BSOD on cold boot - stop code 0x0000001E

[alcatraz]

Hi I hope someone can help with my BSOD problem... Here are the details...

Is Windows 7 Home Premium . . .
- x86 (64-bit)
- I've restored the original installed OS on the system using 'Restore Factory Settings'
- an OEM version?
- The age of system (hardware) is 11 months old
- I've reinstalled the OS because of this BSOD problem but I'm still getting the same problem.

This problem started a couple of weeks ago, I always have a BSOD on a cold boot, usually in the morning when I switch it on. It also occurs if I shut down the comp for a significant length of time. I never have this problem if I warm boot (restart) the comp, no matter how many times I restart it doesnt happen!

I thought maybe I had a virus so reinstalled the OS on the C drive twice, once from a disc backup I know is clean, and once from the partition. The BSOD came back after both instances. I've followed your BSOD posting guidelines and have included the zipped Windows_NT6_BSOD_jcgriff2 folder and system health report.

Any help with this would be very much appreciated, and I thank you in advance.

P.S. If any more info is needed let me know, I'll be monitoring this thread regularly!

Cheers

 

[writhziden]

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\alcatraz\Windows_NT6_BSOD_jcgriff2\011212-27003-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03064000 PsLoadedModuleList = 0xfffff800`032a9670
Debug session time: Thu Jan 12 05:48:45.501 2012 (UTC - 7:00)
System Uptime: 0 days 0:08:39.000
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : hardware ( volmgr!VmReadWrite+bf )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+3130336631346535
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0

BUGCHECK_STR:  0x1E_0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88006394848 -- (.exr 0xfffff88006394848)
ExceptionAddress: fffff88000e5612f (volmgr!VmReadWrite+0x00000000000000bf)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

TRAP_FRAME:  fffff880063948f0 -- (.trap 0xfffff880063948f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80042c0ee0 rbx=0000000000000000 rcx=fffff88000e56010
rdx=fffffa80042c0c60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000e5612f rsp=fffff88006394a80 rbp=00000000ffffffff
 r8=fffffa80049a6540  r9=0000000000000003 r10=0000000000000000
r11=fffffa80042c0ee0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
volmgr!VmReadWrite+0xbf:
fffff880`00e5612f f080bba500000000 lock cmp byte ptr [rbx+0A5h],0 ds:a9a0:00000000`000000a5=??
Resetting default scope

MISALIGNED_IP: 
volmgr!VmReadWrite+bf
fffff880`00e5612f f080bba500000000 lock cmp byte ptr [rbx+0A5h],0

