Event ID: 5032 or 5038

I am using Windows Vista Ultimate x64 and the setup is pretty stable.
However, randomly, my computer will reboot for no appearent reason. Upon
Vista starting back up, I usually go to my Event Viewer. EVERY SINGLE
INSTANCE, after the random reboot, there will be an error posted. It is
Event ID: 5032 or Event ID: 5038 (or both). I have googled my heart out
trying to figure this one out. I have been on numerous boards and it seems
no one can pinpoint the problem. Here is a list of my setup:

Computer: Custom Built
Processor: Intel QX6700 Quadcore
Memory: Corsair Dominator PC2 8500C5D Ram @ 1066mhz
Motherboard: XFX MB-N680-iLT9 (680i LT)
Power Supply: Enermax Galaxy 1000 watt Gamers Edition
Video Card: (2) nVidia 8800GTS cards running in SLi

The computer is connected via a LAN Cable (not wireless).
My internet service provider is Charter Cable. It is a 10Mbps connection.
My cable modem is a Ambit SpeedStream U10C018.
My router is a Linksys WRT54G v4 (wireless capability)

I have NO antivirus installed at the moment.
No software firewall is installed.
I believe the Linksys has a built in firewall.

All of my Vista updates are current. I have not installed my 3rd party
programs but I have installed a few:
Winrar, TeamSpeak RC2, Everest Ultimate, CPU-Z 1.39, F.E.A.R. Combat,
3dmark06, Limewire Pro 4.12.11.. ALL of these programs are listed as
compatible with Vista x64.


Under Event ID: 5032, this is what the message says:

Windows Firewall was unable to notify the user that it blocked an
application from accepting incoming connections on the network.

Error Code: 2

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing"
Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>5032</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12292</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2007-04-24T15:21:14.942Z" />
<EventRecordID>3414</EventRecordID>
<Correlation />
<Execution ProcessID="620" ThreadID="976" />
<Channel>Security</Channel>
<Computer>WindowsUser</Computer>
<Security />
</System>
- <EventData>
<Data Name="ErrorCode">2</Data>
</EventData>
</Event>


Under Event ID: 5038, this is what it says:

Code integrity determined that the image hash of a file is not valid. The
file could be corrupt due to unauthorized modification or the invalid hash
could indicate a potential disk device error.

File Name: \Device\HarddiskVolume1\Windows\System32\nvd3dumx.dll

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing"
Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>5038</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2007-04-24T03:26:33.113Z" />
<EventRecordID>3384</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="72" />
<Channel>Security</Channel>
<Computer>WindowsUser</Computer>
<Security />
</System>
- <EventData>
<Data
Name="param1">\Device\HarddiskVolume1\Windows\System32\nvd3dumx.dll</Data>
</EventData>
</Event>

This sounds like an nVidia driver issue. Are you using a built-in driver or
one you downloaded from the nVidia web site? I would try uninstalling the
driver and letting Windows detect it again and see if you can get a better
match.
---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"officermartinez" wrote:

> I am using Windows Vista Ultimate x64 and the setup is pretty stable.
> However, randomly, my computer will reboot for no appearent reason. Upon
> Vista starting back up, I usually go to my Event Viewer. EVERY SINGLE
> INSTANCE, after the random reboot, there will be an error posted. It is
> Event ID: 5032 or Event ID: 5038 (or both). I have googled my heart out
> trying to figure this one out. I have been on numerous boards and it seems
> no one can pinpoint the problem. Here is a list of my setup:
>
> Computer: Custom Built
> Processor: Intel QX6700 Quadcore
> Memory: Corsair Dominator PC2 8500C5D Ram @ 1066mhz
> Motherboard: XFX MB-N680-iLT9 (680i LT)
> Power Supply: Enermax Galaxy 1000 watt Gamers Edition
> Video Card: (2) nVidia 8800GTS cards running in SLi
>
> The computer is connected via a LAN Cable (not wireless).
> My internet service provider is Charter Cable. It is a 10Mbps connection.
> My cable modem is a Ambit SpeedStream U10C018.
> My router is a Linksys WRT54G v4 (wireless capability)
>
> I have NO antivirus installed at the moment.
> No software firewall is installed.
> I believe the Linksys has a built in firewall.
>
> All of my Vista updates are current. I have not installed my 3rd party
> programs but I have installed a few:
> Winrar, TeamSpeak RC2, Everest Ultimate, CPU-Z 1.39, F.E.A.R. Combat,
> 3dmark06, Limewire Pro 4.12.11.. ALL of these programs are listed as
> compatible with Vista x64.
>
>
> Under Event ID: 5032, this is what the message says:
>
> Windows Firewall was unable to notify the user that it blocked an
> application from accepting incoming connections on the network.
>
> Error Code: 2
>
> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> - <System>
> <Provider Name="Microsoft-Windows-Security-Auditing"
> Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
> <EventID>5032</EventID>
> <Version>0</Version>
> <Level>0</Level>
> <Task>12292</Task>
> <Opcode>0</Opcode>
> <Keywords>0x8010000000000000</Keywords>
> <TimeCreated SystemTime="2007-04-24T15:21:14.942Z" />
> <EventRecordID>3414</EventRecordID>
> <Correlation />
> <Execution ProcessID="620" ThreadID="976" />
> <Channel>Security</Channel>
> <Computer>WindowsUser</Computer>
> <Security />
> </System>
> - <EventData>
> <Data Name="ErrorCode">2</Data>
> </EventData>
> </Event>
>
>
> Under Event ID: 5038, this is what it says:
>
> Code integrity determined that the image hash of a file is not valid. The
> file could be corrupt due to unauthorized modification or the invalid hash
> could indicate a potential disk device error.
>
> File Name: \Device\HarddiskVolume1\Windows\System32\nvd3dumx.dll
>
> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> - <System>
> <Provider Name="Microsoft-Windows-Security-Auditing"
> Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
> <EventID>5038</EventID>
> <Version>0</Version>
> <Level>0</Level>
> <Task>12290</Task>
> <Opcode>0</Opcode>
> <Keywords>0x8010000000000000</Keywords>
> <TimeCreated SystemTime="2007-04-24T03:26:33.113Z" />
> <EventRecordID>3384</EventRecordID>
> <Correlation />
> <Execution ProcessID="4" ThreadID="72" />
> <Channel>Security</Channel>
> <Computer>WindowsUser</Computer>
> <Security />
> </System>
> - <EventData>
> <Data
> Name="param1">\Device\HarddiskVolume1\Windows\System32\nvd3dumx.dll</Data>
> </EventData>
> </Event>
>
>

