Solved Frequent BSOD on PC running Worldox Indexer software

[Castlewood]

Windows 7 x64 SP1 on Intel DH67BL
Core i7-2600 3.4GHz
8GB RAM (2x 4GB DDR-3 PC3-10600)
Seagate 1TB HDD

PC installed one week ago on SBS2003 network, has one function in life to run Worldox Indexer software for legal firm to index documents and email on a Windows 2003 server.

Office 2010 installed as Worldox requirement (for Outlook) but does not actively run.

No antivirus installed.

PC randomly blue screens with various stop codes (19, 1A, 24, 34, 3B, 4E)

BSOD dump attached. System Health Report not included as Perfmon /Report runs but never completes collection phase.

Thank you

 

[writhziden]

Security Software: Install one of these two:

• Microsoft Security Essentials - Free Antivirus for Windows
  
  
• http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627

Loading Dump File [D:\Kingston\BSODDmpFiles\Castlewood\Windows_NT6_BSOD_jcgriff2\032712-17035-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e64000 PsLoadedModuleList = 0xfffff800`030a8650
Debug session time: Tue Mar 27 09:00:43.178 2012 (UTC - 6:00)
System Uptime: 0 days 22:34:08.037
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800750b0e8, fffff8800750a940, fffff880012a042f}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFlushVolume+213 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800750b0e8
Arg3: fffff8800750a940
Arg4: fffff880012a042f

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800750b0e8 -- (.exr 0xfffff8800750b0e8)
ExceptionAddress: fffff880012a042f (Ntfs!NtfsFlushVolume+0x0000000000000213)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800750a940 -- (.cxr 0xfffff8800750a940)
rax=fa800f6999c00460 rbx=0000000000000000 rcx=fa800f6999c004c0
rdx=fffff8a01975ea70 rsi=0000000000000001 rdi=fffffa8012e80010
rip=fffff880012a042f rsp=fffff8800750b320 rbp=fffff8800750b5e0
 r8=0000000000000000  r9=0000000000000001 r10=fffff8800750b3b0
r11=0000000000000000 r12=fffff8a01975ea30 r13=0000000000000000
r14=0000000000000702 r15=fffffa8007858180
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
Ntfs!NtfsFlushVolume+0x213:
fffff880`012a042f f001b08c000000  lock add dword ptr [rax+8Ch],esi ds:002b:fa800f69`99c004ec=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003112100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsFlushVolume+213
fffff880`012a042f f001b08c000000  lock add dword ptr [rax+8Ch],esi

FAULTING_IP: 
Ntfs!NtfsFlushVolume+213
fffff880`012a042f f001b08c000000  lock add dword ptr [rax+8Ch],esi

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012a8fad to fffff880012a042f

STACK_TEXT:  
fffff880`0750b320 fffff880`012a8fad : fffffa80`12e80010 fffffa80`07858180 00000000`00100001 00000000`00000000 : Ntfs!NtfsFlushVolume+0x213
fffff880`0750b450 fffff880`012a96b4 : fffffa80`12e80010 fffffa80`0735e1c0 fffffa80`12f33dc0 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`0750b530 fffff880`010ebbcf : fffffa80`0735e560 fffffa80`0735e1c0 fffffa80`12e80010 fffff880`0750b558 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`0750b5a0 fffff880`010ea6df : fffffa80`076b1de0 00000000`00000000 fffffa80`076b1d00 fffffa80`0735e1c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0750b630 fffff800`031e7f8b : 00000000`00000002 fffffa80`12f33dc0 00000000`00000000 fffffa80`0735e1c0 : fltmgr!FltpDispatch+0xcf
fffff880`0750b690 fffff800`0317cb31 : fffffa80`0735e1c0 fffffa80`115544e0 fffffa80`12f33dc0 fffff880`02f65180 : nt!IopSynchronousServiceTail+0xfb
fffff880`0750b700 fffff800`02edffd3 : fffffa80`115544e0 fffffa80`0670d040 fffffa80`076b1de0 fffffa80`12f33dc0 : nt!NtFlushBuffersFile+0x171
fffff880`0750b790 fffff800`02edc570 : fffff800`031218fd 00000000`01159a90 00000000`00000000 00000002`000002c7 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0750b928 fffff800`031218fd : 00000000`01159a90 00000000`00000000 00000002`000002c7 00000000`01159b88 : nt!KiServiceLinkage
fffff880`0750b930 fffff800`0317af7a : 00000000`00000000 fffffa80`115544e0 00000000`00000080 00000000`00000001 : nt!PopFlushVolumeWorker+0x1bd
fffff880`0750bc00 fffff800`02ed19c6 : fffff880`02f65180 fffffa80`115544e0 fffff880`02f700c0 00000000`01159c60 : nt!PspSystemThreadStartup+0x5a
fffff880`0750bc40 00000000`00000000 : fffff880`0750c000 fffff880`07506000 fffff880`0750a9a0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsFlushVolume+213

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff8800750a940 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsFlushVolume+213

BUCKET_ID:  X64_0x24_Ntfs!NtfsFlushVolume+213

Followup: MachineOwner
---------

Indicates hard disk corruption.

• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html.
  For any drives that do not give the message:
  Windows has checked the file system and found no problems
  run disk check again as above. In other words, if it says:
  Windows has made corrections to the file system
  after running the disk check, run the disk check again.
  
  
• Run the short and long tests from SeaTools.
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.