BleepingComputer.com: Vista crashing/unexpected reboot

For the last week or so I have been having problems with Vista locking up.
Starting a couple days ago it will crash or reboot unexpectedly.

I have ran Malwarebytes Anti-Malware & Super Anti Spyware & they found nothing.
Also have ran AVG 8 with nothing found.

Here is the dump analysis of my mini dump, any help you can provide would be greatly appreciated -


Microsoft ® Windows Debugger Version 6.10.0003.233 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini020109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista SP1 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0xfffff800`02200000 PsLoadedModuleList = 0xfffff800`023c5db0
Debug session time: Sun Feb 1 04:16:17.095 2009 (GMT-5)
System Uptime: 0 days 5:48:52.298
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904aa, fffffa600d3aa8c8, fffffa600d3aa2a0, fffffa6001154574}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904aa
Arg2: fffffa600d3aa8c8
Arg3: fffffa600d3aa2a0
Arg4: fffffa6001154574

Debugging Details:
------------------


EXCEPTION_RECORD: fffffa600d3aa8c8 -- (.exr 0xfffffa600d3aa8c8)
ExceptionAddress: fffffa6001154574 (Ntfs!NtfsFindIndexEntry+0x00000000000001b0)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000001
Attempt to write to address 0000000000000001

CONTEXT: fffffa600d3aa2a0 -- (.cxr 0xfffffa600d3aa2a0)
rax=0000000000000001 rbx=fffffa60010b5d94 rcx=00000000000e4401
rdx=fffffa600d3ac0a0 rsi=000000000001c112 rdi=0000000000000000
rip=fffffa6001154574 rsp=fffffa600d3aab08 rbp=fffffa600d3aac80
r8=fffffa6001154574 r9=fffffa600d3aac80 r10=0000000000000002
r11=fffffa600d3aab78 r12=fffffa60010b5d8c r13=00000000000e4353
r14=fffffa6001062000 r15=fffffa600d3aba40
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
Ntfs!NtfsFindIndexEntry+0x1b0:
fffffa60`01154574 0000 add byte ptr [rax],al ds:002b:00000000`00000001=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: rundll32.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000001

EXCEPTION_PARAMETER2: 0000000000000001

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002429080
0000000000000001

FOLLOWUP_IP:
Ntfs!NtfsFindIndexEntry+1b0
fffffa60`01154574 0000 add byte ptr [rax],al

