Intermittent BSOD on Windows 7 VM

[dlrubin]

Hi,

I just created a new Windows VM and it was working fine until recently, now I'm getting random BSODs a few times daily. I looked at the minidump file in WinDbg and seems related to volsnap.sys. Since the problem just started recently I wonder if it may be related to the VSS space filling up. I have 15% of my disk allocated for VSS
Thanks

 

[koolkat77]

Reduce the start-up items, Antivirus software is basically whats required.

• Remove Startup Programs in Windows 7
• Clean Startup in Windows 7

------------------------
Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow - read here

Run Disk Check on your Hard Drive for file system errors and bad sectors on it - read here
------------------------
Upload a screenshot using:

• CrystalDiskInfo:tip: For how to upload a screenshot or file, read here

Test your Hard Drive(s) by running:

• Hard Drive Diagnostic Procedure

------------------------
Make scans with these tools -

• TDSSKiller Rootkit Removal Utility Free Download | Kaspersky Lab US
• Online Virus Scanner Eset

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {64, 2, 1, 8a1b29b8}

*** WARNING: Unable to verify timestamp for prl_strg.sys
*** ERROR: Module load completed but symbols could not be loaded for prl_strg.sys
Probably caused by : volsnap.sys ( volsnap!VspReuseTableUpdateIrp+e )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000064, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8a1b29b8, address which referenced memory

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'usbvideo' and 'usbvideo.sys' overlap

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81baf84c
Unable to read MiSystemVaType memory at 81b8ee20
 00000064 

CURRENT_IRQL:  2

FAULTING_IP: 
volsnap!VspReuseTableUpdateIrp+e
8a1b29b8 895164          mov     dword ptr [ecx+64h],edx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TAG_NOT_DEFINED_c000000f:  FFFFFFFF80790000

TRAP_FRAME:  8078fd40 -- (.trap 0xffffffff8078fd40)
ErrCode = 00000002
eax=80df8008 ebx=8935f238 ecx=00000000 edx=860eef80 esi=00000000 edi=80df8008
eip=8a1b29b8 esp=8078fdb4 ebp=8078fdb4 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
volsnap!VspReuseTableUpdateIrp+0xe:
8a1b29b8 895164          mov     dword ptr [ecx+64h],edx ds:0023:00000064=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8a1b29b8 to 81a86b7f

STACK_TEXT:  
8078fd40 8a1b29b8 badb0d00 860eef80 81b7c6c0 nt!KiTrap0E+0x1b3
8078fdb4 8a1c631f 80df8008 8935f238 847a76f0 volsnap!VspReuseTableUpdateIrp+0xe
8078fde8 8a1c651c 8935f238 845b50d8 860a5570 volsnap!VspWriteVolumePhase32+0x55
8078fe04 8a1b8b62 00000000 86941468 00000000 volsnap!VspWriteVolumePhase3+0xc0
8078fe24 81abddd3 00000000 86941468 860a5570 volsnap!VspPerformanceWrapperCompletionRoutine+0x3c
8078fe68 8a3c2498 8078fe9c 8a3c2abd 845ab960 nt!IopfCompleteRequest+0x128
8078fe70 8a3c2abd 845ab960 86941468 00000001 CLASSPNP!ClassCompleteRequest+0x11
8078fe9c 81abddd3 00000000 85520ae0 01521cf0 CLASSPNP!TransferPktComplete+0x2e4
8078fee4 8a33716e 8a33a04c 00000000 85520ae0 nt!IopfCompleteRequest+0x128
WARNING: Stack unwind information not available. Following frames may be wrong.
8078ff00 8a3373e4 00000000 00000000 845aa9d4 prl_strg+0x316e
8078ff14 8a337422 845aa9d0 00000000 00000000 prl_strg+0x33e4
8078ff48 81abd675 840b5e5c 00000002 00000000 prl_strg+0x3422
8078ffa4 81abd4d8 81b70d20 83fd2798 00000000 nt!KiExecuteAllDpcs+0xf9
8078fff4 81abcc9c 807fc690 00000000 00000000 nt!KiRetireDpcList+0xd5
8078fff8 807fc690 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2c
81abcc9c 00000000 0000001a 00d6850f bb830000 0x807fc690


