Random BSODs - no apparent causing-action (0a, c2, c5, d1)

writhziden · 26 Mar 2012

Problem Devices:

Code:

Microsoft Teredo Tunneling Adapter	ROOT\*TEREDO\0000	This device cannot start.

Security Software (just to verify it is installed and working properly; nothing needs to be done with it at this time):

Code:

msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	964	8	200	1380	27/03/2012 11:37 a.m.	3.0.8402.0	12.48 KB (12,784 bytes)	27/04/2011 4:21 p.m.
nissrv.exe	c:\program files\microsoft security client\antimalware\nissrv.exe	2800	8	200	1380	27/03/2012 11:37 a.m.	3.0.8402.0	281.52 KB (288,272 bytes)	27/04/2011 4:21 p.m.
msseces.exe	c:\program files\microsoft security client\msseces.exe	1496	8	200	1380	27/03/2012 11:37 a.m.	2.1.1116.0	1.37 MB (1,436,736 bytes)	15/06/2011 1:35 p.m.

Code:


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\Fluent\Mini Dumps 27-03\032712-7144-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0324c000 PsLoadedModuleList = 0xfffff800`03490650
Debug session time: Mon Mar 26 16:36:14.761 2012 (UTC - 6:00)
System Uptime: 0 days 1:40:59.932
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {50, 2, 0, fffff88005a8e895}

Unable to load image cmudaxp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for cmudaxp.sys
*** ERROR: Module load completed but symbols could not be loaded for cmudaxp.sys
Probably caused by : cmudaxp.sys ( cmudaxp+26895 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000050, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88005a8e895, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fa100
 0000000000000050 

CURRENT_IRQL:  2

FAULTING_IP: 
cmudaxp+26895
fffff880`05a8e895 ff5050          call    qword ptr [rax+50h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  consent.exe

TRAP_FRAME:  fffff80000ba24e0 -- (.trap 0xfffff80000ba24e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8006bfcf40
rdx=00000200030a1000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88005a8e895 rsp=fffff80000ba2670 rbp=fffffa8009631000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=fffff88005c688d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cmudaxp+0x26895:
fffff880`05a8e895 ff5050          call    qword ptr [rax+50h] ds:e5b0:00000000`00000050=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032c82e9 to fffff800032c8d40

STACK_TEXT:  
fffff800`00ba2398 fffff800`032c82e9 : 00000000`0000000a 00000000`00000050 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00ba23a0 fffff800`032c6f60 : fffffa80`079be5b0 00000000`00000003 00000000`00000001 fffffa80`06bf6ad8 : nt!KiBugCheckDispatch+0x69
fffff800`00ba24e0 fffff880`05a8e895 : fffffa80`079be5b0 fffff880`00e6d13e 00000000`00000000 fffffa80`00000001 : nt!KiPageFault+0x260
fffff800`00ba2670 fffffa80`079be5b0 : fffff880`00e6d13e 00000000`00000000 fffffa80`00000001 fffff880`06590000 : cmudaxp+0x26895
fffff800`00ba2678 fffff880`00e6d13e : 00000000`00000000 fffffa80`00000001 fffff880`06590000 fffff880`05a8e095 : 0xfffffa80`079be5b0
fffff800`00ba2680 00000000`00000000 : fffff880`06590000 fffff880`06590000 00000000`00000000 fffff880`05a69557 : Wdf01000!imp_WdfRequestCompleteWithInformation+0x1aa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cmudaxp+26895
fffff880`05a8e895 ff5050          call    qword ptr [rax+50h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  cmudaxp+26895

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cmudaxp

IMAGE_NAME:  cmudaxp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d78814f

FAILURE_BUCKET_ID:  X64_0xD1_cmudaxp+26895

BUCKET_ID:  X64_0xD1_cmudaxp+26895

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\Fluent\Mini Dumps 27-03\032612-67517-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03213000 PsLoadedModuleList = 0xfffff800`03457650
Debug session time: Sun Mar 25 02:20:21.229 2012 (UTC - 6:00)
System Uptime: 0 days 0:34:16.401
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, fffff80003296b8c}