LAST_CONTROL_TRANSFER:  from fffff800030d85fe to fffff800030e0c10

STACK_TEXT:  
fffff880`06393928 fffff800`030d85fe : fffff880`063939f8 00000000`00000801 00000000`00000000 fffff800`0313809b : nt!KeBugCheck
fffff880`06393930 fffff800`0310c4fd : fffff800`032e8808 fffff800`0322b0d8 fffff800`03064000 fffff880`06394848 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`06393960 fffff800`0310b2d5 : fffff800`0322b0d0 fffff880`063939d8 fffff880`06394848 fffff800`03064000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`06393990 fffff800`0311c361 : fffff880`06394848 fffff880`063940a0 fffff880`00000000 fffffa80`04b9a9a0 : nt!RtlDispatchException+0x415
fffff880`06394070 fffff800`030e02c2 : fffff880`06394848 fffffa80`04b9aaf0 fffff880`063948f0 fffffa80`042c0c60 : nt!KiDispatchException+0x135
fffff880`06394710 fffff800`030de41f : fffff880`063948f0 fffffa80`04461b00 00000000`00000000 fffff880`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`063948f0 fffff880`00e5612f : fffffa80`0c2281b0 fffff800`033b69c8 000007ff`fffd8000 00000000`00000000 : nt!KiInvalidOpcodeFault+0x11f
fffff880`06394a80 fffff880`01d0f2bf : 00000000`ffffffff fffffa80`04ba9b90 fffffa80`042c0c60 fffffa80`0c228478 : volmgr!VmReadWrite+0xbf
fffff880`06394ac0 fffff880`01d0f53c : fffffa80`04ba9b90 fffff880`01d0f593 fffffa80`04baad90 00000000`000a0045 : fvevol!FveReadWrite+0x47
fffff880`06394b00 fffff880`01cc3031 : fffff880`06394b94 00000000`00000022 00000000`00000000 fffffa80`0d239101 : fvevol!FveFilterRundownReadWrite+0x1dc
fffff880`06394b60 fffff880`01cc2405 : fffffa80`04baad90 fffffa80`042c0c60 fffffa80`0c2281b0 00000000`b71b7000 : rdyboost!SmdProcessReadWrite+0xbf9
fffff880`06394cd0 fffff880`01c67df4 : fffffa80`04d0a190 fffff880`04a94390 fffffa80`0a661b60 fffff880`06951940 : rdyboost!SmdDispatchReadWrite+0xd9
fffff880`06394d00 fffff880`0164839a : fffff880`04a942b8 fffffa80`0c9a35b0 fffff880`06951a78 00000000`00000000 : volsnap! ?? ::FNODOBFM::`string'+0x57b
fffff880`06394d30 fffff800`030d8757 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsStorageDriverCallout+0x16
fffff880`06394d60 fffff800`030d8711 : 00000000`00000000 00000000`00000000 fffff880`06395000 fffff800`030ed7e2 : nt!KxSwitchKernelStackCallout+0x27
fffff880`04a94180 fffff800`030ed7e2 : fffff880`04a94340 00000000`00000002 fffff880`04a94690 fffff8a0`015bec70 : nt!KiSwitchKernelStackContinue
fffff880`04a941a0 fffff880`01647f09 : fffff880`01648384 00000000`0014d600 00000000`00004000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x2a2
fffff880`04a94280 fffff880`016473d6 : fffffa80`04bee8a0 00000000`00000000 fffff8a0`015bec70 fffff800`0311c1f8 : Ntfs!NtfsMultipleAsync+0xa9
fffff880`04a942f0 fffff880`0163ffc6 : fffff880`04a94690 fffffa80`042c0c60 fffff8a0`015bec70 00000000`00000000 : Ntfs!NtfsNonCachedIo+0x216
fffff880`04a944c0 fffff880`01641a68 : fffff880`04a94690 fffffa80`042c0c60 fffff880`04a94701 fffffa80`04383001 : Ntfs!NtfsCommonRead+0x7a6
fffff880`04a94660 fffff880`012b6bcf : fffffa80`042c0fb8 fffffa80`042c0c60 fffffa80`04383010 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8
fffff880`04a94870 fffff880`012b56df : fffffa80`04beede0 fffffa80`0a661b01 fffffa80`04beed00 fffffa80`042c0c60 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`04a94900 fffff800`03108bc5 : fffffa80`042c0c80 fffffa80`09363d50 fffffa80`043c20d0 fffff800`03256e80 : fltmgr!FltpDispatch+0xcf
fffff880`04a94960 fffff800`03108699 : 00000000`00000001 00000000`00000001 fffffa80`043c2010 fffffa80`043c2010 : nt!IoPageRead+0x255
fffff880`04a949f0 fffff800`030ef02a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000000 : nt!MiIssueHardFault+0x255
fffff880`04a94ac0 fffff800`030ded6e : 00000000`00000000 000007fe`f66ac6bc 00000000`00000001 00000000`00002e70 : nt!MmAccessFault+0x146a
fffff880`04a94c20 00000000`77989c12 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`02dadb80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77989c12


STACK_COMMAND:  kb

FOLLOWUP_IP: 
volmgr!VmReadWrite+bf
fffff880`00e5612f f080bba500000000 lock cmp byte ptr [rbx+0A5h],0

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  volmgr!VmReadWrite+bf

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED_volmgr.sys

BUCKET_ID:  X64_IP_MISALIGNED_volmgr.sys

Followup: MachineOwner
---------

The crash is system related and could be due to corruption, a virus, lack of Windows updates, or hardware.

Run the following steps and post back after doing each one and wait for a response before proceeding to the next step.

1. Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs.
2. Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors.
3. Check for viruses.
   
   Download and install the free version of Malwarebytes : Free anti-malware, anti-virus and spyware removal download (do not start the trial) and make sure it is updated. Do not run a scan yet.
   Download VIPRE Rescue - VIPRE Computer Recovery Solution from Sunbelt Software but do not unzip it yet
   Download the Fakerean removal tool but do not run it yet.
   Start your computer in http://www.sevenforums.com/tutorials/69585-safe-mode.html
   Unzip VIPRE Rescue and let it run.
   Run a full scan with Malwarebytes.
   Run the fakerean removal tool.​
4. Install all Windows Updates and update your device drivers (see http://www.sevenforums.com/tutorials/43216-installing-updating-drivers-7-a.html, Driver Reference Table - sysnative.com - MVP and Drivers and Downloads for driver updating).
5. Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete.
6. An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
   
   a. Backup your system and user files
   b. Create a system restore point
   c. If you do not have a Windows 7 DVD, Create a system repair disc
   d. Run Driver Verifier
   
   If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
   
   Thanks to zigzag3143 for contributing to the Verifier steps.
   If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​

 

[alcatraz]

Hi Writhziden,

Thanks for your comprehensive reply!

I ran a dsk chk over night on the C drive and here are the results, I have a C and a D drive so I'll run a chk dsk on the D drive today.

　
Checking file system on C:
The type of the file system is NTFS.
Volume label is Packard Bell.
A disk check has been scheduled.
Windows will now check the disk. 
CHKDSK is verifying files (stage 1 of 5)...
243712 file records processed. File verification completed.
286 large file records processed. 0 bad file records processed. 0 EA records processed. 92 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
320920 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
243712 file SDs/SIDs processed. Cleaning up 380 unused index entries from index $SII of file 0x9.
Cleaning up 380 unused index entries from index $SDH of file 0x9.
Cleaning up 380 unused security descriptors.
Security descriptor verification completed.
38605 data files processed. CHKDSK is verifying Usn Journal...
37060136 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
243696 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
99247773 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
479110143 KB total disk space.
81634072 KB in 204425 files.
123140 KB in 38606 indexes.
0 KB in bad sectors.
361835 KB in use by the system.
65536 KB occupied by the log file.
396991096 KB available on disk.
4096 bytes in each allocation unit.
119777535 total allocation units on disk.
99247774 allocation units available on disk.
Internal Info:
00 b8 03 00 63 b5 03 00 5b da 06 00 00 00 00 00 ....c...[.......
ad 0e 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 ....\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

 

[writhziden]

Hi Writhziden,

Thanks for your comprehensive reply!

I ran a dsk chk over night on the C drive and here are the results, I have a C and a D drive so I'll run a chk dsk on the D drive today.

　
Checking file system on C:
The type of the file system is NTFS.
Volume label is Packard Bell.
A disk check has been scheduled.
Windows will now check the disk. 
CHKDSK is verifying files (stage 1 of 5)...
243712 file records processed. File verification completed.
286 large file records processed. 0 bad file records processed. 0 EA records processed. 92 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
320920 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
243712 file SDs/SIDs processed. Cleaning up 380 unused index entries from index $SII of file 0x9.
Cleaning up 380 unused index entries from index $SDH of file 0x9.
Cleaning up 380 unused security descriptors.
Security descriptor verification completed.
38605 data files processed. CHKDSK is verifying Usn Journal...
37060136 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
243696 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
99247773 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
479110143 KB total disk space.
81634072 KB in 204425 files.
123140 KB in 38606 indexes.
0 KB in bad sectors.
361835 KB in use by the system.
65536 KB occupied by the log file.
396991096 KB available on disk.
4096 bytes in each allocation unit.
119777535 total allocation units on disk.
99247774 allocation units available on disk.
Internal Info:
00 b8 03 00 63 b5 03 00 5b da 06 00 00 00 00 00 ....c...[.......
ad 0e 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 ....\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

Alright, after you run D, you will want to run C again since there were errors. Run both drives until both have no errors (if D has no errors, there is no need to run it again on D).

