New
#11
The NTFS_FILE_SYSTEM bug check has a value of 0x00000024. This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.
Crash occurred on the NtfsCreateFcb function. Driver create FCB when a byte stream is being opened for the first time and no other FCB representing this byte stream currently exists in system memory. This structure is retained as long as any NT components maintains a reference for it (some field in FCB structure). (source: FCB Details — OSR)Code:Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\mrpep\AppData\Local\Temp\Temp1_PC-Tue_01_14_2020__44025_60.zip\010820-25022-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS 7601.24384.amd64fre.win7sp1_ldr_escrow.190220-1800 Machine Name: Kernel base = 0xfffff800`02819000 PsLoadedModuleList = 0xfffff800`02a52c90 Debug session time: Wed Jan 8 10:43:56.624 2020 (UTC + 1:00) System Uptime: 0 days 0:03:21.153 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ..... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff800`028acba0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff880`06c26790=0000000000000024 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff88006c27748 Arg3: fffff88006c26fb0 Arg4: fffff880012c6dfe Debugging Details: ------------------ fffff800029fb0e8: Unable to get Flags value from nt!KdVersionBlock GetUlongPtrFromAddress: unable to read from fffff80002ab6300 KEY_VALUES_STRING: 1 Key : AV.Fault Value: Read Key : Analysis.CPU.Sec Value: 1 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOP-QO9C72C Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 1 Key : Analysis.Memory.CommitPeak.Mb Value: 62 Key : Analysis.System Value: CreateObject ADDITIONAL_XML: 1 BUGCHECK_CODE: 24 BUGCHECK_P1: 1904fb BUGCHECK_P2: fffff88006c27748 BUGCHECK_P3: fffff88006c26fb0 BUGCHECK_P4: fffff880012c6dfe EXCEPTION_RECORD: fffff88006c27748 -- (.exr 0xfffff88006c27748) ExceptionAddress: fffff880012c6dfe (Ntfs!NtfsCreateFcb+0x000000000000008e) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff88006c26fb0 -- (.cxr 0xfffff88006c26fb0) rax=0000000000000000 rbx=0000000000000000 rcx=0001000000011283 rdx=0000000000011283 rsi=fffff8a000229000 rdi=fffff88006c27afe rip=fffff880012c6dfe rsp=fffff88006c27980 rbp=fffffa80036ecb60 r8=0000000000011286 r9=0000ffffffffffff r10=0000000000000002 r11=fffff98007ae1800 r12=0000000000000000 r13=fffffa80044c3180 r14=fffffa80044c3180 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 Ntfs!NtfsCreateFcb+0x8e: fffff880`012c6dfe 448827 mov byte ptr [rdi],r12b ds:002b:fffff880`06c27afe=00 Resetting default scope CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: chrome.exe READ_ADDRESS: fffff800029fb0e8: Unable to get Flags value from nt!KdVersionBlock fffff800029fb0e8: Unable to get Flags value from nt!KdVersionBlock fffff800029fb0e8: Unable to get Flags value from nt!KdVersionBlock Unable to get MmSystemRangeStart GetUlongPtrFromAddress: unable to read from fffff80002ab62f0 GetUlongPtrFromAddress: unable to read from fffff80002ab64a8 ffffffffffffffff ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja w 0x%p odwo a a si do pami ci pod adresem 0x%p. Pami nie mo e by %s. EXCEPTION_CODE_STR: c0000005 EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff EXCEPTION_STR: 0xc0000005 STACK_TEXT: fffff880`06c27980 fffff880`012d3563 : fffffa80`06cc8660 fffffa80`00000003 fffff8a0`00229000 00090000`00011286 : Ntfs!NtfsCreateFcb+0x8e fffff880`06c27a60 fffff880`012bdc61 : 00000000`00000000 fffffa80`036ecb60 fffff8a0`028fced0 fffff880`06a5d470 : Ntfs!NtfsCreateNewFile+0x493 fffff880`06c27d90 fffff880`012274cd : fffffa80`06cc8660 fffffa80`036ecb60 fffff880`06a5d470 fffffa80`06f43000 : Ntfs!NtfsCommonCreate+0x1365 fffff880`06c27f30 fffff800`028afed7 : fffff880`06a5d3e0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d fffff880`06c27f60 fffff800`028afe98 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27 fffff880`06a5d2a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue SYMBOL_NAME: Ntfs!NtfsCreateFcb+8e MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys IMAGE_VERSION: 6.1.7601.23932 STACK_COMMAND: .cxr 0xfffff88006c26fb0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCreateFcb+8e OS_VERSION: 7.1.7601.24384 BUILDLAB_STR: win7sp1_ldr_escrow OSPLATFORM_TYPE: x64 OSNAME: Windows 7 FAILURE_ID_HASH: {be11a449-104b-d0d4-a9d5-cfd4b21e684b} Followup: MachineOwner ---------
The MEMORY_MANAGEMENT bug check has a value of 0x0000001A. This indicates that a severe memory management error occurred.