I am leaning more towards a network controller issue. I have the nvidia
nforce networking controller installed. Do you think that could be the
issue? I seriously doubt that my video drivers are the cause of my issues.

I'm leaning toward video because nvd3dumx.dll is the GeForce video driver.
Why do you think it is a network controller issue?
---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"officermartinez" wrote:

> I am leaning more towards a network controller issue. I have the nvidia
> nforce networking controller installed. Do you think that could be the
> issue? I seriously doubt that my video drivers are the cause of my issues.
>
>

I am only saying this because the Event View always says:
Windows Firewall was unable to notify the user that it blocked an
application from accepting incoming connections on the network. Error Code:
2

That leads me to believe that the network is trying to communicate with my
computer, but the Vista firewall won't allow it to. To me, that indicates a
network issue, not a display issue. My display works fine. It seems that
when the Vista firewall catches my computer communicating with the network,
it doesn't like it and will just shut it down in order to prevent the
communication.



"Jesper" <Jesper@discussions.microsoft.com> wrote in message
news:6B475C60-FEDA-4B6A-9F28-142186E4B4B1@microsoft.com...
> I'm leaning toward video because nvd3dumx.dll is the GeForce video driver.
> Why do you think it is a network controller issue?
> ---
>>

It's perfectly logical that nVidia's video drivers listen on the network
though. ;-)

Seriously, it could happen, and it can't notify the user that it happens
because the user context associated with drivers is SYSTEM. SYSTEM does not
have any way to get notified of that issue.

I'm not sure whether the network communication is the culprit, but even if
it is, the fault still lies with that video driver. If it needs to listen on
a network interface it needs to open the port for that at install time. Why
it would need to do so is a whole different matter that I can't answer. I
still say try upgrading the video driver.
---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"officermartinez" wrote:

> I am only saying this because the Event View always says:
> Windows Firewall was unable to notify the user that it blocked an
> application from accepting incoming connections on the network. Error Code:
> 2
>
> That leads me to believe that the network is trying to communicate with my
> computer, but the Vista firewall won't allow it to. To me, that indicates a
> network issue, not a display issue. My display works fine. It seems that
> when the Vista firewall catches my computer communicating with the network,
> it doesn't like it and will just shut it down in order to prevent the
> communication.
>
>
>
> "Jesper" <Jesper@discussions.microsoft.com> wrote in message
> news:6B475C60-FEDA-4B6A-9F28-142186E4B4B1@microsoft.com...
> > I'm leaning toward video because nvd3dumx.dll is the GeForce video driver.
> > Why do you think it is a network controller issue?
> > ---
> >>
>
>

OK.. That sounds pretty logical to me also. But I have tried the default
100.65 drivers.. 101.70 drivers.. and the 158.18 drivers.. The 158's are the
latest release from nVidia.. But this issue occurred with ALL driver
versions. Is there a way I can open the port to let that driver communicate,
so I won't get the random boot?

Of course you can open the port. You just need to find out what port it
needs. Since it is a driver, you can't open the firewall to the app. Did the
event log tell you which port it was trying to open?

FWIW, I have an nVidia card too in one of my machines, and I have not seen
this behavior. I can't recall which driver version I have though, and I don't
have the SLI cards.

---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"officermartinez" wrote:

> OK.. That sounds pretty logical to me also. But I have tried the default
> 100.65 drivers.. 101.70 drivers.. and the 158.18 drivers.. The 158's are the
> latest release from nVidia.. But this issue occurred with ALL driver
> versions. Is there a way I can open the port to let that driver communicate,
> so I won't get the random boot?
>
>

The event log doesn't show the port information. Hmmmmm.. I had another
random boot today. I was on www.msn.com when it randomly rebooted. Like
every instance before, I went to the Event Viewer, and saw that I had an
Audit Error again.. 5032 and 5038. Grrrrrrrrrrrr. This is very annoying!

Can you look at the firewall log? Go into the Windows Firewall with Advanced
Security admin tool. Click the Windows Firewall Properties and configure the
firewall log. After the problem happens again you can look at the log in the
Monitoring area.


---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"officermartinez" wrote:

> The event log doesn't show the port information. Hmmmmm.. I had another
> random boot today. I was on www.msn.com when it randomly rebooted. Like
> every instance before, I went to the Event Viewer, and saw that I had an
> Audit Error again.. 5032 and 5038. Grrrrrrrrrrrr. This is very annoying!
>
>