 

[alcatraz]

Ok no corrections made to file system on D drive, I'll include data for you to look at just to make sure! And will now run again on C.. thanks so much for your help writhziden...

Chkdsk was executed in read/write mode. 
Checking file system on D:
Volume label is Data.
CHKDSK is verifying files (stage 1 of 5)...
256 file records processed. File verification completed.
0 large file records processed. 0 bad file records processed. 0 EA records processed. 0 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
288 index entries processed. Index verification completed.
　
CHKDSK is verifying security descriptors (stage 3 of 5)...
256 file SDs/SIDs processed. Cleaning up 27 unused index entries from index $SII of file 0x9.
Cleaning up 27 unused index entries from index $SDH of file 0x9.
Cleaning up 27 unused security descriptors.
Security descriptor verification completed.
17 data files processed. CHKDSK is verifying Usn Journal...
1088888 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
240 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
119753045 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
479115991 KB total disk space.
21672 KB in 12 files.
24 KB in 18 indexes.
82111 KB in use by the system.
65536 KB occupied by the log file.
479012184 KB available on disk.
4096 bytes in each allocation unit.
119778997 total allocation units on disk.
119753046 allocation units available on disk.

 

[writhziden]

Ok no corrections made to file system on D drive, I'll include data for you to look at just to make sure! And will now run again on C.. thanks so much for your help writhziden...

Chkdsk was executed in read/write mode. 
Checking file system on D:
Volume label is Data.
CHKDSK is verifying files (stage 1 of 5)...
256 file records processed. File verification completed.
0 large file records processed. 0 bad file records processed. 0 EA records processed. 0 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
288 index entries processed. Index verification completed.
　
CHKDSK is verifying security descriptors (stage 3 of 5)...
256 file SDs/SIDs processed. Cleaning up 27 unused index entries from index $SII of file 0x9.
Cleaning up 27 unused index entries from index $SDH of file 0x9.
Cleaning up 27 unused security descriptors.
Security descriptor verification completed.
17 data files processed. CHKDSK is verifying Usn Journal...
1088888 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
240 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
119753045 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
479115991 KB total disk space.
21672 KB in 12 files.
24 KB in 18 indexes.
82111 KB in use by the system.
65536 KB occupied by the log file.
479012184 KB available on disk.
4096 bytes in each allocation unit.
119778997 total allocation units on disk.
119753046 allocation units available on disk.

D: looks good. Run again on C: until C: is clean. Best wishes!

 

[alcatraz]

Thanks! Here is the data from C again... looks clean to me? Do I now move on to step 2?

　
Checking file system on C:
The type of the file system is NTFS.
Volume label is Packard Bell.
A disk check has been scheduled.
Windows will now check the disk. 
CHKDSK is verifying files (stage 1 of 5)...
249856 file records processed. File verification completed.
285 large file records processed. 0 bad file records processed. 0 EA records processed. 92 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
326936 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
249856 file SDs/SIDs processed. Cleaning up 31 unused index entries from index $SII of file 0x9.
Cleaning up 31 unused index entries from index $SDH of file 0x9.
Cleaning up 31 unused security descriptors.
Security descriptor verification completed.
38541 data files processed. CHKDSK is verifying Usn Journal...
35767880 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
249840 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
99114971 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
479110143 KB total disk space.
82157056 KB in 210832 files.
126556 KB in 38542 indexes.
0 KB in bad sectors.
366643 KB in use by the system.
65536 KB occupied by the log file.
396459888 KB available on disk.
4096 bytes in each allocation unit.
119777535 total allocation units on disk.
99114972 allocation units available on disk.
Internal Info:
00 d0 03 00 2a ce 03 00 cc 0b 07 00 00 00 00 00 ....*...........
ad 0e 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 ....\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

 

[writhziden]

See how the system responds for a few days (or until you get another blue screen crash). Then if you are still having stability issues, run through step one again and see if it is hard disk related. If it comes back clean at that point, run through step two.

 

[alcatraz]

Oh right! Cool... thanks a lot for your help... I'll report back in a few days or when it next crashes! Thanks for your time Writhziden, you're a star!

