BSOD on cold boot - stop code 0x0000001E

Hi I hope someone can help with my BSOD problem... Here are the details...

Is Windows 7 Home Premium . . .
- x86 (64-bit)
- I've restored the original installed OS on the system using 'Restore Factory Settings'
- an OEM version?
- The age of system (hardware) is 11 months old
- I've reinstalled the OS because of this BSOD problem but I'm still getting the same problem.

This problem started a couple of weeks ago, I always have a BSOD on a cold boot, usually in the morning when I switch it on. It also occurs if I shut down the comp for a significant length of time. I never have this problem if I warm boot (restart) the comp, no matter how many times I restart it doesnt happen!

I thought maybe I had a virus so reinstalled the OS on the C drive twice, once from a disc backup I know is clean, and once from the partition. The BSOD came back after both instances. I've followed your BSOD posting guidelines and have included the zipped Windows_NT6_BSOD_jcgriff2 folder and system health report.

Any help with this would be very much appreciated, and I thank you in advance.

P.S. If any more info is needed let me know, I'll be monitoring this thread regularly! :)

Cheers

Code:

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\alcatraz\Windows_NT6_BSOD_jcgriff2\011212-27003-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03064000 PsLoadedModuleList = 0xfffff800`032a9670
Debug session time: Thu Jan 12 05:48:45.501 2012 (UTC - 7:00)
System Uptime: 0 days 0:08:39.000
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : hardware ( volmgr!VmReadWrite+bf )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+3130336631346535
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0

BUGCHECK_STR:  0x1E_0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88006394848 -- (.exr 0xfffff88006394848)
ExceptionAddress: fffff88000e5612f (volmgr!VmReadWrite+0x00000000000000bf)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

TRAP_FRAME:  fffff880063948f0 -- (.trap 0xfffff880063948f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80042c0ee0 rbx=0000000000000000 rcx=fffff88000e56010
rdx=fffffa80042c0c60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000e5612f rsp=fffff88006394a80 rbp=00000000ffffffff
 r8=fffffa80049a6540  r9=0000000000000003 r10=0000000000000000
r11=fffffa80042c0ee0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
volmgr!VmReadWrite+0xbf:
fffff880`00e5612f f080bba500000000 lock cmp byte ptr [rbx+0A5h],0 ds:a9a0:00000000`000000a5=??
Resetting default scope

MISALIGNED_IP: 
volmgr!VmReadWrite+bf
fffff880`00e5612f f080bba500000000 lock cmp byte ptr [rbx+0A5h],0

