Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Intermittent BSOD on Windows 7 VM

01 Sep 2013   #1

Vindows 7 Enterprise
Intermittent BSOD on Windows 7 VM


I just created a new Windows VM and it was working fine until recently, now I'm getting random BSODs a few times daily. I looked at the minidump file in WinDbg and seems related to volsnap.sys. Since the problem just started recently I wonder if it may be related to the VSS space filling up. I have 15% of my disk allocated for VSS

My System SpecsSystem Spec
01 Sep 2013   #2

Microsoft Community Contributor Award Recipient

Windows 10 Home 64Bit

Reduce the start-up items, Antivirus software is basically whats required.------------------------
Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:
  • Click on the
  • Type CMD on Search
  • Left click and Run as Administrator
  • Type SFC /scannow - read here
Run Disk Check on your Hard Drive for file system errors and bad sectors on it - read here
Upload a screenshot using:Test your Hard Drive(s) by running:------------------------
Make scans with these tools -
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck D1, {64, 2, 1, 8a1b29b8}

*** WARNING: Unable to verify timestamp for prl_strg.sys
*** ERROR: Module load completed but symbols could not be loaded for prl_strg.sys
Probably caused by : volsnap.sys ( volsnap!VspReuseTableUpdateIrp+e )

Followup: MachineOwner

kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arg1: 00000064, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8a1b29b8, address which referenced memory

Debugging Details:

OVERLAPPED_MODULE: Address regions for 'usbvideo' and 'usbvideo.sys' overlap

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81baf84c
Unable to read MiSystemVaType memory at 81b8ee20


8a1b29b8 895164          mov     dword ptr [ecx+64h],edx





TAG_NOT_DEFINED_c000000f:  FFFFFFFF80790000

TRAP_FRAME:  8078fd40 -- (.trap 0xffffffff8078fd40)
ErrCode = 00000002
eax=80df8008 ebx=8935f238 ecx=00000000 edx=860eef80 esi=00000000 edi=80df8008
eip=8a1b29b8 esp=8078fdb4 ebp=8078fdb4 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
8a1b29b8 895164          mov     dword ptr [ecx+64h],edx ds:0023:00000064=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8a1b29b8 to 81a86b7f

8078fd40 8a1b29b8 badb0d00 860eef80 81b7c6c0 nt!KiTrap0E+0x1b3
8078fdb4 8a1c631f 80df8008 8935f238 847a76f0 volsnap!VspReuseTableUpdateIrp+0xe
8078fde8 8a1c651c 8935f238 845b50d8 860a5570 volsnap!VspWriteVolumePhase32+0x55
8078fe04 8a1b8b62 00000000 86941468 00000000 volsnap!VspWriteVolumePhase3+0xc0
8078fe24 81abddd3 00000000 86941468 860a5570 volsnap!VspPerformanceWrapperCompletionRoutine+0x3c
8078fe68 8a3c2498 8078fe9c 8a3c2abd 845ab960 nt!IopfCompleteRequest+0x128
8078fe70 8a3c2abd 845ab960 86941468 00000001 CLASSPNP!ClassCompleteRequest+0x11
8078fe9c 81abddd3 00000000 85520ae0 01521cf0 CLASSPNP!TransferPktComplete+0x2e4
8078fee4 8a33716e 8a33a04c 00000000 85520ae0 nt!IopfCompleteRequest+0x128
WARNING: Stack unwind information not available. Following frames may be wrong.
8078ff00 8a3373e4 00000000 00000000 845aa9d4 prl_strg+0x316e
8078ff14 8a337422 845aa9d0 00000000 00000000 prl_strg+0x33e4
8078ff48 81abd675 840b5e5c 00000002 00000000 prl_strg+0x3422
8078ffa4 81abd4d8 81b70d20 83fd2798 00000000 nt!KiExecuteAllDpcs+0xf9
8078fff4 81abcc9c 807fc690 00000000 00000000 nt!KiRetireDpcList+0xd5
8078fff8 807fc690 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2c
81abcc9c 00000000 0000001a 00d6850f bb830000 0x807fc690


8a1b29b8 895164          mov     dword ptr [ecx+64h],edx


SYMBOL_NAME:  volsnap!VspReuseTableUpdateIrp+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: volsnap

IMAGE_NAME:  volsnap.sys


FAILURE_BUCKET_ID:  0xD1_volsnap!VspReuseTableUpdateIrp+e

BUCKET_ID:  0xD1_volsnap!VspReuseTableUpdateIrp+e

Followup: MachineOwner
My System SpecsSystem Spec
06 Sep 2013   #3

Vindows 7 Enterprise

Thanks very much for your help.
I have done all the steps you suggested and here are the results:

SFC /scannow : see below for log
Check HD for disk errors and sector errors: none found

CrystalDiskInfo: screenshot attached

Scans withTDSSkiller and online virus scanner: no infections

Any suggestions now?

