BSODs; volsnap.sys identified

[cwaters]

Heck, at this point, perhaps it would be better for me to simply format the HDD and then install the OS from scratch again. My concern in doing that, however, is that I'll end up at the same place.

 

[cwaters]

I performed a repair re-installation on Monday. Early this morning, another BSOD occurred, naming volsnap.sys as the culprit again. What a pain!!!

I fear I have no recourse but to go through the painful process of formatting the HDD and installing Windows again. But what's to say I won't experience the same problem again?

What could cause volsnap.sys to keep crashing? Could there be malware in the BIOS? (BTW, the Dell BIOS update utility won't let me re-flash the BIOS with the same or an earlier version. I already have the latest BIOS so I appear to be stuck.) Could it be a hardware failure?

 

[Kaktussoft]

I performed a repair re-installation on Monday. Early this morning, another BSOD occurred, naming volsnap.sys as the culprit again. What a pain!!!

I fear I have no recourse but to go through the painful process of formatting the HDD and installing Windows again. But what's to say I won't experience the same problem again?

What could cause volsnap.sys to keep crashing? Could there be malware in the BIOS? (BTW, the Dell BIOS update utility won't let me re-flash the BIOS with the same or an earlier version. I already have the latest BIOS so I appear to be stuck.) Could it be a hardware failure?

Post screenshot of disk management please. Then I can give you instructions how to dual boot and test.

You already performed chkdsk/r c: ?
You already did a memory check?
You already tried http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html ? So no special drivers/startup software is loaded?

 

[cwaters]

Post screenshot of disk management please. Then I can give you instructions how to dual boot and test.

You already performed chkdsk/r c: ?
You already did a memory check?
You already tried http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html ? So no special drivers/startup software is loaded?

Thanks!
I've performed numerous CHKDSK /R /F, on both C: and D:.
I did a memory check using MemTest86.
I reviewed the 'Clean Startup' article but haven't tried it yet because the problem is so random and inconsistent. For instance, my system hasn't rebooted in over 30 hours. Not sure how to answer your question about "special" drivers/startup software. Can you elaborate?

I have attached a screenshot of my Disk Management. I've never been able to figure out why my C: partition is on Disk 1...nor if that matters.

 

[Kaktussoft]

You already tried Troubleshoot Application Conflicts by Performing a Clean Startup ? So no special drivers/startup software is loaded?
=> I meant: Try a clean startup so no 3rd party drivers and startup items are running

Disk0 has an OEM partition and a RECOVERY partition.... this was the initial boot disk a long time ago. The 3rd partition on disk 0 is still active. So marked to be bootable. Please make it inactive.

In http://www.sevenforums.com/tutorials/783-elevated-command-prompt.html :

diskpart
sel  vol  d:
inactive
exit

Now open disk management and check if D is not active anymore.

Now shrink C by 50000MB to make space for new win7 system. http://www.sevenforums.com/tutorials/2672-partition-volume-shrink.html

Boot from win7 install DVD and install win7 in unallocated space you just created. If all is succesfull you can dual boot. Boot into the new and old win7 and check drive lettering using disk mangement. Is new win7 really using the new partition?

 

[cwaters]

Disk0 has an OEM partition and a RECOVERY partition.... this was the initial boot disk a long time ago. The 3rd partition on disk 0 is still active. So marked to be bootable. Please make it inactive.

In http://www.sevenforums.com/tutorials/783-elevated-command-prompt.html :

diskpart
sel  vol  d:
inactive
exit

Now open disk management and check if D is not active anymore.

Now shrink C by 50000MB to make space for new win7 system. http://www.sevenforums.com/tutorials/2672-partition-volume-shrink.html

You joggled my memory. This PC came with Window Vista when I purchased it three years ago; that's where the 47MB OEM and 10GB RECOVERY partitions on the 500MB Disk 0 likely resided. I recall adding a 750GB HDD some later (Disk 1) and installing Windows 7 on it; not sure where the 100MB System Reserved partition came from on Disk 1...is that anything to be concerned about? In any case, Vista has long since been removed from this PC; i.e., there is no \Windows directory on Disk 0's third partition...and the system isn't set up for dual-boot.

I have marked Disk 0's third partition as inactive. On Disk 1, I have shrunk C: by 50000MB and have created a new 50GB partition (M:, listed as a Primary Partition). Please see attached.

Boot from win7 install DVD and install win7 in unallocated space you just created. If all is succesfull you can dual boot. Boot into the new and old win7 and check drive lettering using disk mangement. Is new win7 really using the new partition?

I will install Windows 7 on the new partition and then verify that I can dual-boot. I will also boot into each install and check the drive lettering--which (presumably) will verify that the new install is using the new partition. What should I do after that?

 

[cwaters]

I installed Windows 7 on the new partition. I can dual-boot. I booted into both the original install and the new install; the drive lettering looks OK in each (IMO). Please see attachments.

How do you suggest I proceed?

 

[Kaktussoft]

Looks great!!! Now you can determine if it's a hardware problem

 

[cwaters]

Looks great!!! Now you can determine if it's a hardware problem

How will I be able to do that? Are you perhaps recommending that I boot into the new installation/environment and then wait to see if the volsnap.sys BSOD occurs again? I would need to install all (or many) of my apps before I could use that environment for any length of time.

