BSODs; volsnap.sys identified

My three-year old Dell Studio XPS desktop PC running Windows 7 x64 (with SP1) had become sluggish; so about two months ago, I formatted the HDD and then performed a new install. It had been working fine for about a month. Over the last few weeks, however, upon my unlocking the desktop I've been noticing that the system has unexpectedly rebooted. Upon the loading of my profile, Windows will inevitably display a message saying that a critical error occurred and that the system unexpectedly shutdown. Sometimes the system will lock-up right after I enter my credentials to unlock the desktop or even to log in.

The System log shows that the PC has unexpectedly rebooted about 20 times over the last three weeks. The following two error/critical events appear with each unexpected reboot:

Source: EventLog
Event ID: 6008
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Description: The previous system shutdown at ... was unexpected.

Source: Microsoft-Windows-Kernel-Power
Event ID: 41
Task Category: (63)
Level: Critical
Keywords: (2)
User: SYSTEM
Description: The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

A surface scan of the HDD using SpinRite doesn't report any problems.

I had added memory to the system just prior to my performing the new install. I used MemTest86 utility over the past 36 hours, performing 10 passes; no errors were found.

All Windows Updates are installed.

SFC /SCANNOW reports "Windows Resource Protection did not find any integrity violations."

Full scans in MSE show the system to be clean. Various malware-detecting utilities report the system to be clean, too.

The BlueScreenView utility shows two mini-dump files: one associated with the earliest reboot listed in the System Log (it occurred about three weeks ago) and one associated with a reboot that occurred about a week ago. The PC has unexpectedly rebooted many times since then; not sure why no other dump files are present. For both mini-dump files, the Bug Check String is DRIVER_IRQL_NOT_LESS_OR_EQUAL, the Bug Check Code is 0x000000d1, and the Caused By Driver is volsnap.sys.

Upon analyzing the full memory dump file and the two mini-dump files, the "Who Crashed" utility vaguely reports: "This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time."

I only have one restore point, dated today -- even though there is over 440 GB of drive space and the system is configured to use it. Not sure why there are no other restore points. I wonder if this is somehow related to the mention of the volsnap.sys driver associated with the unexpected reboots?

Since unchecking the System failure "Automatically restart" checkbox, I've seen a few of the BSOD's; they all reference volsnap.sys.

I considered using the Verifier tool but it didn't seem relevant -- since volsnap.sys is a Microsoft file.

Suspecting volsnap.sys and learning that it corresponds to the Volume Shadow Copy service, I stopped the service. A few minutes later, however, I noticed it had been started. I stopped the service again, numerous times, but it kept starting; not sure what's causing that. I have now stopped the service and have set it to "Disabled".

I have attached the SF_Diagnostic_Tool ZIP file.

Thank you for any suggestions as to how to diagnose and resolve this problem!

Hello cwaters.

Both the dumps are exactly the same, and they are showing a lot of this particular error ....

Code:

fffff880`02f1bd98  fffff880`010acf5c ataport!IdePortCompletionDpc

In this situation, I am suggesting you to scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline
  

When done, free up the startup.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept the restart.

One problematic element is still remained there, but apparently it is not a startup issue but a BIOS rootkit that is causing the issues.

Stop error message when you resume a computer that is running Windows 7 or Windows Server 2008 R2 from sleep or from hibernation: "Stop error code 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL)"

Stop error on a computer that is running Windows Server 2008 R2, Windows Server 2008, Windows Vista or Windows 7 when the operating system uses a virtual storport miniport driver to save a dump file or a hibernation file: "0x000000D1"
did you do: chkdsk/r c:
??

cwaters said:

Kaktussoft said:

did you do: chkdsk/r c:
??

I just now performed this. A reboot was required. Through the first four steps, no errors were detected. The fifth/final step ('checking free space') ran for at least an hour, slowly progressing, but I missed the end results. BTW, is there a way to make the results remain on the screen ... so as to prevent the Windows GUI from loading?

Check Disk (chkdsk) - Read Event Viewer Log

Did you do #4 already?

If you are asking ....

cwaters said:

Thanks! I ran TDSSKiller when I first started encountering the problem a few weeks ago. I see that it was updated 8 days ago -- so I will download and run that version. I'm curious; TDSSKiller runs within Windows, so how effective can it be at detecting low-level malware?

It works almost all the times, I have never seen it failing.

cwaters said:

I will setup Windows Defender Offline media and then scan my system. Had been wondering whether there was such a thing. Again, since MSE runs within Windows, how effective can it be at detecting low-level malware?

MSE gives you the real time protection. For scanning, you should use WDO.

cwaters said:

I'm confused about your last suggestion. How will 'freeing up the startup' help? What should I look for and/or do afterward?

It will help you to determine if any startup entries are causing any issue there.

cwaters said:

BTW, since disabling the VSC service, I've not encountered any unexpected reboots. Could that indicate that my volsnap.sys file is truly corrupt (or worse, infected)?

Probably the worse ... as rootkits are there.