 

[alcatraz]

Alas, I turned the comp off for a couple of hours, and when I turned it back on it seemed ok. Was still working fine for 15 minutes after boot up (which is a lot longer than it usually takes). Then another BSOD!

I'll now run another dsk chk on both drives, I've attached the latest dump report, which may also have the previous dump in there as well.. sorry about that! I'll let you know how the dsk chk goes...

 

[alcatraz]

Ran dsk chk again, both are clean with no errors, so moving onto step 2 now... will post results!

 

[alcatraz]

Hi writhziden, ran sfc scannow 3 times, each with no errors.. will await your response before proceeding...

 

[writhziden]

Hi writhziden, ran sfc scannow 3 times, each with no errors.. will await your response before proceeding...

Continue to step 3.

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\alcatraz\Windows_NT6_BSOD_jcgriff2\011312-20514-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03065000 PsLoadedModuleList = 0xfffff800`032aa670
Debug session time: Fri Jan 13 15:21:25.502 2012 (UTC - 7:00)
System Uptime: 0 days 0:25:10.000
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : cdrom.sys ( cdrom!DeviceMainTimerTickHandler+ba )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+3130336631346535
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0

BUGCHECK_STR:  0x1E_0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff80000b9c1a8 -- (.exr 0xfffff80000b9c1a8)
ExceptionAddress: fffff88000ec6c7c (Wdf01000!FxPkgIo::DispathToInCallerContextCallback+0x00000000000000a0)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff80000b9c250 -- (.trap 0xfffff80000b9c250)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000082 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000ec6c7c rsp=fffff80000b9c3e0 rbp=fffffa80082169d0
 r8=fffffa8007f03b10  r9=0000000000000000 r10=fffffa8007f03b10
r11=fffff88000f01260 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
Wdf01000!FxPkgIo::DispathToInCallerContextCallback+0xa0:
fffff880`00ec6c7c 4c8b1b          mov     r11,qword ptr [rbx] ds:29a0:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030d95fe to fffff800030e1c10

STACK_TEXT:  
fffff800`00b9b288 fffff800`030d95fe : 00000000`00000000 00000000`00000000 fffff800`00b9ba00 fffff800`0310d830 : nt!KeBugCheck
fffff800`00b9b290 fffff800`0310d4fd : fffff800`032eb71c fffff800`03228c30 fffff800`03065000 fffff800`00b9c1a8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff800`00b9b2c0 fffff800`0310c2d5 : fffff800`0322c0fc fffff800`00b9b338 fffff800`00b9c1a8 fffff800`03065000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`00b9b2f0 fffff800`0311d361 : fffff800`00b9c1a8 fffff800`00b9ba00 fffff800`00000000 fffffa80`08214020 : nt!RtlDispatchException+0x415
fffff800`00b9b9d0 fffff800`030e12c2 : fffff800`00b9c1a8 00000000`00000002 fffff800`00b9c250 00000000`00000000 : nt!KiDispatchException+0x135
fffff800`00b9c070 fffff800`030dfbca : 00000000`00000000 fffffa80`0d3da1c0 00000000`00000000 00001f80`00000500 : nt!KiExceptionDispatch+0xc2
fffff800`00b9c250 fffff880`00ec6c7c : fffffa80`088c29a0 00000000`00000000 fffff880`00000000 00000000`00000158 : nt!KiGeneralProtectionFault+0x10a
fffff800`00b9c3e0 fffff880`00ec5490 : fffffa80`07f03c70 fffffa80`088c29a0 fffffa80`07f03b10 fffffa80`08214020 : Wdf01000!FxPkgIo::DispathToInCallerContextCallback+0xa0
fffff800`00b9c410 fffff880`00eaf245 : fffffa80`088c29a0 0000057f`f773d3d8 fffffa80`088c2d18 fffffa80`088c2d38 : Wdf01000!FxPkgIo::Dispatch+0x2b4
fffff800`00b9c490 fffff880`0483ecde : fffffa80`088c2c20 fffff800`030ee1f4 fffffa80`00000000 fffffa80`07704a80 : Wdf01000!FxDevice::Dispatch+0xa9
fffff800`00b9c4c0 fffff880`00eb8f19 : fffff880`04151d68 fffff880`04144688 fffff880`04151d68 00000000`00000000 : cdrom!DeviceMainTimerTickHandler+0xba
fffff800`00b9c500 fffff880`00eb8f50 : fffff800`00b9c630 fffff800`00b9c648 00000000`00000000 fffffa80`03c4ce00 : Wdf01000!FxTimer::TimerHandler+0xb5
fffff800`00b9c540 fffff800`030ed5fc : fffff800`0000000f fffff800`00b9c618 00000000`00000008 00000000`00000000 : Wdf01000!FxTimer::_FxTimerDpcThunk+0x18
fffff800`00b9c570 fffff800`030ed496 : fffffa80`03c063d8 fffffa80`03c063d8 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`00b9c5e0 fffff800`030ed37e : 00000003`8407dc60 fffff800`00b9cc58 00000000`00017a1a fffff800`0325a5c8 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9cc30 fffff800`030ed167 : 00000001`189a49cf 00000001`00017a1a 00000001`189a49ce 00000000`0000001a : nt!KiTimerExpiration+0x1be
fffff800`00b9ccd0 fffff800`030d996a : fffff800`03257e80 fffff800`03265cc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cdrom!DeviceMainTimerTickHandler+ba
fffff880`0483ecde 4883c438        add     rsp,38h