1st parameter = 0x41790 - A page table page has been corrupted. On a 64 bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs.
1st parameter = 0x403 - The page table and PFNs are out of sync . This is probably a hardware error, especially if parameters 3 & 4 differ by only a single bit.Code:Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\mrpep\AppData\Local\Temp\Temp1_PC-Tue_01_14_2020__44025_60.zip\010820-33867-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS 7601.24384.amd64fre.win7sp1_ldr_escrow.190220-1800 Machine Name: Kernel base = 0xfffff800`0285c000 PsLoadedModuleList = 0xfffff800`02a95c90 Debug session time: Wed Jan 8 10:37:40.118 2020 (UTC + 1:00) System Uptime: 0 days 0:09:32.523 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ..... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff800`028efba0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff880`037eb820=000000000000001a 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit OS, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs. Arg2: fffffa8001cd5f20 Arg3: 000000000000111f Arg4: 0000000000000000 Debugging Details: ------------------ fffff80002a3e0e8: Unable to get Flags value from nt!KdVersionBlock GetUlongPtrFromAddress: unable to read from fffff80002af9300 KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 1 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOP-QO9C72C Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 1 Key : Analysis.Memory.CommitPeak.Mb Value: 56 Key : Analysis.System Value: CreateObject ADDITIONAL_XML: 1 BUGCHECK_CODE: 1a BUGCHECK_P1: 41790 BUGCHECK_P2: fffffa8001cd5f20 BUGCHECK_P3: 111f BUGCHECK_P4: 0 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: chrome.exe STACK_TEXT: fffff880`037eb818 fffff800`029b3dfd : 00000000`0000001a 00000000`00041790 fffffa80`01cd5f20 00000000`0000111f : nt!KeBugCheckEx fffff880`037eb820 fffff800`029d13e5 : fffff8a0`00000000 00000000`24ef8fff 00000000`00000000 ead00000`87c38125 : nt!MiDeleteVirtualAddresses+0x93d fffff880`037eb990 fffff800`02b48971 : fffffa80`03a04060 00000000`00000000 fffffa80`0682b8c0 00000000`24ef8fff : nt!MiRemoveMappedView+0x485 fffff880`037ebad0 fffff800`02b3906b : 00000000`00000000 00000000`23a50000 fffffa80`00000001 00000000`00000001 : nt!MiUnmapViewOfSection+0x1b1 fffff880`037ebb90 fffff800`028fdbd3 : 00000000`00000001 00000000`22a50670 fffffa80`03a04060 00000000`00fb6190 : nt!NtUnmapViewOfSection+0x5f fffff880`037ebbe0 00000000`777b9b2a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0df6e7d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777b9b2a SYMBOL_NAME: nt!MiDeleteVirtualAddresses+93d MODULE_NAME: nt IMAGE_VERSION: 6.1.7601.24384 STACK_COMMAND: .thread ; .cxr ; kb IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x1a_41790_nt!MiDeleteVirtualAddresses+93d OS_VERSION: 7.1.7601.24384 BUILDLAB_STR: win7sp1_ldr_escrow OSPLATFORM_TYPE: x64 OSNAME: Windows 7 FAILURE_ID_HASH: {f4a94a0f-7c3c-4cbd-b72c-ee4a493af7de} Followup: MachineOwner ---------
The SYSTEM_SERVICE_EXCEPTION bug check has a value of 0x0000003B. This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.Code:Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\mrpep\AppData\Local\Temp\Temp1_PC-Tue_01_14_2020__44025_60.zip\010820-46067-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS 7601.24384.amd64fre.win7sp1_ldr_escrow.190220-1800 Machine Name: Kernel base = 0xfffff800`0280f000 PsLoadedModuleList = 0xfffff800`02a48c90 Debug session time: Wed Jan 8 11:45:41.020 2020 (UTC + 1:00) System Uptime: 0 days 1:01:08.550 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ..... