BSOD Volsnap.sys randomly occurring in XP

[tjfs]

So far I've run CHKDSK, set pagefile to 0, defragged and then recreated it, and swapped out all the RAM with other RAM.

Crashed anything up to 6 times a day, randomly.

I wonder if it's something to do with Syncplicity? I'm not running volume shadowing (I have XP SP3 fully patched)

Typical crash report highlights:

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.

READ_ADDRESS: a6a30ffc

CURRENT_IRQL: 2

FAULTING_IP:
VolSnap!VspWriteVolume+c7

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

STACK_TEXT:
f7a217f4 f759f9dd 86a08bd0 86ae6248 86a08bd4 VolSnap!VspWriteVolume+0xc7
f7a21854 f759ebbf 00ae6248 86a08bd4 86c6ede0 VolSnap!VspAcquireNonPagedResource+0xad
f7a21870 804ee129 879360d8 86ae632c 869bf598 VolSnap!VolSnapWrite+0x1d3
f7a21880 f71dc92e 86c6efdc 8786e608 87118dd0 nt!IopfCallDriver+0x31
f7a21948 f71d0a8a 8786e608 86c6ede0 87118dd0 Ntfs!NtfsPagingFileIo+0x370
f7a21b3c f71cec18 8786e608 86c6ede0 86c6ede0 Ntfs!NtfsCommonWrite+0x458
f7a21ba0 f73c0aea 878d3020 86c6ede0 86c6ede0 Ntfs!NtfsFsdWrite+0xf3

I can attach a minidump if that would help anyone.

Tim

[bbearren]

Have you tried running

sfc /scannow

to correct any corrupt/damaged system files?

[ms5655]

I'd uninstall Syncplicity and see if that helps. If so try the sync tool here http://www.microsoft.com/windowsxp/D...powertoys.mspx

[r.kotvis]

I'm not running volume shadowing

The file volsnap.sys is related to the Volume Shadow Copy Service. Are you sure this service isn't running? I'm not familiar with Syncplicity, but I wouldn't be surprised if the program relies on this service. "DRIVER_FAULT" seems to indicate that the file has become corrupt, possibly during the installation of Syncplicity.

If your hard drive contains a backup for volsnap.sys (on a system running XP SP3 you may find it in C:\WINDOWS\ServicePackFiles\i386), compare the size and 'date modified' for the backup file with the file in C:\WINDOWS\system32\drivers. If they're different, you've probably located the problem. The next step would be to stop the Volume Shadow Copy Service, rename the C:\WINDOWS\system32\drivers\volsnap.sys file to something like volsnap.sys.old (I wouldn't recommend deleting the file until you are absolutely certain the problem has been solved), copy the backup file to the C:\WINDOWS\system32\drivers folder and restart the Volume Shadow Copy Service.

If there's no backup for volsnap.sys on your system you may be able to obtain it from another machine running XP SP3.

Be aware that although this - hopefully - prevents your computer from displaying blue screens, Syncplicity will probably have to be reinstalled before you can use it again.