Random BSODs caused by ntoskrnl.

Hello CA,

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa7fd2856ac4, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff880053d463a, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c7100
GetUlongFromAddress: unable to read from fffff800034c71c0
 fffffa7fd2856ac4 

CURRENT_IRQL:  2

FAULTING_IP: 
cmudaxp+1ce63a
fffff880`053d463a 448b89a4000000  mov     r9d,dword ptr [rcx+0A4h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TAG_NOT_DEFINED_c000000f:  FFFFF80004C2DFB0

TRAP_FRAME:  fffff80004c27040 -- (.trap 0xfffff80004c27040)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80004c27288 rbx=0000000000000000 rcx=fffffa800a856a20
rdx=fffffa800c92e8d0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880053d463a rsp=fffff80004c271d0 rbp=0000000000000080
 r8=0000000000000080  r9=0000000000000000 r10=fffff880053e16f0
r11=0000000000000022 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cmudaxp+0x1ce63a:
fffff880`053d463a 448b89a4000000  mov     r9d,dword ptr [rcx+0A4h] ds:fffffa80`0a856ac4=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003297569 to fffff80003297fc0

STACK_TEXT:  
fffff800`04c26ef8 fffff800`03297569 : 00000000`0000000a fffffa7f`d2856ac4 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`04c26f00 fffff800`032961e0 : 00000000`00000000 00000000`00000000 fffffa80`0afcc700 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`04c27040 fffff880`053d463a : fffffa80`06ec3030 fffffa80`0b5b20f8 00000000`00000000 fffffa80`0b5b2038 : nt!KiPageFault+0x260
fffff800`04c271d0 fffffa80`06ec3030 : fffffa80`0b5b20f8 00000000`00000000 fffffa80`0b5b2038 fffffa80`06ec3030 : cmudaxp+0x1ce63a
fffff800`04c271d8 fffffa80`0b5b20f8 : 00000000`00000000 fffffa80`0b5b2038 fffffa80`06ec3030 fffff880`0523f075 : 0xfffffa80`06ec3030
fffff800`04c271e0 00000000`00000000 : fffffa80`0b5b2038 fffffa80`06ec3030 fffff880`0523f075 00000000`00000000 : 0xfffffa80`0b5b20f8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cmudaxp+1ce63a
fffff880`053d463a 448b89a4000000  mov     r9d,dword ptr [rcx+0A4h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  cmudaxp+1ce63a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cmudaxp

IMAGE_NAME:  cmudaxp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5062bcce

FAILURE_BUCKET_ID:  X64_0xD1_cmudaxp+1ce63a

BUCKET_ID:  X64_0xD1_cmudaxp+1ce63a

Followup: MachineOwner
---------

0: kd> lmvm cmudaxp
start             end                 module name
fffff880`05206000 fffff880`05533000   cmudaxp  T (no symbols)           
    Loaded symbol image file: cmudaxp.sys
    Image path: \SystemRoot\system32\drivers\cmudaxp.sys
    Image name: cmudaxp.sys
    Timestamp:        Wed Sep 26 13:59:02 2012 (5062BCCE)
    CheckSum:         002A8DBE
    ImageSize:        0032D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Is is your Audio driver. Update it from the link provided in Driver Reference Table - cmudaxp.sys.

Code:

fffff880`092497e8  fffff880`03e62b95Unable to load image \SystemRoot\System32\Drivers\aswSnx.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSnx.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.SYS
 aswSnx+0x5ab95

Description here .... Driver Reference Table - aswSnx.SYS

Uninstall Avast using Avast Uninstall Utility. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Download and install those, and then run full system scans with both of them, one by one.

You are using a beta of display driver.

Code:

 lmvm atikmpag
start             end                 module name
fffff880`04e57000 fffff880`04ee3000   atikmpag   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\atikmpag.sys
    Image name: atikmpag.sys
    Timestamp:        Sun Dec 02 12:43:21 2012 (50BAFF91)
    CheckSum:         0008D150
    ImageSize:        0008C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I would suggest you to use a stable version, as it is alos a failing driver here.

• Download and install Driver Fusion.
• Reboot the computer in Advanced Boot Options, safe mode. Search Driver Fusion in your start menu, and remove all components of your AMD/ATI display driver.
• Boot normally now. Install the appropriate ATI/AMD display driver.
  You can get it from the link in our forum, Latest AMD Catalyst Video Driver for Windows 7, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.
  
  
  During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

Let us know the results.



** IF there are subsequent crashes after following these instructions, post it following the Blue Screen of Death (BSOD) Posting Instructions. We need some more information in case.