STACK_COMMAND:  kb

FOLLOWUP_IP: 
volsnap!VspReuseTableUpdateIrp+e
8a1b29b8 895164          mov     dword ptr [ecx+64h],edx

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  volsnap!VspReuseTableUpdateIrp+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: volsnap

IMAGE_NAME:  volsnap.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce788f5

FAILURE_BUCKET_ID:  0xD1_volsnap!VspReuseTableUpdateIrp+e

BUCKET_ID:  0xD1_volsnap!VspReuseTableUpdateIrp+e

Followup: MachineOwner
---------

 

[dlrubin]

Thanks very much for your help.
I have done all the steps you suggested and here are the results:

SFC /scannow : see below for log
Check HD for disk errors and sector errors: none found

CrystalDiskInfo: screenshot attached

Scans withTDSSkiller and online virus scanner: no infections

Any suggestions now?





Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
134144 file records processed. File verification completed.
457 large file records processed. 0 bad file records processed. 2 EA records processed. 68 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
175608 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
134144 file SDs/SIDs processed. Cleaning up 202 unused index entries from index $SII of file 0x9.
Cleaning up 202 unused index entries from index $SDH of file 0x9.
Cleaning up 202 unused security descriptors.
Security descriptor verification completed.
20733 data files processed. CHKDSK is verifying Usn Journal...
33781488 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
134128 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
56781783 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Windows has made corrections to the file system.

268331007 KB total disk space.
40901572 KB in 104003 files.
59176 KB in 20734 indexes.
0 KB in bad sectors.
243127 KB in use by the system.
65536 KB occupied by the log file.
227127132 KB available on disk.

4096 bytes in each allocation unit.
67082751 total allocation units on disk.
56781783 allocation units available on disk.

Internal Info:
00 0c 02 00 4c e7 01 00 32 7c 03 00 00 00 00 00 ....L...2|......
dc 01 00 00 44 00 00 00 00 00 00 00 00 00 00 00 ....D...........
40 f4 2b 00 50 01 2b 00 c8 1b 2b 00 00 00 2b 00 @.+.P.+...+...+.

Windows has finished checking your disk.
Please wait while your computer restarts.

 

[koolkat77]

Any new BSOD?

 

[dlrubin]

Not yet, but it's intermittent and will likely happen again. And I continually notice these errors in the eventvwr system tab: eventID 8 "The flush and hold writes operation on volume C: timed out while waiting for a release writes command." and these VSS errors below in the application tab. Any ideas?

Volume Shadow Copy Service error: The I/O writes cannot be held during the shadow copy creation period on volume \\?\Volume{0781ec58-2821-11e1-9781-806e6f6e6963}\. The volume index in the shadow copy set is 0. Error details: Open[0x00000000, The operation completed successfully.
], Flush[0x00000000, The operation completed successfully.
], Release[0x80042314, The shadow copy provider timed out while holding writes to the volume being shadow copied. This is probably due to excessive activity on the volume by an application or a system service. Try again later when activity on the volume is reduced.
], OnRun[0x00000000, The operation completed successfully.
].

Operation:
Executing Asynchronous Operation

Context:
Current State: DoSnapshotSet

----------------------------

Volume Shadow Copy Service error: Error calling a routine on the Shadow Copy Provider {b5946137-7b9f-4925-af80-51abd60b20d5}. Routine returned E_INVALIDARG. Routine details GetSnapshot({00000000-0000-0000-0000-000000000000},003C5AB0).

Operation:
Get Shadow Copy Properties

Context:
Execution Context: Coordinator

--------------------------------

 

[dlrubin]

I just got another BSOD from volsnap.sys again. attached is the minidump..
Any other suggestions?

 

[Arc]

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.