BUGCHECK_STR: 0x24

DEFAULT_BUCKET_ID: CODE_CORRUPTION

LAST_CONTROL_TRANSFER: from fffff8000226888c to fffffa6001154574

STACK_TEXT:
fffffa60`0d3aab08 fffff800`0226888c : 00000000`00000000 00000000`00000000 fffff980`34bdd000 fffffa80`0adf66b0 : Ntfs!NtfsFindIndexEntry+0x1b0
fffffa60`0d3aab10 fffffa60`0107ee49 : fffffa60`010b5da0 fffffa60`0d3ac0a0 fffffa60`0d3aba40 fffffa60`0d3ac0a0 : nt!_C_specific_handler+0x140
fffffa60`0d3aab80 fffff800`0226873d : fffffa60`0d3ac0a0 fffffa60`0d3ac320 00000000`00000002 fffffa60`0d3aad80 : Ntfs!_GSHandlerCheck_SEH+0x75
fffffa60`0d3aabb0 fffff800`0226c070 : fffffa60`00000002 fffffa60`0d3ac000 00000000`00000000 fffffa60`0d3ac0a0 : nt!RtlpExecuteHandlerForUnwind+0xd
fffffa60`0d3aabe0 fffff800`02268818 : fffffa60`010afb0c fffffa60`0107e112 fffffa60`0d3aba40 ffffffff`c0000102 : nt!RtlUnwindEx+0x2f0
fffffa60`0d3ab290 fffff800`022686bd : fffffa60`0d3ac320 fffffa60`0d3ac320 fffffa60`0d3aba40 fffffa60`0107e10d : nt!_C_specific_handler+0xcc
fffffa60`0d3ab300 fffff800`0226fcff : fffffa60`00000001 00000000`00000000 00000000`00000000 fffffa60`0d3ac320 : nt!RtlpExecuteHandlerForException+0xd
fffffa60`0d3ab330 fffff800`0226db7e : fffffa60`0d3aba40 fffffa60`0d3abae0 0000b6d8`00000001 ffff0000`0000000d : nt!RtlDispatchException+0x22f
fffffa60`0d3aba20 fffffa60`01075218 : fffffa80`0c0ba240 fffff880`107117e8 fffff980`352c3000 00000000`c0000102 : nt!RtlRaiseStatus+0x4e
fffffa60`0d3abfc0 fffffa60`0115b9cc : fffff880`107117f0 fffffa80`0a998e88 fffffa80`0c0ba242 fffff880`0000000e : Ntfs!NtfsRaiseStatusInternal+0x58
fffffa60`0d3ac000 fffffa60`01146353 : fffffa80`0c0ba240 00000000`00000000 fffff880`090a7070 fffff880`10711750 : Ntfs! ?? ::NNGAKEGL::`string'+0x6ea0
fffffa60`0d3ac0a0 fffffa60`01137d4e : fffffa80`0c0ba240 fffffa60`0d3ac4a0 fffffa80`0c0ba240 fffff880`00ab8801 : Ntfs!NtfsFindIndexEntry+0x63
fffffa60`0d3ac120 fffffa60`0107e10d : fffffa80`0c0ba240 fffffa80`1017f500 fffffa60`0d3ac4a0 fffffa80`1063cb01 : Ntfs!NtfsCommonCreate+0x74e
fffffa60`0d3ac320 fffff800`022763d1 : fffffa60`0d3ac410 fffff880`00001f00 00000000`00000000 00000000`00002274 : Ntfs!NtfsCommonCreateCallout+0x1d
fffffa60`0d3ac350 fffffa60`0107e83a : fffffa60`0107e0f0 fffffa60`0d3ac410 fffffa80`0c0ba240 fffffa80`1017f500 : nt!KeExpandKernelStackAndCalloutEx+0x2e1
fffffa60`0d3ac3e0 fffffa60`0113656d : 00000000`00000000 fffffa60`0d3ac4a0 fffffa80`1017f500 fffffa80`1017f500 : Ntfs!NtfsCommonCreateOnNewStack+0x4a
fffffa60`0d3ac440 fffffa60`00d52e17 : fffffa80`10673030 fffffa80`1017f500 fffffa80`07512d00 fffffa80`1017f501 : Ntfs!NtfsFsdCreate+0x1ad
fffffa60`0d3ac5e0 fffffa60`00d6f26c : fffffa80`0cd93460 fffffa80`0cdb08c0 fffffa80`1017f500 fffffa60`0d3ac6a0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227
fffffa60`0d3ac650 fffff800`024dad83 : 00000000`00000005 fffffa80`105b23b0 00000000`00000040 00000000`00000000 : fltmgr!FltpCreate+0x25d
fffffa60`0d3ac700 fffff800`024d4a59 : fffffa80`04ed7950 00000000`00000000 fffffa80`1061e010 00000000`00000001 : nt!IopParseDevice+0x5e3
fffffa60`0d3ac8a0 fffff800`024d8944 : 00000000`00000000 fffffa80`106a7a01 fffffa80`00000040 00000000`00000000 : nt!ObpLookupObjectName+0x5eb
fffffa60`0d3ac9b0 fffff800`024e4ee0 : fffff880`00100081 00000000`0020f1a8 00000000`00000001 fffff800`024d18f8 : nt!ObOpenObjectByName+0x2f4
fffffa60`0d3aca80 fffff800`024e5a0c : 00000000`0020f138 fffff800`00100081 fffff880`19b3d5b0 00000000`0020f158 : nt!IopCreateFile+0x290
fffffa60`0d3acb20 fffff800`02254df3 : fffff880`091c4a10 fffffa80`1063cbb0 00000000`0000016c fffff800`024d1ec4 : nt!NtCreateFile+0x78
fffffa60`0d3acbb0 00000000`775f5fca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0020f0c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775f5fca


CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
fffffa6001154000-fffffa6001154006 7 bytes - Ntfs!NtfsCommonClose+b39
[ ff eb 16 48 8b 8d e8:00 00 00 00 00 00 00 ]
fffffa600115400a-fffffa600115400e 5 bytes - Ntfs!NtfsCommonClose+b43 (+0x0a)
[ 48 81 c1 10 06:00 00 00 00 00 ]
fffffa6001154011-fffffa6001154017 7 bytes - Ntfs!NtfsCommonClose+b4a (+0x07)
[ ff 15 b1 5b f5 ff eb:00 00 00 00 00 00 00 ]
fffffa6001154019-fffffa600115402b 19 bytes - Ntfs!NtfsCommonClose+b52 (+0x08)
[ 48 83 c4 48 5d 5b c3 55:00 00 00 00 00 00 00 00 ]
fffffa600115402f-fffffa600115403b 13 bytes - Ntfs!NtfsFsdClose+7a0 (+0x16)
[ 48 8b d1 48 8b 4d 48 e8:00 00 00 00 00 00 00 00 ]
fffffa600115403d-fffffa6001154052 22 bytes - Ntfs!NtfsFsdClose+7ae (+0x0e)
[ 48 83 c4 40 5d c3 90 55:00 00 00 00 00 00 00 00 ]
fffffa6001154056-fffffa600115405b 6 bytes - Ntfs!NtfsFsdDispatchSwitch+333 (+0x19)
[ e8 95 0c f2 ff eb:00 00 00 00 00 00 ]
fffffa600115405d-fffffa6001154083 39 bytes - Ntfs!NtfsFsdDispatchSwitch+33a (+0x07)
[ 48 83 c4 30 5d c3 90 53:00 00 00 00 00 00 00 00 ]
fffffa6001154085-fffffa60011540ad 41 bytes - Ntfs!NtfsCopyReadA+3b2 (+0x28)
[ 48 83 c4 48 5d 5b c3 55:00 00 00 00 00 00 00 00 ]
fffffa60011540af-fffffa60011540c3 21 bytes - Ntfs!NtfsCopyWriteA+4a4 (+0x2a)
[ 48 83 c4 48 41 5d 5d c3:00 00 00 00 00 00 00 00 ]
fffffa60011540c5-fffffa60011540ce 10 bytes - Ntfs!NtfsCommonQueryInformation+c7e (+0x16)
[ 74 15 48 8b 55 68 48 8b:00 00 00 00 00 00 00 00 ]
fffffa60011540d2-fffffa60011540df 14 bytes - Ntfs!NtfsCommonQueryInformation+c8b (+0x0d)
[ 48 8b cb e8 46 55 f1 ff:00 00 00 00 00 00 00 00 ]
fffffa60011540e3-fffffa60011540e5 3 bytes - Ntfs!NtfsCommonQueryInformation+c9c (+0x11)
[ 83 7d 60:00 00 00 ]
fffffa60011540e7-fffffa60011540f9 19 bytes - Ntfs!NtfsCommonQueryInformation+ca0 (+0x04)
[ 74 0e 45 33 c0 33 d2 48:00 00 00 00 00 00 00 00 ]
fffffa60011540fb-fffffa600115410b 17 bytes - Ntfs!NtfsCommonQueryInformation+cb4 (+0x14)
[ 74 0c 48 8b 55 50 48 8b:00 00 00 00 00 00 00 00 ]
fffffa600115410d-fffffa6001154117 11 bytes - Ntfs!NtfsCommonQueryInformation+cc6 (+0x12)
[ 74 13 48 8b 4d 48 48 81:00 00 00 00 00 00 00 00 ]
fffffa600115411a-fffffa6001154120 7 bytes - Ntfs!NtfsCommonQueryInformation+cd3 (+0x0d)
[ ff 15 a8 5a f5 ff eb:00 00 00 00 00 00 00 ]
fffffa6001154122-fffffa6001154149 40 bytes - Ntfs!NtfsCommonQueryInformation+cdb (+0x08)
[ 48 83 c4 48 5d 5b c3 90:00 00 00 00 00 00 00 00 ]
fffffa600115414d-fffffa6001154151 5 bytes - Ntfs!NtfsQueryDirectory+1cc2 (+0x2b)
[ eb 02 33 c0 eb:00 00 00 00 00 ]
fffffa6001154153-fffffa6001154169 23 bytes - Ntfs!NtfsQueryDirectory+1cc8 (+0x06)
[ 48 83 c4 50 5d c3 90 90:00 00 00 00 00 00 00 00 ]
fffffa600115416b-fffffa6001154171 7 bytes - Ntfs!NtfsQueryDirectory+1ce0 (+0x18)
[ 74 16 48 8b 9d 48 01:00 00 00 00 00 00 00 ]
fffffa6001154174-fffffa6001154178 5 bytes - Ntfs!NtfsQueryDirectory+1ce9 (+0x09)
[ 48 8d 8b 10 06:00 00 00 00 00 ]
fffffa600115417b-fffffa6001154187 13 bytes - Ntfs!NtfsQueryDirectory+1cf0 (+0x07)
[ ff 15 47 5a f5 ff eb 07:00 00 00 00 00 00 00 00 ]
fffffa600115418a-fffffa600115418e 5 bytes - Ntfs!NtfsQueryDirectory+1cff (+0x0f)
[ 48 8d 95 80 01:00 00 00 00 00 ]
fffffa6001154191-fffffa6001154195 5 bytes - Ntfs!NtfsQueryDirectory+1d06 (+0x07)
[ 48 8b bd 40 01:00 00 00 00 00 ]
fffffa6001154198-fffffa60011541a3 12 bytes - Ntfs!NtfsQueryDirectory+1d0d (+0x07)
