BSOD while idle, Stop: 0x7A

MBD · 03 Jun 2015

I woke up today to my computer restarting endlessly in a BSOD loop: it would attempt to recover from the BSOD, try to boot into Windows, and BSOD again. I powered it off completely and powered it back on and it booted just fine. However, being no stranger to BSODs and attempting to analyze their causes, I immediately went to work identifying the error. I opened up my minidump folder, but there was only one dump. So I have no clue what caused my computer to restart in the first place. It was stop 0x7A, with parameter two (the one that tells you what happened with 0x7A, sometimes) being 0xC000000E. I did some cursory reading and found that this error is generally related to hard disk failure, so I went ahead and ran chkdsk /f/r on both of my HDDs, which both came back clean. Once I booted back into Windows, I ran sfc /scannow and got no errors.

"Alright," I said to myself, "let's see what WinDbg has to say." So I opened up the minidump file in WinDbg and it spat this out at me:

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\060315-38001-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is: srv*
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18798.amd64fre.win7sp1_gdr.150316-1654
Machine Name:
Kernel base = 0xfffff800`0321e000 PsLoadedModuleList = 0xfffff800`03463890
Debug session time: Wed Jun  3 19:55:16.351 2015 (UTC - 4:00)
System Uptime: 44 days 8:52:56.291
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {fffff6fb800083f8, ffffffffc000000e, 33bb4880, fffff7000107fff8}

Probably caused by : volsnap.sys ( volsnap!VspCleanupVolumeSnapshot+49 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fb800083f8, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc000000e, error status (normally i/o status code)
Arg3: 0000000033bb4880, current process (virtual address for lock type 3, or PTE)
Arg4: fffff7000107fff8, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR:  0x7a_c000000e

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880033705a0 -- (.trap 0xfffff880033705a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff70001000000 rbx=0000000000000000 rcx=00000000003fffee
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800035a919d rsp=fffff88003370730 rbp=0000000000000000
 r8=0000000000000001  r9=000000000000000f r10=0000000000001fff
r11=fffffa800700c9e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReturnPageTablePageCommitment+0x28d:
fffff800`035a919d 480fb308        btr     qword ptr [rax],rcx ds:fffff700`01000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003303032 to fffff80003290a40

STACK_TEXT:  
fffff880`03370288 fffff800`03303032 : 00000000`0000007a fffff6fb`800083f8 ffffffff`c000000e 00000000`33bb4880 : nt!KeBugCheckEx
fffff880`03370290 fffff800`032b848b : fffffa80`077615d0 fffff880`03370400 fffffa80`0700cd78 fffffa80`077615d0 : nt! ?? ::FNODOBFM::`string'+0x3593a
fffff880`03370370 fffff800`0329edea : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00001f80`01000000 : nt!MiIssueHardFault+0x28b
fffff880`03370440 fffff800`0328eb6e : 00000000`00000001 fffff700`0107fff8 fffffa80`033a9d00 00000000`07fffdcd : nt!MmAccessFault+0x146a
fffff880`033705a0 fffff800`035a919d : fffffa80`07037b50 fffff800`032932aa fffff8a0`00001980 00000000`000008f4 : nt!KiPageFault+0x16e
fffff880`03370730 fffff800`035a961e : 00000000`0000000f 00000000`00001fff fffffa80`0700c9e0 00000000`00001fff : nt!MiReturnPageTablePageCommitment+0x28d
fffff880`033707b0 fffff800`035a9a0f : fffffa80`00000000 000007ff`fdcd0000 fffffa80`00000001 fffff880`0f221900 : nt!MiUnmapViewOfSection+0x1ce
fffff880`03370870 fffff800`0328fcd3 : 00000000`00000000 fffff800`0343b2f0 fffffa80`0700c9e0 fffff800`03294802 : nt!NtUnmapViewOfSection+0x5f
fffff880`033708c0 fffff800`0328c290 : fffff880`011714a9 fffffa80`07b42ae8 fffff880`03370b50 fffffa80`07b42a30 : nt!KiSystemServiceCopyEnd+0x13
fffff880`03370a58 fffff880`011714a9 : fffffa80`07b42ae8 fffff880`03370b50 fffffa80`07b42a30 fffffa80`07b42a30 : nt!KiServiceLinkage
fffff880`03370a60 fffff880`01172bf2 : fffffa80`07b42ae8 fffffa80`086583d8 fffffa80`07b42a30 00000000`00000000 : volsnap!VspCleanupVolumeSnapshot+0x49
fffff880`03370ac0 fffff880`01172eca : 00000000`00000000 fffff800`0343b200 fffffa80`086583d8 00000000`00000000 : volsnap!VspDeleteOldestSnapshot+0xf2
fffff880`03370b10 fffff800`0329a6a5 : fffff880`01172e30 fffff800`0343b2d8 fffffa80`07037b50 fffff800`0343b2d8 : volsnap!VspDestroyAllSnapshotsWorker+0x9a
fffff880`03370b70 fffff800`0352aaba : 00000000`00000000 fffffa80`07037b50 00000000`00000080 fffffa80`0700c9e0 : nt!ExpWorkerThread+0x111
fffff880`03370c00 fffff800`03282426 : fffff880`03174180 fffffa80`07037b50 fffff880`0317f0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03370c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
volsnap!VspCleanupVolumeSnapshot+49
fffff880`011714a9 4883a7a003000000 and     qword ptr [rdi+3A0h],0