 

[Kaktussoft]

Looks great!!! Now you can determine if it's a hardware problem

How will I be able to do that? Are you perhaps recommending that I boot into the new installation/environment and then wait to see if the volsnap.sys BSOD occurs again? I would need to install all (or many) of my apps before I could use that environment for any length of time.

dual boot is just for testing. If new win7 instance doesn't crash.... it's not a hardware failure

 

[cwaters]

Looks great!!! Now you can determine if it's a hardware problem

How will I be able to do that? Are you perhaps recommending that I boot into the new installation/environment and then wait to see if the volsnap.sys BSOD occurs again? I would need to install all (or many) of my apps before I could use that environment for any length of time.

dual boot is just for testing. If new win7 instance doesn't crash.... it's not a hardware failure

That's the thing; this problem is random and inconsistent. Sometimes the system won't have a BSOD until many hours or even a few days later; my initial instance hasn't had a BSOD now in four days. So how can I know whether installing the second instance determined or eliminated a cause? I would need to stay in the second instance (potentially) for days to see whether it has a BSOD.

Here's something interesting in the initial instance: While reviewing the System log for Criticals, Errors, and Warnings, I notice the following error since the last BSOD (I also see these prior to the BSOD):

Source: volsnap
Event ID: 8
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Description: The flush and hold writes operation on volume C: timed out while waiting for a release writes command.
​

This error has occurred 37 times over the last 96 hours, referencing the C:, D:, and M: volumes.

I also see two instances of this error:

Source: Ntfs
Event ID: 55
Task Category: (2)
Level: Error
Keywords: Classic
User: N/A
Description: The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolumeShadowCopy14.
​

I see similar errors three weeks ago, naming a different ShadowCopy. Any thoughts?

While I wait for your reply, I will boot back into the new instance and then watch for BSODs; I will also review the System log to see if these errors occur there.

 

[Kaktussoft]

In problem win7 instance: elevated command prompt:

vssadmin  list  writers

Post output

can you still create restore points?

 

[cwaters]

I booted into the new instance and then left for a few hours. I didn't realize sleep mode is enabled by default; so the system was asleep all this time.

Now that I've taken the new instance out of sleep mode, I notice a few interesting errors in the System log:

Source: Ntfs
Event ID: 55
Task Category: (2)
Level: Error
Keywords: Classic
User: N/A
Description: The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolumeShadowCopy14.
​

Note that this is the same error and volume that the problem instance is complaining about.

Not sure if it's relevant, but I'm also seeing this error in the new instance's System log:

Source: Microsoft-Windows-Kernel-General
Event ID: 5
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Description: {Registry Hive Recovered} Registry hive (file): '\??\Volume{8dff3286-4baf-11e2-aa13-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{0B8E6811-F778-430D-B833-192E453C86CB}' was corrupted and it has been recovered. Some data might have been lost.
​

This latter error has occurred three times--each time with a different final bracketed value. I don't recall seeing this error in the problem instance.

 

[cwaters]

In problem win7 instance: elevated command prompt:

vssadmin  list  writers

Post output

can you still create restore points?

Here is the output from the command, ran soon after I booted and logged in to the problem instance:

C:\Windows\system32>vssadmin list writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Waiting for responses.
These may be delayed if a shadow copy is being prepared.

Writer name: 'Task Scheduler Writer'
Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
State: [1] Stable
Last error: No error

Writer name: 'VSS Metadata Store Writer'
Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
State: [1] Stable
Last error: No error

Writer name: 'Performance Counters Writer'
Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
State: [1] Stable
Last error: No error

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {82585540-6148-4ac9-9c70-d61b7814a7c3}
State: [1] Stable
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {8c184acc-5bc6-4111-8c16-980018bc06df}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {a80da31d-5dff-49a0-8cb5-49549131ab20}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {f891199b-a5ce-4934-b999-2e07c3a59887}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {4514538e-26b5-4e85-9d74-c2ccf4b8497c}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {89d3766e-2b68-4cfc-9262-501589bb04a9}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {31f59a4e-fd04-4536-87c3-89a3517b7786}
State: [1] Stable
Last error: No error
​

I was able to successfully create a new restore point. BTW, only "Local Disk ( C: )" has its Protection flag set to "On".

 

[Kaktussoft]

Is computer running in IDE or AHCI mode? http://www.sevenforums.com/tutorials/61869-ahci-enable-windows-7-vista.html

If you don't know, goto device manager, expand branch IDE ATA/ATAPI-controller. Post screenshot. Do it in problem win7 instance and new win7 instance

 

[Kaktussoft]

In problem win7 instance: elevated command prompt:

vssadmin  list  writers

Post output

can you still create restore points?

Here is the output from the command, ran soon after I booted and logged in to the problem instance:

C:\Windows\system32>vssadmin list writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Waiting for responses.
These may be delayed if a shadow copy is being prepared.