LAST_CONTROL_TRANSFER:  from fffff800030d85fe to fffff800030e0c10

STACK_TEXT:  
fffff880`06393928 fffff800`030d85fe : fffff880`063939f8 00000000`00000801 00000000`00000000 fffff800`0313809b : nt!KeBugCheck
fffff880`06393930 fffff800`0310c4fd : fffff800`032e8808 fffff800`0322b0d8 fffff800`03064000 fffff880`06394848 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`06393960 fffff800`0310b2d5 : fffff800`0322b0d0 fffff880`063939d8 fffff880`06394848 fffff800`03064000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`06393990 fffff800`0311c361 : fffff880`06394848 fffff880`063940a0 fffff880`00000000 fffffa80`04b9a9a0 : nt!RtlDispatchException+0x415
fffff880`06394070 fffff800`030e02c2 : fffff880`06394848 fffffa80`04b9aaf0 fffff880`063948f0 fffffa80`042c0c60 : nt!KiDispatchException+0x135
fffff880`06394710 fffff800`030de41f : fffff880`063948f0 fffffa80`04461b00 00000000`00000000 fffff880`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`063948f0 fffff880`00e5612f : fffffa80`0c2281b0 fffff800`033b69c8 000007ff`fffd8000 00000000`00000000 : nt!KiInvalidOpcodeFault+0x11f
fffff880`06394a80 fffff880`01d0f2bf : 00000000`ffffffff fffffa80`04ba9b90 fffffa80`042c0c60 fffffa80`0c228478 : volmgr!VmReadWrite+0xbf
fffff880`06394ac0 fffff880`01d0f53c : fffffa80`04ba9b90 fffff880`01d0f593 fffffa80`04baad90 00000000`000a0045 : fvevol!FveReadWrite+0x47
fffff880`06394b00 fffff880`01cc3031 : fffff880`06394b94 00000000`00000022 00000000`00000000 fffffa80`0d239101 : fvevol!FveFilterRundownReadWrite+0x1dc
fffff880`06394b60 fffff880`01cc2405 : fffffa80`04baad90 fffffa80`042c0c60 fffffa80`0c2281b0 00000000`b71b7000 : rdyboost!SmdProcessReadWrite+0xbf9
fffff880`06394cd0 fffff880`01c67df4 : fffffa80`04d0a190 fffff880`04a94390 fffffa80`0a661b60 fffff880`06951940 : rdyboost!SmdDispatchReadWrite+0xd9
fffff880`06394d00 fffff880`0164839a : fffff880`04a942b8 fffffa80`0c9a35b0 fffff880`06951a78 00000000`00000000 : volsnap! ?? ::FNODOBFM::`string'+0x57b
fffff880`06394d30 fffff800`030d8757 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsStorageDriverCallout+0x16
fffff880`06394d60 fffff800`030d8711 : 00000000`00000000 00000000`00000000 fffff880`06395000 fffff800`030ed7e2 : nt!KxSwitchKernelStackCallout+0x27
fffff880`04a94180 fffff800`030ed7e2 : fffff880`04a94340 00000000`00000002 fffff880`04a94690 fffff8a0`015bec70 : nt!KiSwitchKernelStackContinue
fffff880`04a941a0 fffff880`01647f09 : fffff880`01648384 00000000`0014d600 00000000`00004000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x2a2
fffff880`04a94280 fffff880`016473d6 : fffffa80`04bee8a0 00000000`00000000 fffff8a0`015bec70 fffff800`0311c1f8 : Ntfs!NtfsMultipleAsync+0xa9
fffff880`04a942f0 fffff880`0163ffc6 : fffff880`04a94690 fffffa80`042c0c60 fffff8a0`015bec70 00000000`00000000 : Ntfs!NtfsNonCachedIo+0x216
fffff880`04a944c0 fffff880`01641a68 : fffff880`04a94690 fffffa80`042c0c60 fffff880`04a94701 fffffa80`04383001 : Ntfs!NtfsCommonRead+0x7a6
fffff880`04a94660 fffff880`012b6bcf : fffffa80`042c0fb8 fffffa80`042c0c60 fffffa80`04383010 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8
fffff880`04a94870 fffff880`012b56df : fffffa80`04beede0 fffffa80`0a661b01 fffffa80`04beed00 fffffa80`042c0c60 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`04a94900 fffff800`03108bc5 : fffffa80`042c0c80 fffffa80`09363d50 fffffa80`043c20d0 fffff800`03256e80 : fltmgr!FltpDispatch+0xcf
fffff880`04a94960 fffff800`03108699 : 00000000`00000001 00000000`00000001 fffffa80`043c2010 fffffa80`043c2010 : nt!IoPageRead+0x255
fffff880`04a949f0 fffff800`030ef02a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000000 : nt!MiIssueHardFault+0x255
fffff880`04a94ac0 fffff800`030ded6e : 00000000`00000000 000007fe`f66ac6bc 00000000`00000001 00000000`00002e70 : nt!MmAccessFault+0x146a
fffff880`04a94c20 00000000`77989c12 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`02dadb80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77989c12


STACK_COMMAND:  kb

FOLLOWUP_IP: 
volmgr!VmReadWrite+bf
fffff880`00e5612f f080bba500000000 lock cmp byte ptr [rbx+0A5h],0

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  volmgr!VmReadWrite+bf

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED_volmgr.sys

BUCKET_ID:  X64_IP_MISALIGNED_volmgr.sys

Followup: MachineOwner
---------

The crash is system related and could be due to corruption, a virus, lack of Windows updates, or hardware.

Run the following steps and post back after doing each one and wait for a response before proceeding to the next step.

1. Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs.
2. Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors.
3. Check for viruses.
   