SYMBOL_STACK_INDEX:  a

SYMBOL_NAME:  volsnap!VspCleanupVolumeSnapshot+49

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: volsnap

IMAGE_NAME:  volsnap.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce792c8

FAILURE_BUCKET_ID:  X64_0x7a_c000000e_volsnap!VspCleanupVolumeSnapshot+49

BUCKET_ID:  X64_0x7a_c000000e_volsnap!VspCleanupVolumeSnapshot+49

Followup: MachineOwner
---------

It blames volsnap.sys, but I have no idea how to proceed from here. If it listed a 3rd party driver, I'd try to update it or uninstall it or whatever, but since it's a Windows driver, that obviously points to a deeper problem. Can anyone else lend me some insight?

I have ran the requested program and attached the requested file. Thanks!

Edit: Don't laugh at my computer name. Been my computer name since I was a 10 year old skiddie :P

HomerJC · 04 Jun 2015

do you have IE? that also is a problem!!

MBD · 04 Jun 2015

HomerJC said:

do you have IE? that also is a problem!!

...Of course I have IE. Every version of Windows has IE. I don't use it, obviously, but you cannot uninstall it.

Arc · 04 Jun 2015

Hi MBD. :)

See the crash dump that you attached with your first post ... it is informative about the issue. Apparently it is disc HDD related issue.

Code:

BugCheck 7A, {fffff6fb800083f8, ffffffffc000000e, 33bb4880, fffff7000107fff8}

Probably caused by : volsnap.sys ( volsnap!VspCleanupVolumeSnapshot+49 )

Followup: MachineOwner
---------

Code:

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.

Code:

ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.

DISK_HARDWARE_ERROR: There was error with disk hardware

How old the Seagate 250 GB HDD is?

Test both of your HDDs using Seatools, take both the short test and the long test. SeaTools for DOS and Windows - How to Use

Also, post screenshots of the both HDDs using CrystalDiskInfo - Software - Crystal Dew World.

Let us know the results. We may have to take some further steps depending on the results.

MBD · 04 Jun 2015

oops, double post

MBD · 04 Jun 2015

Arc said:

Hi MBD. :)

See the crash dump that you attached with your first post ... it is informative about the issue. Apparently it is disc HDD related issue.

Code:

BugCheck 7A, {fffff6fb800083f8, ffffffffc000000e, 33bb4880, fffff7000107fff8}

Probably caused by : volsnap.sys ( volsnap!VspCleanupVolumeSnapshot+49 )

Followup: MachineOwner
---------

Code:

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.

Code:

ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.

DISK_HARDWARE_ERROR: There was error with disk hardware

How old the Seagate 250 GB HDD is?

Test both of your HDDs using Seatools, take both the short test and the long test. SeaTools for DOS and Windows - How to Use

Also, post screenshots of the both HDDs using CrystalDiskInfo - Software - Crystal Dew World.

Let us know the results. We may have to take some further steps depending on the results.

Unfortunately, I fear I'll never have the chance to run those tests; I restarted my computer after enabling verifier.exe testing and Windows fails to boot every time. It tries, fails, re-tries, fails. This is either a result of the HDD failing or a result of verifier.exe stressing the drivers that were already causing failures too much. Either way, I'm pretty hosed. Anyone know how to make a Windows 7 disc from a bootable Linux CD (that's what I'm using to post with right now)?

Edit: got it to boot in Safe Mode, deleted all settings in Driver Verifier, and now when I boot to normal Windows, Windows loads nothing upon login. None of my desktop icons, no taskbar, nothing; attempting to CTRL+SHIFT+ESC yields an error message (0xC0000022). Malwarebytes, strangely, works. Nothing else does.

I can still boot into safe mode just fine.

Arc · 04 Jun 2015

You have verifier enabled, and you cannot disable it?

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

MBD · 04 Jun 2015

Arc said:

You have verifier enabled, and you cannot disable it?

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

You JUST MISSED my edit, by seconds, haha. In my previous post, at the bottom, it describes what happened.

Arc · 04 Jun 2015

Complete the HDD test, preferably using Seatools for DOS.

MBD · 04 Jun 2015

Arc said:

Complete the HDD test, preferably using Seatools for DOS.

Was able to system restore to right after I recovered from the BSODs and ran chkdsk. I will run the test right now.