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff800`028a2ba0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff880`0775d1c0=000000000000001a 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000000403, The subtype of the bugcheck. Arg2: fffff680000525c0 Arg3: 8f7000000c33c96f Arg4: fffff680008525c0 Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for dxgmms1.sys fffff800029f10e8: Unable to get Flags value from nt!KdVersionBlock GetUlongPtrFromAddress: unable to read from fffff80002aac300 KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 1 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOP-QO9C72C Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 1 Key : Analysis.Memory.CommitPeak.Mb Value: 59 Key : Analysis.System Value: CreateObject ADDITIONAL_XML: 1 BUGCHECK_CODE: 1a BUGCHECK_P1: 403 BUGCHECK_P2: fffff680000525c0 BUGCHECK_P3: 8f7000000c33c96f BUGCHECK_P4: fffff680008525c0 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: opera.exe STACK_TEXT: fffff880`0775d1b8 fffff800`0296037e : 00000000`0000001a 00000000`00000403 fffff680`000525c0 8f700000`0c33c96f : nt!KeBugCheckEx fffff880`0775d1c0 fffff800`02966b89 : fffff680`000525c0 fffff680`00052a78 fffffa80`07031060 00000000`04888000 : nt!MiDeletePteRun+0x8ee fffff880`0775d360 fffff800`0283dff4 : fffffa80`00000000 00000000`0a54ffff 00000000`00000000 98e00000`08613d6e : nt!MiDeleteVirtualAddresses+0x6c9 fffff880`0775d4d0 fffff800`028b0bd3 : ffffffff`ffffffff fffffa80`078e8440 fffffa80`06f72290 00000000`00008000 : nt!NtFreeVirtualMemory+0xb34 fffff880`0775d5c0 fffff800`028a63b0 : fffff880`05392682 fffff8a0`0f583460 fffffa80`07031060 fffffa80`06f72290 : nt!KiSystemServiceCopyEnd+0x13 fffff880`0775d758 fffff880`05392682 : fffff8a0`0f583460 fffffa80`07031060 fffffa80`06f72290 fffff8a0`0f9d7880 : nt!KiServiceLinkage fffff880`0775d760 fffff8a0`0f583460 : fffffa80`07031060 fffffa80`06f72290 fffff8a0`0f9d7880 fffff8a0`0068d330 : dxgmms1+0x35682 fffff880`0775d768 fffffa80`07031060 : fffffa80`06f72290 fffff8a0`0f9d7880 fffff8a0`0068d330 fffff880`0537dce7 : 0xfffff8a0`0f583460 fffff880`0775d770 fffffa80`06f72290 : fffff8a0`0f9d7880 fffff8a0`0068d330 fffff880`0537dce7 fffffa80`06d28ef0 : 0xfffffa80`07031060 fffff880`0775d778 fffff8a0`0f9d7880 : fffff8a0`0068d330 fffff880`0537dce7 fffffa80`06d28ef0 fffff8a0`02c3fa00 : 0xfffffa80`06f72290 fffff880`0775d780 fffff8a0`0068d330 : fffff880`0537dce7 fffffa80`06d28ef0 fffff8a0`02c3fa00 00000000`00000001 : 0xfffff8a0`0f9d7880 fffff880`0775d788 fffff880`0537dce7 : fffffa80`06d28ef0 fffff8a0`02c3fa00 00000000`00000001 00000000`000007ff : 0xfffff8a0`0068d330 fffff880`0775d790 fffffa80`06d28ef0 : fffff8a0`02c3fa00 00000000`00000001 00000000`000007ff fffff8a0`02ec21c0 : dxgmms1+0x20ce7 fffff880`0775d798 fffff8a0`02c3fa00 : 00000000`00000001 00000000`000007ff fffff8a0`02ec21c0 00000000`000001c0 : 0xfffffa80`06d28ef0 fffff880`0775d7a0 00000000`00000001 : 00000000`000007ff fffff8a0`02ec21c0 00000000`000001c0 00000000`00000000 : 0xfffff8a0`02c3fa00 fffff880`0775d7a8 00000000`000007ff : fffff8a0`02ec21c0 00000000`000001c0 00000000`00000000 00000000`000007ff : 0x1 fffff880`0775d7b0 fffff8a0`02ec21c0 : 00000000`000001c0 00000000`00000000 00000000`000007ff 00000000`00000000 : 0x7ff fffff880`0775d7b8 00000000`000001c0 : 00000000`00000000 00000000`000007ff 00000000`00000000 00000000`00000001 : 0xfffff8a0`02ec21c0 fffff880`0775d7c0 00000000`00000000 : 00000000`000007ff 00000000`00000000 00000000`00000001 00000000`00000001 : 0x1c0 SYMBOL_NAME: dxgmms1+35682 MODULE_NAME: dxgmms1 IMAGE_NAME: dxgmms1.sys STACK_COMMAND: .thread ; .cxr ; kb FAILURE_BUCKET_ID: X64_0x1a_403_dxgmms1+35682 OS_VERSION: 7.1.7601.24384 BUILDLAB_STR: win7sp1_ldr_escrow OSPLATFORM_TYPE: x64 OSNAME: Windows 7 FAILURE_ID_HASH: {55dcb15c-e542-5f1d-8641-31426b64de01} Followup: MachineOwner ---------
1st parameter = 0xc00005 - A memory access violation occurred. (Parameter 4 of the bug check is the address that the driver attempted to access.)