Probably caused by : CLFS.SYS ( CLFS!CClfsContainer::WriteSector+3ac )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003296b8c, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c1100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeWaitForSingleObject+17c
fffff800`03296b8c 4c8938          mov     qword ptr [rax],r15

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800a99d0c0 -- (.trap 0xfffff8800a99d0c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8006beea88
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003296b8c rsp=fffff8800a99d250 rbp=0000000000000000
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff88003365180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeWaitForSingleObject+0x17c:
fffff800`03296b8c 4c8938          mov     qword ptr [rax],r15 ds:8000:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000328f2e9 to fffff8000328fd40

STACK_TEXT:  
fffff880`0a99cf78 fffff800`0328f2e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0a99cf80 fffff800`0328df60 : 00000103`00000402 00000000`00000001 fffffa80`09074230 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0a99d0c0 fffff800`03296b8c : 00000000`000000a0 73666c43`03cd2b60 00000103`00000000 fffffa80`090741f0 : nt!KiPageFault+0x260
fffff880`0a99d250 fffff880`00ccaf98 : 00000000`00000000 fffffa80`00000000 fffffa80`0428da00 00000000`00007a00 : nt!KeWaitForSingleObject+0x17c
fffff880`0a99d2f0 fffff880`00cc490b : 00000000`00007a00 fffffa80`06beea80 fffffa80`089a2ce0 fffff8a0`00be3000 : CLFS!CClfsContainer::WriteSector+0x3ac
fffff880`0a99d390 fffff880`00cc4642 : fffffa80`06c0c490 fffffa80`06c0c490 00000000`00000001 fffff8a0`00001a01 : CLFS!CClfsBaseFilePersisted::WriteMetadataBlock+0x24b
fffff880`0a99d420 fffff880`00ca8335 : fffffa80`06c0c490 00000000`00000001 00000000`00000000 00000000`00000000 : CLFS!CClfsBaseFilePersisted::FlushImage+0x3a
fffff880`0a99d460 fffff880`00cd52fd : 00000000`00000000 00000000`00000000 fffffa80`03cd2040 00000000`00000000 : CLFS!CClfsLogFcbPhysical::FlushMetadata+0xe1
fffff880`0a99d4b0 fffff880`00cd1d57 : fffffa80`06c19cc0 fffff8a0`00001a50 fffffa80`06568900 00000000`00000000 : CLFS!CClfsLogFcbVirtual::Cleanup+0x231
fffff880`0a99d550 fffff880`00ccec52 : fffffa80`06c19cc0 fffff880`0a99d960 fffffa80`03cd2040 00000000`00000000 : CLFS!CClfsLogCcb::Cleanup+0x147
fffff880`0a99d5a0 fffff880`00ce84be : fffffa80`03cb5bd0 fffffa80`03cb5bd0 00000000`00000001 fffffa80`06c18270 : CLFS!CClfsRequest::Cleanup+0x5e
fffff880`0a99d5f0 fffff880`00cc0a09 : fffffa80`03cb5bd0 00000000`00000000 fffffa80`06568920 00000000`00000000 : CLFS!ClfsDispatchIoRequest+0x32
fffff880`0a99d640 fffff800`0359677f : fffffa80`03cb5bd0 fffffa80`03cd2040 00000000`00000000 fffffa80`06c18270 : CLFS!CClfsDriver::LogIoDispatch+0x21
fffff880`0a99d670 fffff800`03585eb4 : 00000000`00000000 fffffa80`03cd2040 fffff880`00cba110 fffff880`00caab99 : nt!IopCloseFile+0x11f
fffff880`0a99d700 fffff800`03585c71 : fffffa80`03cd2040 fffffa80`00000001 fffff8a0`00001a50 00000000`00000002 : nt!ObpDecrementHandleCount+0xb4
fffff880`0a99d780 fffff800`03586234 : 00000000`0000022c fffffa80`03cd2040 fffff8a0`00001a50 00000000`0000022c : nt!ObpCloseHandleTableEntry+0xb1
fffff880`0a99d810 fffff800`0328efd3 : fffffa80`08b0b040 fffff880`0a99d8e0 fffff880`00cba110 fffff880`00cdb9d7 : nt!ObpCloseHandle+0x94
fffff880`0a99d860 fffff800`0328b570 : fffff880`00cef476 ffffffff`fffef800 00000000`00000000 fffff8a0`00bd9b10 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0a99d9f8 fffff880`00cef476 : ffffffff`fffef800 00000000`00000000 fffff8a0`00bd9b10 00000000`00000000 : nt!KiServiceLinkage
fffff880`0a99da00 fffff800`03516a52 : fffffa80`06c189a0 fffffa80`06c19800 00000000`00000000 00000000`00000000 : CLFS!ClfsCloseLogFileObject+0x7a
fffff880`0a99da40 fffff800`03388c69 : fffffa80`06c189a0 00000000`00000000 00000000`00000000 fffff800`00aa0000 : nt!TmpTmOffline+0xe6
fffff880`0a99da90 fffff800`0351b8b3 : fffffa80`06c189a0 fffffa80`066d3c40 00000000`00000000 00000000`00000000 : nt!TmpShutdownTransactionManager+0x9
fffff880`0a99dac0 fffff800`03359ea0 : fffff800`03404a10 fffff800`0342f260 00000000`00000001 ffffe02b`ba58d900 : nt!TmpNamespaceForEach+0x8f
fffff880`0a99db00 fffff800`034da250 : fffffa80`08d2bc50 fffff880`0197d010 00000000`00000001 00000000`00000001 : nt!TmShutdownSystem+0x60
fffff880`0a99db30 fffff800`03299471 : fffff800`034da100 fffff800`0342f201 fffff800`0342f200 00000000`00000000 : nt!PopGracefulShutdown+0x150
fffff880`0a99db70 fffff800`03529f7a : 00000000`02a923f4 fffffa80`08b0b040 00000000`00000080 fffffa80`03cd2040 : nt!ExpWorkerThread+0x111
fffff880`0a99dc00 fffff800`032809c6 : fffff880`009ea180 fffffa80`08b0b040 fffffa80`03ce8040 fffff880`01635384 : nt!PspSystemThreadStartup+0x5a
fffff880`0a99dc40 00000000`00000000 : fffff880`0a99e000 fffff880`0a998000 fffff880`0a99d040 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
CLFS!CClfsContainer::WriteSector+3ac
fffff880`00ccaf98 89442434        mov     dword ptr [rsp+34h],eax