   Download and install the free version of Malwarebytes : Free anti-malware, anti-virus and spyware removal download (do not start the trial) and make sure it is updated. Do not run a scan yet.
   Download VIPRE Rescue - VIPRE Computer Recovery Solution from Sunbelt Software but do not unzip it yet
   Download the Fakerean removal tool but do not run it yet.
   Start your computer in Safe Mode
   Unzip VIPRE Rescue and let it run.
   Run a full scan with Malwarebytes.
   Run the fakerean removal tool.
4. Install all Windows Updates and update your device drivers (see Installing and updating drivers in 7, Driver Reference Table - sysnative.com - MVP and Drivers and Downloads for driver updating).
5. Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete.
6. An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
   
   a. Backup your system and user files
   b. Create a system restore point
   c. If you do not have a Windows 7 DVD, Create a system repair disc
   d. Run Driver Verifier
   
   If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.
   
   Thanks to zigzag3143 for contributing to the Verifier steps.
   If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

Hi Writhziden,

Thanks for your comprehensive reply!

I ran a dsk chk over night on the C drive and here are the results, I have a C and a D drive so I'll run a chk dsk on the D drive today.

Code:

　
Checking file system on C:
The type of the file system is NTFS.
Volume label is Packard Bell.
A disk check has been scheduled.
Windows will now check the disk. 
CHKDSK is verifying files (stage 1 of 5)...
243712 file records processed. File verification completed.
286 large file records processed. 0 bad file records processed. 0 EA records processed. 92 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
320920 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
243712 file SDs/SIDs processed. Cleaning up 380 unused index entries from index $SII of file 0x9.
Cleaning up 380 unused index entries from index $SDH of file 0x9.
Cleaning up 380 unused security descriptors.
Security descriptor verification completed.
38605 data files processed. CHKDSK is verifying Usn Journal...
37060136 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
243696 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
99247773 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
479110143 KB total disk space.
81634072 KB in 204425 files.
123140 KB in 38606 indexes.
0 KB in bad sectors.
361835 KB in use by the system.
65536 KB occupied by the log file.
396991096 KB available on disk.
4096 bytes in each allocation unit.
119777535 total allocation units on disk.
99247774 allocation units available on disk.
Internal Info:
00 b8 03 00 63 b5 03 00 5b da 06 00 00 00 00 00 ....c...[.......
ad 0e 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 ....\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

alcatraz said:

Hi Writhziden,

Thanks for your comprehensive reply!

I ran a dsk chk over night on the C drive and here are the results, I have a C and a D drive so I'll run a chk dsk on the D drive today.

Code:

　
Checking file system on C:
The type of the file system is NTFS.
Volume label is Packard Bell.
A disk check has been scheduled.
Windows will now check the disk. 
CHKDSK is verifying files (stage 1 of 5)...
243712 file records processed. File verification completed.
286 large file records processed. 0 bad file records processed. 0 EA records processed. 92 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
320920 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
243712 file SDs/SIDs processed. Cleaning up 380 unused index entries from index $SII of file 0x9.
Cleaning up 380 unused index entries from index $SDH of file 0x9.
Cleaning up 380 unused security descriptors.
Security descriptor verification completed.
38605 data files processed. CHKDSK is verifying Usn Journal...
37060136 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
243696 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
99247773 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
479110143 KB total disk space.
81634072 KB in 204425 files.
123140 KB in 38606 indexes.
0 KB in bad sectors.
361835 KB in use by the system.
65536 KB occupied by the log file.
396991096 KB available on disk.
4096 bytes in each allocation unit.
119777535 total allocation units on disk.
99247774 allocation units available on disk.
Internal Info:
00 b8 03 00 63 b5 03 00 5b da 06 00 00 00 00 00 ....c...[.......
ad 0e 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 ....\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

Alright, after you run D, you will want to run C again since there were errors. Run both drives until both have no errors (if D has no errors, there is no need to run it again on D).

Ok no corrections made to file system on D drive, I'll include data for you to look at just to make sure! :) And will now run again on C.. thanks so much for your help writhziden...