Writer name: 'Task Scheduler Writer'
Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
State: [1] Stable
Last error: No error

Writer name: 'VSS Metadata Store Writer'
Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
State: [1] Stable
Last error: No error

Writer name: 'Performance Counters Writer'
Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
State: [1] Stable
Last error: No error

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {82585540-6148-4ac9-9c70-d61b7814a7c3}
State: [1] Stable
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {8c184acc-5bc6-4111-8c16-980018bc06df}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {a80da31d-5dff-49a0-8cb5-49549131ab20}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {f891199b-a5ce-4934-b999-2e07c3a59887}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {4514538e-26b5-4e85-9d74-c2ccf4b8497c}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {89d3766e-2b68-4cfc-9262-501589bb04a9}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {31f59a4e-fd04-4536-87c3-89a3517b7786}
State: [1] Stable
Last error: No error
​

I was able to successfully create a new restore point. BTW, only "Local Disk ( C: )" has its Protection flag set to "On".

I was able to successfully create a new restore point. BTW, only "Local Disk ( C: )" has its Protection flag set to "On".
=>Is this on bad instance or new instance? C in new instance has protection set to on as well?

 

[cwaters]

Is computer running in IDE or AHCI mode? http://www.sevenforums.com/tutorials/61869-ahci-enable-windows-7-vista.html

If you don't know, goto device manager, expand branch IDE ATA/ATAPI-controller. Post screenshot. Do it in problem win7 instance and new win7 instance

I reviewed Device Manager in the context of the article but am not sure how to interpret the results so as to answer your question--so here are the screenshots. The two configurations look the same, FWIW.

 

[cwaters]

In problem win7 instance: elevated command prompt:

vssadmin  list  writers

Post output

can you still create restore points?

Here is the output from the command, ran soon after I booted and logged in to the problem instance:

C:\Windows\system32>vssadmin list writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Waiting for responses.
These may be delayed if a shadow copy is being prepared.

Writer name: 'Task Scheduler Writer'
Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
State: [1] Stable
Last error: No error

Writer name: 'VSS Metadata Store Writer'
Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
State: [1] Stable
Last error: No error

Writer name: 'Performance Counters Writer'
Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
State: [1] Stable
Last error: No error

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {82585540-6148-4ac9-9c70-d61b7814a7c3}
State: [1] Stable
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {8c184acc-5bc6-4111-8c16-980018bc06df}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {a80da31d-5dff-49a0-8cb5-49549131ab20}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {f891199b-a5ce-4934-b999-2e07c3a59887}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {4514538e-26b5-4e85-9d74-c2ccf4b8497c}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {89d3766e-2b68-4cfc-9262-501589bb04a9}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {31f59a4e-fd04-4536-87c3-89a3517b7786}
State: [1] Stable
Last error: No error
​

I was able to successfully create a new restore point. BTW, only "Local Disk ( C: )" has its Protection flag set to "On".

I was able to successfully create a new restore point. BTW, only "Local Disk ( C: )" has its Protection flag set to "On".
=>Is this on bad instance or new instance? C in new instance has protection set to on as well?

The screenshot is from the problem instance. I checked the new instance; like the problem instance, it has its protection set to just Local Disk ( C: ).

 

[cwaters]

The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolumeShadowCopy14.
​

Is there a way to determine what volume this is -- so that I can run CHKDSK on it?
UPDATE: I notice the three shadow copies that had been present in the problem instance are now missing; I also haven't seen any new 'corrupt/unusable' errors; so maybe running CHKDSK on the corrupt/unusable 'volume' is a moot point. FWIW, the only shadow copy present is one from this morning, marked Windows Update / Critical Update.
UPDATE: I notice the following error in the Application log. It has occurred over 26,000 times over the last five days:

Source: VSS
Event ID: 12294
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Description: Volume Shadow Copy Service error: Error calling a routine on the Shadow Copy Provider {b5946137-7b9f-4925-af80-51abd60b20d5}. Routine returned E_INVALIDARG. Routine details GetSnapshot({00000000-0000-0000-0000-000000000000},0000000000424250).

Operation:
Get Shadow Copy Properties

Context:
Execution Context: Coordinator
​

This error occurs four times within one second and appears to be occurring every 15 minutes; it just happened again.

I searched for the error on this site but didn't find much. One possible fix mentioned on a third-party site; I received 'not found' errors when I attempted to perform a few of the registrations. I've since rebooted, as directed in that post's comments section; so far, the above error hasn't re-appeared.

BTW, when I unlocked the console this morning, the system was basically unresponsive -- even though it hadn't had a BSOD. The clock in the system tray was current ... and I could depress the Starta button and apps on the taskbar ... and see the balloons over items in the system tray ... however, there was no response otherwise; no apps would load. I was able to select Restart from the Start menu, but there was no response, even after many minutes. I finally cycled the power. I've had this happen a number of times during this ordeal over the last few weeks.

This is an incredibly frustrating problem...and has realy soured my opinion of Windows 7. What's even more strange is that the system had been running fairly well (relatively speaking) with Windows 7 up until a few months ago -- when I formatted the drive and re-installed. What could be so different so as to cause such chaos now?

 

[Kaktussoft]

vssadmin list shadows