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  CLFS!CClfsContainer::WriteSector+3ac

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CLFS

IMAGE_NAME:  CLFS.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc11d

FAILURE_BUCKET_ID:  X64_0xA_CLFS!CClfsContainer::WriteSector+3ac

BUCKET_ID:  X64_0xA_CLFS!CClfsContainer::WriteSector+3ac

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\Fluent\Mini Dumps 27-03\031812-9141-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0321a000 PsLoadedModuleList = 0xfffff800`0345e650
Debug session time: Sat Mar 17 15:16:05.005 2012 (UTC - 6:00)
System Uptime: 0 days 0:19:02.802
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880098d0d38, fffff880098d0590, fffff800032abecd}

Probably caused by : Ntfs.sys ( Ntfs!FindFirstIndexEntry+1fa )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880098d0d38
Arg3: fffff880098d0590
Arg4: fffff800032abecd

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880098d0d38 -- (.exr 0xfffff880098d0d38)
ExceptionAddress: fffff800032abecd (nt!CcGetVirtualAddress+0x000000000000003d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000098
Attempt to read from address 0000000000000098

CONTEXT:  fffff880098d0590 -- (.cxr 0xfffff880098d0590)
rax=0000000000000000 rbx=000000000000000e rcx=0000000000000000
rdx=0000000000000000 rsi=fffff880098d1258 rdi=0000000000000001
rip=fffff800032abecd rsp=fffff880098d0f70 rbp=0000000000000000
 r8=fffff880098d10c8  r9=fffff880098d10c0 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=fffff880098d1368
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!CcGetVirtualAddress+0x3d:
fffff800`032abecd 8b8198000000    mov     eax,dword ptr [rcx+98h] ds:002b:00000000`00000098=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000098