[ 48 8b cf e8 d0 5d ff ff:00 00 00 00 00 00 00 00 ]
fffffa60011541a7-fffffa60011541b0 10 bytes - Ntfs!NtfsQueryDirectory+1d1c (+0x0f)
[ 48 85 f6 74 29 48 8d 8b:00 00 00 00 00 00 00 00 ]
fffffa60011541b3-fffffa60011541c1 15 bytes - Ntfs!NtfsQueryDirectory+1d28 (+0x0c)
[ ff 15 ef 59 f5 ff 83 46:00 00 00 00 00 00 00 00 ]
fffffa60011541c4-fffffa60011541d7 20 bytes - Ntfs!NtfsQueryDirectory+1d39 (+0x11)
[ ff 15 be 59 f5 ff 48 8b:00 00 00 00 00 00 00 00 ]
fffffa60011541d9-fffffa60011541df 7 bytes - Ntfs!NtfsQueryDirectory+1d4e (+0x15)
[ 74 15 48 8b 9d 38 01:00 00 00 00 00 00 00 ]
fffffa60011541e2-fffffa60011541f4 19 bytes - Ntfs!NtfsQueryDirectory+1d57 (+0x09)
[ 48 8b 53 70 48 8b cf e8:00 00 00 00 00 00 00 00 ]
fffffa60011541f7-fffffa60011541fb 5 bytes - Ntfs!NtfsQueryDirectory+1d6c (+0x15)
[ 48 8b b5 78 01:00 00 00 00 00 ]
fffffa60011541fe-fffffa6001154207 10 bytes - Ntfs!NtfsQueryDirectory+1d73 (+0x07)
[ 48 8b d6 48 8b cf e8 a7:00 00 00 00 00 00 00 00 ]
fffffa6001154209-fffffa600115420b 3 bytes - Ntfs!NtfsQueryDirectory+1d7e (+0x0b)
[ 83 bd d0:00 00 00 ]
fffffa6001154210-fffffa6001154216 7 bytes - Ntfs!NtfsQueryDirectory+1d85 (+0x07)
[ 74 16 48 8b 93 b0 01:00 00 00 00 00 00 00 ]
fffffa6001154219-fffffa600115422a 18 bytes - Ntfs!NtfsQueryDirectory+1d8e (+0x09)
[ 45 33 c0 48 8b 52 40 48:00 00 00 00 00 00 00 00 ]
fffffa600115422c-fffffa6001154237 12 bytes - Ntfs!NtfsQueryDirectory+1da1 (+0x13)
[ 74 0b 48 8b d6 48 8b cb:00 00 00 00 00 00 00 00 ]
fffffa6001154239-fffffa600115423c 4 bytes - Ntfs!NtfsQueryDirectory+1dae (+0x0d)
[ 48 8b 8d f0:00 00 00 00 ]
fffffa6001154240-fffffa6001154250 17 bytes - Ntfs!NtfsQueryDirectory+1db5 (+0x07)
[ 48 85 c9 74 08 33 d2 ff:00 00 00 00 00 00 00 00 ]
fffffa6001154254-fffffa6001154261 14 bytes - Ntfs!NtfsQueryDirectory+1dc9 (+0x14)
[ 48 85 c9 74 0a 33 d2 ff:00 00 00 00 00 00 00 00 ]
fffffa6001154263-fffffa6001154276 20 bytes - Ntfs!NtfsQueryDirectory+1dd8 (+0x0f)
[ 48 83 c4 58 5f 5e 5d 5b:00 00 00 00 00 00 00 00 ]
fffffa6001154278-fffffa600115427d 6 bytes - Ntfs!NtfsContinueIndexEnumeration+3bd (+0x15)
[ 74 23 48 8b 85 c0:00 00 00 00 00 00 ]
fffffa6001154281-fffffa6001154285 5 bytes - Ntfs!NtfsContinueIndexEnumeration+3c6 (+0x09)
[ 48 8b 88 b0 01:00 00 00 00 00 ]
fffffa6001154288-fffffa600115428f 8 bytes - Ntfs!NtfsContinueIndexEnumeration+3cd (+0x07)
[ 48 8b 49 40 48 8b 89 88:00 00 00 00 00 00 00 00 ]
fffffa6001154293-fffffa600115429b 9 bytes - Ntfs!NtfsContinueIndexEnumeration+3d8 (+0x0b)
[ ff 15 2f 59 f5 ff c6 45:00 00 00 00 00 00 00 00 ]
fffffa600115429d-fffffa600115429f 3 bytes - Ntfs!NtfsContinueIndexEnumeration+3e2 (+0x0a)
[ 80 7d 60:00 00 00 ]
fffffa60011542a1-fffffa60011542a6 6 bytes - Ntfs!NtfsContinueIndexEnumeration+3e6 (+0x04)
[ 75 1b 48 8b 85 b8:00 00 00 00 00 00 ]
fffffa60011542aa-fffffa60011542ad 4 bytes - Ntfs!NtfsContinueIndexEnumeration+3ef (+0x09)
[ 48 8b 88 90:00 00 00 00 ]
fffffa60011542b1-fffffa60011542b9 9 bytes - Ntfs!NtfsContinueIndexEnumeration+3f6 (+0x07)
[ 48 85 c9 74 08 66 c7 41:00 00 00 00 00 00 00 00 ]
fffffa60011542bc - Ntfs!NtfsContinueIndexEnumeration+401 (+0x0b)
[ eb:00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
3622 errors : !Ntfs (fffffa6001154000-fffffa6001154fff)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE_4096