Code:

Chkdsk was executed in read/write mode. 
Checking file system on D:
Volume label is Data.
CHKDSK is verifying files (stage 1 of 5)...
256 file records processed. File verification completed.
0 large file records processed. 0 bad file records processed. 0 EA records processed. 0 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
288 index entries processed. Index verification completed.
　
CHKDSK is verifying security descriptors (stage 3 of 5)...
256 file SDs/SIDs processed. Cleaning up 27 unused index entries from index $SII of file 0x9.
Cleaning up 27 unused index entries from index $SDH of file 0x9.
Cleaning up 27 unused security descriptors.
Security descriptor verification completed.
17 data files processed. CHKDSK is verifying Usn Journal...
1088888 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
240 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
119753045 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
479115991 KB total disk space.
21672 KB in 12 files.
24 KB in 18 indexes.
82111 KB in use by the system.
65536 KB occupied by the log file.
479012184 KB available on disk.
4096 bytes in each allocation unit.
119778997 total allocation units on disk.
119753046 allocation units available on disk.

alcatraz said:

Ok no corrections made to file system on D drive, I'll include data for you to look at just to make sure! :) And will now run again on C.. thanks so much for your help writhziden...

Code:

Chkdsk was executed in read/write mode. 
Checking file system on D:
Volume label is Data.
CHKDSK is verifying files (stage 1 of 5)...
256 file records processed. File verification completed.
0 large file records processed. 0 bad file records processed. 0 EA records processed. 0 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
288 index entries processed. Index verification completed.
　
CHKDSK is verifying security descriptors (stage 3 of 5)...
256 file SDs/SIDs processed. Cleaning up 27 unused index entries from index $SII of file 0x9.
Cleaning up 27 unused index entries from index $SDH of file 0x9.
Cleaning up 27 unused security descriptors.
Security descriptor verification completed.
17 data files processed. CHKDSK is verifying Usn Journal...
1088888 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
240 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
119753045 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
479115991 KB total disk space.
21672 KB in 12 files.
24 KB in 18 indexes.
82111 KB in use by the system.
65536 KB occupied by the log file.
479012184 KB available on disk.
4096 bytes in each allocation unit.
119778997 total allocation units on disk.
119753046 allocation units available on disk.

D: looks good. Run again on C: until C: is clean. :) Best wishes!

Thanks! Here is the data from C again... looks clean to me? :) Do I now move on to step 2?

Code:

　
Checking file system on C:
The type of the file system is NTFS.
Volume label is Packard Bell.
A disk check has been scheduled.
Windows will now check the disk. 
CHKDSK is verifying files (stage 1 of 5)...
249856 file records processed. File verification completed.
285 large file records processed. 0 bad file records processed. 0 EA records processed. 92 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
326936 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
249856 file SDs/SIDs processed. Cleaning up 31 unused index entries from index $SII of file 0x9.
Cleaning up 31 unused index entries from index $SDH of file 0x9.
Cleaning up 31 unused security descriptors.
Security descriptor verification completed.
38541 data files processed. CHKDSK is verifying Usn Journal...
35767880 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
249840 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
99114971 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
479110143 KB total disk space.
82157056 KB in 210832 files.
126556 KB in 38542 indexes.
0 KB in bad sectors.
366643 KB in use by the system.
65536 KB occupied by the log file.
396459888 KB available on disk.
4096 bytes in each allocation unit.
119777535 total allocation units on disk.
99114972 allocation units available on disk.
Internal Info:
00 d0 03 00 2a ce 03 00 cc 0b 07 00 00 00 00 00 ....*...........
ad 0e 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 ....\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

See how the system responds for a few days (or until you get another blue screen crash). Then if you are still having stability issues, run through step one again and see if it is hard disk related. If it comes back clean at that point, run through step two.

Oh right! Cool... thanks a lot for your help... I'll report back in a few days or when it next crashes! Thanks for your time Writhziden, you're a star! :)

Alas, I turned the comp off for a couple of hours, and when I turned it back on it seemed ok. Was still working fine for 15 minutes after boot up (which is a lot longer than it usually takes). Then another BSOD!

I'll now run another dsk chk on both drives, I've attached the latest dump report, which may also have the previous dump in there as well.. sorry about that! I'll let you know how the dsk chk goes...