfpPfnPrioRequest
    nt!PfQuerySuperfetchInformation
    nt!ExpQuerySystemInformation
    nt!NtQuerySystemInformation
    nt!KiSystemServiceCopyEnd
    0x0
    
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nt!MiIdentifyPfn+15d
    
    IMAGE_NAME:  memory_corruption
    
    FAILURE_BUCKET_ID:  0x3B_nt!MiIdentifyPfn
    
    BUCKET_ID:  0x3B_nt!MiIdentifyPfn
    

    the dumps shows that Windows crashes while Sueprfetch laods data from the HDD. Have you also tried chkdsk?


    "A programmer is just a tool which converts caffeine into code"

    Monday, December 24, 2012 12:39 PM
    Answerer
  • Thank you so much.

    Just received two more crashes in last 24 hours of total inactivity. Uploaded two more _new*.dmp files.

    Also, following is the log of chkdsk:

    Checking file system on C:
    The type of the file system is NTFS.
    
    
    A disk check has been scheduled.
    Windows will now check the disk.                         
    
    CHKDSK is verifying files (stage 1 of 3)...
    Attribute record of type 0x80 and instance tag 0x5 is cross linked
    starting at 0x87de28 for possibly 0x870 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x5
    in file 0x1d000 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 118784.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x94482d for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239d2 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145874.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x94482f for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239d3 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145875.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x9448af for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239d4 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145876.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x9449a8 for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239d5 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145877.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x944c2a for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239d6 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145878.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x944c2d for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239d7 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145879.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x944c2f for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239d8 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145880.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x944cad for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239d9 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145881.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x944caf for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239da is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145882.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x944d2d for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x239db is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 145883.
    Attribute record of type 0x80 and instance tag 0x1 is cross linked
    starting at 0xcd936b for possibly 0xccb46 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x1
    in file 0x26a3b is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 158267.
    Attribute record of type 0x80 and instance tag 0xd is cross linked
    starting at 0x16b44ad for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0xd
    in file 0x3e512 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 255250.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x86d011 for possibly 0x330 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x3f40f is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 259087.
    Attribute record of type 0x80 and instance tag 0x1 is cross linked
    starting at 0x19addbc for possibly 0x14d40 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x1
    in file 0x42d3f is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 273727.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x13bf42d for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x4682b is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 288811.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x13bf82d for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x4682d is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 288813.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x17b382f for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x46882 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 288898.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x17b38a8 for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x46883 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 288899.
    Attribute record of type 0x80 and instance tag 0x4 is cross linked
    starting at 0x17b38aa for possibly 0x1 clusters.
    Some clusters occupied by attribute of type 0x80 and instance tag 0x4
    in file 0x46888 is already in use.
    Deleting corrupt attribute record (128, "")
    from file record segment 288904.
      289536 file records processed.                                          File verification completed.
      7527 large file records processed.                                      0 bad file records processed.                                      
    CHKDSK is verifying indexes (stage 2 of 3)...
      386974 index entries processed.                                         Index verification completed.
      0 unindexed files scanned.                                           0 unindexed files recovered.                                       
    CHKDSK is verifying security descriptors (stage 3 of 3)...
    Cleaning up 1153 unused index entries from index $SII of file 0x9.
    Cleaning up 1153 unused index entries from index $SDH of file 0x9.
    Cleaning up 1153 unused security descriptors.
    Security descriptor verification completed.
    Inserting data attribute into file 118784.
    Inserting data attribute into file 145874.
    Inserting data attribute into file 145875.
    Inserting data attribute into file 145876.
    Inserting data attribute into file 145877.
    Inserting data attribute into file 145878.
    Inserting data attribute into file 145879.
    Inserting data attribute into file 145880.
    Inserting data attribute into file 145881.
    Inserting data attribute into file 145882.
    Inserting data attribute into file 145883.
    Inserting data attribute into file 158267.
    Inserting data attribute into file 255250.
    Inserting data attribute into file 259087.
    Inserting data attribute into file 273727.
    Inserting data attribute into file 288811.
    Inserting data attribute into file 288813.
    Inserting data attribute into file 288898.
    Inserting data attribute into file 288899.
    Inserting data attribute into file 288904.
      48740 data files processed.                                            CHKDSK is verifying Usn Journal...
    Usn Journal verification completed.
    CHKDSK discovered free space marked as allocated in the volume bitmap.
    
    Windows has made corrections to the file system.
    No further action is required.
    
     195358719 KB total disk space.
     103434360 KB in 233053 files.
        131572 KB in 48721 indexes.
             0 KB in bad sectors.
        366923 KB in use by the system.
         65536 KB occupied by the log file.
      91425864 KB available on disk.
    
          4096 bytes in each allocation unit.
      48839679 total allocation units on disk.
      22856466 allocation units available on disk.
    
    Internal Info:
    00 6b 04 00 cd 4c 04 00 a0 b0 07 00 00 00 00 00  .k...L..........
    11 02 00 00 6b 00 00 00 00 00 00 00 00 00 00 00  ....k...........
    00 00 ac cc b4 00 00 00 04 00 00 00 00 00 00 00  ................
    