Crash occurred on the function KxWaitForLockOwnerShip. So there are problems with achieving interrupt spin lockCode:Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\mrpep\AppData\Local\Temp\Temp1_PC-Tue_01_14_2020__44025_60.zip\011420-27939-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS 7601.24540.amd64fre.win7sp1_ldr_escrow.191127-1706 Machine Name: Kernel base = 0xfffff800`02a07000 PsLoadedModuleList = 0xfffff800`02c40c90 Debug session time: Tue Jan 14 09:14:44.649 2020 (UTC + 1:00) System Uptime: 0 days 0:07:48.179 Loading Kernel Symbols ............................................................... ................................................................ .......................... Loading User Symbols Loading unloaded module list ...... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff800`02a9aea0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff880`05f94150=000000000000003b 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80002a42202, Address of the instruction which caused the bugcheck Arg3: fffff88005f94a10, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ fffff80002be90e8: Unable to get Flags value from nt!KdVersionBlock GetUlongPtrFromAddress: unable to read from fffff80002ca4300 KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 1 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOP-QO9C72C Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 1 Key : Analysis.Memory.CommitPeak.Mb Value: 56 Key : Analysis.System Value: CreateObject ADDITIONAL_XML: 1 BUGCHECK_CODE: 3b BUGCHECK_P1: c0000005 BUGCHECK_P2: fffff80002a42202 BUGCHECK_P3: fffff88005f94a10 BUGCHECK_P4: 0 CONTEXT: fffff88005f94a10 -- (.cxr 0xfffff88005f94a10) rax=0000000000000000 rbx=fffffa80025a29e0 rcx=fffff88005f954a0 rdx=1100000000000000 rsi=00000000000c8b8a rdi=fffff88005f954a0 rip=fffff80002a42202 rsp=fffff88005f953e0 rbp=fffff88005f95480 r8=0000000000000000 r9=0000000000000000 r10=fffffa8003480bb0 r11=fffff80002ca7a00 r12=0000000000000001 r13=000000000007bc00 r14=0000000000000190 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 nt!KxWaitForLockOwnerShip+0x12: fffff800`02a42202 48890a mov qword ptr [rdx],rcx ds:002b:11000000`00000000=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: explorer.exe STACK_TEXT: fffff880`05f953e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxWaitForLockOwnerShip+0x12 SYMBOL_NAME: nt!KxWaitForLockOwnerShip+12 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe IMAGE_VERSION: 6.1.7601.24540 STACK_COMMAND: .cxr 0xfffff88005f94a10 ; kb FAILURE_BUCKET_ID: X64_0x3B_c0000005_nt!KxWaitForLockOwnerShip+12 OS_VERSION: 7.1.7601.24540 BUILDLAB_STR: win7sp1_ldr_escrow OSPLATFORM_TYPE: x64 OSNAME: Windows 7 FAILURE_ID_HASH: {de0c025e-d6fc-b77a-e5bb-cda39d615676} Followup: MachineOwner ---------
Considering the total randomness of bugchecks, I am inclined to the thesis that the reason is incorrectly working RAM memory, therefore test it with a memtest, if you overclocked it, restore default settings, disable XMP profiles in the BIOS, change RAM timings etc.
That's when the only thing that's safe is to test the RAM or replace it with another one
Ok I set the bios to default settings. Restarted and it seemed like iTunes was working fine at first. Then my pc froze and I got this loud buzzing noise (I was wearing headphones). I had to restart to stop it. The problem is always different,sometimes the computer freezes with a loud buzzing sound, other times It freezes with horizontal lines across the screen and automatically restarts. Occasionally I get a BSOD