SYMBOL_STACK_INDEX:  a

SYMBOL_NAME:  cdrom!DeviceMainTimerTickHandler+ba

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cdrom

IMAGE_NAME:  cdrom.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79298

FAILURE_BUCKET_ID:  X64_0x1E_0_cdrom!DeviceMainTimerTickHandler+ba

BUCKET_ID:  X64_0x1E_0_cdrom!DeviceMainTimerTickHandler+ba

Followup: MachineOwner
---------

Your last .dmp file listed cdrom.sys as the culprit, but it was another KMODE_EXCEPTION_NOT_HANDLED (1e) crash, so the steps I outlined in my first post are still relevant.

Also, you should update the following drivers ASAP.

PxHlpa64	fffff880`015f0000	fffff880`015fbd00	Wed Mar 12 19:58:17 2008 (47d88a39)	0001d5ea		PxHlpa64.sys
AVerIR	fffff880`04c00000	fffff880`04c1e000	Mon Sep 08 03:31:35 2008 (48c4f0f7)	00026326		AVerIR.sys
GEARAspiWDM	fffff880`04000000	fffff880`0400d000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys

 

[alcatraz]

Hi I went through all steps in step 3 with no errors found. With regard to the driver updates, I'm having trouble updating the 3 drivers you listed. I cant find my model of pc on my manufacturers website and therefore cant find the correct driver update for Avermedia. I downloaded what I thought was the best match, but its just a folder with lots of files in it, with no instructions on how to update! I'm not savvy enough to know how to update these types of system drivers so I'm at a loss now really

 

[alcatraz]

Oh I havent had a crash (BSOD) for the last 2 days now, forgot to mention that!! It's booted from cold just fine!

 

[writhziden]

Hi I went through all steps in step 3 with no errors found. With regard to the driver updates, I'm having trouble updating the 3 drivers you listed. I cant find my model of pc on my manufacturers website and therefore cant find the correct driver update for Avermedia. I downloaded what I thought was the best match, but its just a folder with lots of files in it, with no instructions on how to update! I'm not savvy enough to know how to update these types of system drivers so I'm at a loss now really

To update your drivers, see http://www.sevenforums.com/tutorials/99402-driver-install-add-hardware-wizard.html and http://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html for two different methods to install drivers.

The two methods should allow you to use the folders you have downloaded that are full of files.

Oh I havent had a crash (BSOD) for the last 2 days now, forgot to mention that!! It's booted from cold just fine!

That's great news. Do your normal routine for a week, and if your system is stable, you can mark the thread as solved by clicking the green button at the bottom of the thread next to Post Reply.

If you have any problems, we can proceed with the next steps.

 

[writhziden]

Is the system still running stable? Were you able to update your drivers?