    Windows has finished checking your disk.
    Please wait while your computer restarts.
    

    Monday, December 24, 2012 8:57 PM
  • chkdsk repaired a lot of NTFS issues. The latest dump also shows NTFS issues:

    KERNEL_SECURITY_CHECK_FAILURE (139)
    A kernel component has corrupted a critical data structure.  The corruption
    could potentially allow a malicious user to gain control of this machine.
    Arguments:
    Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
    Arg2: fffff8800b348680, Address of the trap frame for the exception that caused the bugcheck
    Arg3: fffff8800b3485d8, Address of the exception record for the exception that caused the bugcheck
    Arg4: 0000000000000000, Reserved
    
    
    
    EFAULT_BUCKET_ID:  LIST_ENTRY_CORRUPT
    
    BUGCHECK_STR:  0x139
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  1
    
    STACK_TEXT:
    nt!KeBugCheckEx
    nt!KiBugCheckDispatch
    nt!KiFastFailDispatch
    nt!KiRaiseSecurityCheckFailure
    Ntfs!NtfsOpenAttribute
    Ntfs!NtfsOpenExistingAttr
    Ntfs!NtfsOpenAttributeInExistingFile
    Ntfs!NtfsOpenExistingPrefixFcb
    Ntfs!NtfsFindStartingNode
    Ntfs!NtfsCommonCreate
    Ntfs!NtfsCommonCreateCallout
    nt!KxSwitchKernelStackCallout
    nt!KiSwitchKernelStackContinue
    nt!KeExpandKernelStackAndCalloutInternal
    nt!KeExpandKernelStackAndCalloutEx
    Ntfs!NtfsFsdCreate
    fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted
    fltmgr!FltpCreate
    nt!IopParseDevice
    nt!ObpLookupObjectName
    nt!ObOpenObjectByName
    nt!IopCreateFile
    nt!NtOpenFile
    nt!KiSystemServiceCopyEnd
    nt!KiServiceLinkage
    CI!CipOpenFileOnCleanStackCallout
    nt!KxSwitchKernelStackCallout
    nt!KiSwitchKernelStackContinue
    
    

    Fixing the NTFS issues should also fix your crashes.


    "A programmer is just a tool which converts caffeine into code"

    Tuesday, December 25, 2012 5:39 AM
    Answerer
  • Thank you Andre.

    +1 for your kind help.

    Today, after the inactivity for 24 hours, I encountered another crash. The system was restarted. I have uploaded the file _new_122512-50559-01.dmp.

    Tuesday, December 25, 2012 6:27 PM
  • the new dump shows memory corruption again:


    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff80067d0b187, Address of the instruction which caused the bugcheck
    Arg3: fffff8800b31bed0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    FAULTING_IP: 
    nt!MiProcessCrcList+cb
    fffff800`67d0b187 8b04c8          mov     eax,dword ptr [rax+rcx*8]
    
    CONTEXT:  fffff8800b31bed0 -- (.cxr 0xfffff8800b31bed0)
    rax=fffffa8000000020 rbx=fffffa800c3daef0 rcx=0003060000686aa8
    rdx=0000000000000001 rsi=000000000011c3fc rdi=fffffa800c000000
    rip=fffff80067d0b187 rsp=fffff8800b31c8d0 rbp=0000000000000009
     r8=fffff8800b31c8d0  r9=0000000000000000 r10=0000000000000001
    r11=fffff8800b31c8a0 r12=0000000000000001 r13=fffffa800c42dda0
    r14=fffffa800b37cb00 r15=fffffa8008a1b810
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    nt!MiProcessCrcList+0xcb:
    fffff800`67d0b187 8b04c8          mov     eax,dword ptr [rax+rcx*8] ds:002b:00182a80`03435560=????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from fffff80067d0adf2 to fffff80067d0b187
    
    STACK_TEXT:  
    nt!MiProcessCrcList
    nt!MmCombineIdenticalPages
    nt!NtSetSystemInformation
    nt!KiSystemServiceCopyEnd
    0x0
    
    
    FOLLOWUP_IP: 
    nt!MiProcessCrcList+cb
    fffff800`67d0b187 8b04c8          mov     eax,dword ptr [rax+rcx*8]
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nt!MiProcessCrcList+cb
    
    IMAGE_NAME:  memory_corruption
    
    BUCKET_ID_FUNC_OFFSET:  cb
    
    FAILURE_BUCKET_ID:  0x3B_nt!MiProcessCrcList
    

    How long have you used memtest? Run it several passes in deep diag mode.Also try to load the default BIOS settings and make sure the SPD RAM timings are ok.


    "A programmer is just a tool which converts caffeine into code"

    Tuesday, December 25, 2012 7:16 PM
    Answerer
  • Turned out to be a faulty 1GB RAM chip. I removed that one and now I am running Windows 8 on 3GB RAM for more than 36 hours without any more crashes. I hope it will keep working this way.

    Thank you Andre. At this point, I am marking your last post as answer. If there is any change in behavior, I will post a reply. :-)

    Friday, December 28, 2012 6:08 PM