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c8100
 0000000000000098 

FOLLOWUP_IP: 
Ntfs!FindFirstIndexEntry+1fa
fffff880`014b4c85 84c0            test    al,al

FAULTING_IP: 
nt!CcGetVirtualAddress+3d
fffff800`032abecd 8b8198000000    mov     eax,dword ptr [rcx+98h]

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff80003592382 to fffff800032abecd

STACK_TEXT:  
fffff880`098d0f70 fffff800`03592382 : 00000000`00000000 00000000`00000000 fffff880`098d10c8 fffff880`098d10c0 : nt!CcGetVirtualAddress+0x3d
fffff880`098d1000 fffff880`014b4c85 : fffff880`098d16c0 fffff8a0`0082f730 fffff8a0`0082f730 fffff880`0000000e : nt!CcMapData+0xd2
fffff880`098d10c0 fffff880`0147cc6e : fffff8a0`0082f730 00000000`00000000 fffff880`098d1368 00000000`00000000 : Ntfs!FindFirstIndexEntry+0x1fa
fffff880`098d1150 fffff880`01498da5 : fffff880`098d16c0 fffff8a0`0082f730 fffff8a0`04423ea8 fffff880`00000000 : Ntfs!NtOfsAddRecords+0x9a
fffff880`098d1330 fffff880`014c9520 : fffff880`098d16c0 fffff8a0`04423ea0 00000000`00001e38 00000000`00001e40 : Ntfs!GetSecurityIdFromSecurityDescriptorUnsafe+0x1fd
fffff880`098d13e0 fffff880`0147d1fa : fffff880`098d16c0 fffff880`098d16c0 fffff8a0`0a9605c0 00000000`00000000 : Ntfs!NtfsCacheSharedSecurityByDescriptor+0xa0
fffff880`098d1430 fffff880`0147cf6c : fffff880`098d16c0 fffff8a0`0a9c9e00 fffff8a0`0a9605c0 fffff8a0`0a9c9e00 : Ntfs!NtfsModifySecurity+0xde
fffff880`098d1570 fffff880`014943a9 : fffff880`098d16c0 fffffa80`093bc1b0 fffff8a0`0a9605c0 fffffa80`06a07180 : Ntfs!NtfsCommonSetSecurityInfo+0x150
fffff880`098d1620 fffff880`01494f01 : fffff880`098d16c0 fffffa80`093bc1b0 fffffa80`093bc1b0 00000000`00000000 : Ntfs!NtfsFsdDispatchSwitch+0x169
fffff880`098d16a0 fffff880`00c1b6af : 00000008`746c6644 63536553`098d1900 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdDispatch+0x2d
fffff880`098d1890 fffff800`035754d3 : fffffa80`077b07f0 00000000`00000000 00000000`00000000 fffffa80`093bc1b0 : fltmgr!FltpDispatch+0x9f
fffff880`098d18f0 fffff800`0352f9e6 : 00000000`00000000 00000000`0b0705f4 fffff880`098d1a18 fffff8a0`0b7a0a90 : nt!IopGetSetSecurityObject+0x183
fffff880`098d19b0 fffff800`0352f8d8 : fffffa80`03ee0000 00000000`20000004 00000000`00000001 00000000`104bdb01 : nt!ObSetSecurityObjectByPointer+0x5a
fffff880`098d1a10 fffff800`03295fd3 : 00000000`00001458 fffffa80`03ee6060 00000000`00001401 00000000`0b20eeb0 : nt!NtSetSecurityObject+0x108
fffff880`098d1ae0 00000000`77ca29da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`104bdd98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ca29da


SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!FindFirstIndexEntry+1fa

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff880098d0590 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!FindFirstIndexEntry+1fa

BUCKET_ID:  X64_0x24_Ntfs!FindFirstIndexEntry+1fa

Followup: MachineOwner
---------

Points to your cmudaxp.sys driver, which is the ASUS Xonar DG Audio Interface driver
Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... BIOS... Lack of Windows updates... Antivirus Software... Backup... Hardware...
Possible causes are Memory problems... Corrupted hard disk file system... Drivers... corrupted SCSI or IDE Drivers...