STACK_COMMAND: .cxr 0xfffffa600d3aa2a0 ; kb

FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096

BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096

Followup: memory_corruption
---------

The error message states that there was memory corruption due to a memory access violation - and that it was caused by the NTFS file system on your hard drive.

So, I'd first run Startup Repair ( http://www.bleepingcomputer.com/tutorials/repair-windows-with-windows-startup-repair/ )
Then I'd run the Windows Memory diagnostic ( http://www.bleepingcomputer.com/tutorials/using-vista-windows-memory-diagnostics-tool/ )

Let us know the details of the Startup Repair (there'll be a link for details once it's run) and the result of the memory diagnostic and we can move on from there.

Thank you for the quick response.

I do not have a vista DVD. My laptop is an acer & did not ship with any DVDs.
All I have are restore DVDs I created. Is there some other way of running it?

Try the files at this link: http://www.bleepingcomputer.com/blogs/usas...?showentry=1261
Also, you may be able to access Startup Repair by rapidly tapping the F8 key just before the Windows Splash Screen shows up. At the top of the list (above the Safe Mode options) should be an option to "Repair my computer" - select that.

thank you again. I will try F8 and see if the repair option is there, if not I will try the link you provided & report back.

I ran start up repair & it came back with the message "start up repair did not detect any problems"

I guess I will leave my computer running all night tonight & see if it crashes again.