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
134144 file records processed. File verification completed.
457 large file records processed. 0 bad file records processed. 2 EA records processed. 68 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
175608 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
134144 file SDs/SIDs processed. Cleaning up 202 unused index entries from index $SII of file 0x9.
Cleaning up 202 unused index entries from index $SDH of file 0x9.
Cleaning up 202 unused security descriptors.
Security descriptor verification completed.
20733 data files processed. CHKDSK is verifying Usn Journal...
33781488 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
134128 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
56781783 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Windows has made corrections to the file system.

268331007 KB total disk space.
40901572 KB in 104003 files.
59176 KB in 20734 indexes.
0 KB in bad sectors.
243127 KB in use by the system.
65536 KB occupied by the log file.
227127132 KB available on disk.

4096 bytes in each allocation unit.
67082751 total allocation units on disk.
56781783 allocation units available on disk.

Internal Info:
00 0c 02 00 4c e7 01 00 32 7c 03 00 00 00 00 00 ....L...2|......
dc 01 00 00 44 00 00 00 00 00 00 00 00 00 00 00 ....D...........
40 f4 2b 00 50 01 2b 00 c8 1b 2b 00 00 00 2b 00 @.+.P.+...+...+.

Windows has finished checking your disk.
Please wait while your computer restarts.
My System SpecsSystem Spec

06 Sep 2013   #4

Microsoft Community Contributor Award Recipient

Windows 10 Home 64Bit

Any new BSOD?
My System SpecsSystem Spec
06 Sep 2013   #5

Vindows 7 Enterprise

Not yet, but it's intermittent and will likely happen again. And I continually notice these errors in the eventvwr system tab: eventID 8 "The flush and hold writes operation on volume C: timed out while waiting for a release writes command." and these VSS errors below in the application tab. Any ideas?

Volume Shadow Copy Service error: The I/O writes cannot be held during the shadow copy creation period on volume \\?\Volume{0781ec58-2821-11e1-9781-806e6f6e6963}\. The volume index in the shadow copy set is 0. Error details: Open[0x00000000, The operation completed successfully.
], Flush[0x00000000, The operation completed successfully.
], Release[0x80042314, The shadow copy provider timed out while holding writes to the volume being shadow copied. This is probably due to excessive activity on the volume by an application or a system service. Try again later when activity on the volume is reduced.
], OnRun[0x00000000, The operation completed successfully.

Executing Asynchronous Operation

Current State: DoSnapshotSet


Volume Shadow Copy Service error: Error calling a routine on the Shadow Copy Provider {b5946137-7b9f-4925-af80-51abd60b20d5}. Routine returned E_INVALIDARG. Routine details GetSnapshot({00000000-0000-0000-0000-000000000000},003C5AB0).

Get Shadow Copy Properties

Execution Context: Coordinator

My System SpecsSystem Spec
14 Sep 2013   #6

Vindows 7 Enterprise

I just got another BSOD from volsnap.sys again. attached is the minidump..
Any other suggestions?
My System SpecsSystem Spec
14 Sep 2013   #7

Microsoft Community Contributor Award Recipient

Microsoft Windows 10 Pro Insider Preview 64-bit

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

information   Information
Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

warning   Warning
Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip   Tip

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.
My System SpecsSystem Spec

 Intermittent BSOD on Windows 7 VM

Thread Tools

Similar help and support threads
Thread Forum
Intermittent BSOD, "Windows Failed to Start" upon boot
Hi guys, For the last few weeks, I've been getting the "Windows Failed to Start" error screen intermittently when I try to boot my computer. This does not always happen, but several times on occasion. I then proceed to run Startup Repair (with a system restore), and then I am able to launch...
BSOD Help and Support
Intermittent System Lockups - Windows BSOD Dump
For the last year or so, (possibly ever since I've built this computer :huh:) I have been experiencing intermittent lock ups while doing regular web browsing / excel tasks. Generally, the system will "lock up" for around 30 seconds to a minute and then resume functioning as normal. During this lock...
BSOD Help and Support
Intermittent BSOD mixed with Windows Not Starting Properly after updat
Hello, new to this forum but desperately need help. I am running Windows 7 64-bit on an ASUS U56E standard everything - no hardware changes ever, bought from a store in the box brand new. Had for about a year now. About a week or two ago I started to get a black screen when turning on my...
BSOD Help and Support
Intermittent BSOD, trouble resuming Windows, Difficult to Diagnose
System Spec: - 64 bit - I built the machine August 2010, I have not reinstalled the OS since. - Full Retail Version of Windows 7 - Hello Everyone, I have been experiencing problems with this machine since about a month after I built it in August 2011. At first I would get a BSOD just...
BSOD Help and Support
Intermittent BSOD - Windows 7 Pro 64 bit
I have Windows 7 Pro, 64 bit installed on my Asus laptop, model N81VP - the laptop is about two years old. For the last few months, I've randomly been getting BSOD's and I'm not sure why - never had them until recently. There isn't anything specific that triggers them, and I haven't done anything...
BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 14:49.
Twitter Facebook Google+