Thanks to Dave76 for help understanding possible causes.

Do the following to resolve the above driver/hard disk issues:

Make sure your hard disk controller drivers are up to date. Check ASUS - Motherboards- ASUS P8P67-M PRO for SATA drivers, and also check Intel® Driver Update Utility for driver updates. Even if the Intel driver update utility notifies you that the driver is valid, take note of where to get the updated driver and download the update. Often, the driver is valid but not up to date.
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.
Update/re-install your Audio driver from ASUS - Motherboards- ASUS P8P67-M PRO using the following general drive re-install method:
1. First, download the latest driver. Then do the next steps.
2. Click Start Menu
3. Right Click My Computer/Computer
4. Click Manage
5. Click Device Manager from the list on the left
6. Find the device you are trying to uninstall by expanding the appropriate set of devices
7. Right click the device
8. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
9. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
10. Restart your computer only if Windows asks you to.
11. Install the latest driver for the device.
Alternatively:
1. Login as an adminstrative user.
2. First, download the latest driver. Then do the next steps.
3. Click Start Menu
4. Click Control Panel
5. Click Hardware and Sound
6. Click Device Manager (the last link under Devices and Printers)
7. Find the device you are trying to uninstall by expanding the appropriate set of devices
8. Right click the device
9. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
10. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
11. Restart your computer only if Windows asks you to.
12. Install the latest driver for the device.

Fluent · 26 Mar 2012

Teredo Tunnelling Adapter - I recently started using a network proxy for various software, so I believe this correlates to why the is showing as unused.

Security Software - I use MSE and it is completely up to date. Recent scans picked up no problems.

Disks - I ran chkdsk on all my hard drives with no errors returned. My SATA drivers were updated recently as part of the troubleshooting process. This goes for most drive and motherboard controllers also.

Soundcard - I use an ASUS Xonar STX and know of the cmudaxp.sys file. It had caused problems in the past, so I have been using a third-party driver which is widely known for remedying the problems and has been working properly for months now. Could it somehow have automatically installed the ASUS version? (Doubtful but thought I'd ask)
I have reinstalled it just in case.

Did any of the errors point toward the Razer software again?

writhziden · 27 Mar 2012

No errors pointing toward the Razer software.

It is possible your ASUS Xonar STX driver was updated via a Windows update. If you have a concern about this: Drivers - Turn Off Automatic Driver Installation

Fluent · 27 Mar 2012

The ASUS Xonar was driver version 1794 before, so I have confirmed it is now upgraded to 1796.
For anyone with ASUS Xonar cards, here is the link for UNi Drivers: http://brainbit.wordpress.com/2010/0...ified-drivers/ - They run off the same control panel, but have a later version of the driver than ASUS release and contain options for lower latency playback.

Good news about the Razer drivers, fingers crossed the 2.01 rollback worked and I can continue using it. There are very few complaints about this device online so I fail to accept I am a random one-off.
Once again, I will run the system as is for a week. If I encounter any issues, I will repost - at which stage am I likely looking at a fresh install? If I dont encounter a blue screen in the next week, it will be safe to assume it is solved.

Thanks

writhziden · 27 Mar 2012

Given the length of the thread and the steps that have been exhausted, a clean install would not be a bad idea if the problems continue. We can help you with it if you need us to.

Best wishes that you do not need to do more troubleshooting and it is now resolved. :)

Fluent · 27 Mar 2012

Haha, fair call. I'll go straight for the fresh install if it BSOD again.
Thanks again for your help. The only reinstall query I have is if you have a recommended link for setting up a Win7 USB-key installer? I believe this is much quicker than the DVD.

writhziden · 27 Mar 2012

For Windows 7 USB installers, there are a couple methods that work:

The simplest methods appear to be the first two.

Fluent · 10 Apr 2012

Alright, with the new UNi 1796 drivers for the ASUS Xonar STX and the complete wipe and re-install of the Razer drivers, the computer is behaving itself properly. I haven't had a blue screen or any error in over a week.
Thanks Writhziden for your help and patience.

writhziden · 10 Apr 2012

You're very welcome. That is great news, and I am happy to see the problem solved.