Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD - pssnap.sys - PAGE_FAULT_IN_NONPAGED_AREA - Macrium Reflect


  • Please log in to reply
3 replies to this topic

#1 aswiseman

aswiseman

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:42 PM

Posted 29 June 2018 - 05:31 PM

I recently ran Windows Update on Windows 7 Professional, as I do every few weeks. Everything seemed to go OK, until I restarted and after the animated flag logo formed up, I got a flash of a blue screen and an immediate restart.

 

Using F8 to prevent restarts, I was able to read the screen...

 

A problem has been detected and Windows has been shut down to prevent damage

to your computer.

 

 pssnap.sys

 

PAGE_FAULT_IN_NONPAGED_AREA

 

 

A quick Google shows this is caused by the interaction of Macrium Reflect (back-up software) and a Windows fix for SPECTRE.

 

I didn't think I still had Macrium installed, so it appears to have left behind the pssnap.sys, which is used at start-up time. Macrium have issued a fix which removes this file from start-up and new versions of the software no longer install it as a start up service...

 

https://knowledgebase.macrium.com/display/KNOW7/Windows+7+32+bit+BSOD+after+MS+Windows+Update

 

All well and good, but the fix doesn't work for me :-(

 

The fix involves booting from a Macrium-customised Windows PE and then running their removesnap.exe which I think alters the registry to prevent the c:\windows\system32\drivers\pssnap.sys from running.

 

It tells me it has run successfully, shows the path of the registry entry and eveything. But when I reboot, the BSOD is still there.

 

I have tried renaming pssnap.sys to pssnap.old. But when I reboot I still get the BSOD (but without the reference to pssnap.sys and the PAGE_FAULT_IN_NONPAGED_AREA).

 

I have also tried installing a later version of pssnap.sys (by getting a newer version of Reflect and putting it on another boot partition and copying this newer pssnap.sys over the older one.) I still get the error.

 

So I was wondering whether it's not working for me because I have a dual-boot (well multi-boot machine)?  I have an SSD with Win 7 and Win 10 plus a HDD with the old versions of Win 7 and Win 10 which were copied to the SSD.

 

Is it possible that the removesnap.exe doesn't know which installation to work on?

 

Do I need to change the broken Windows 7 to be the default boot partition first and then run all of this?

 

 

Any/all ideas gratefully received!


Edited by aswiseman, 29 June 2018 - 05:44 PM.


BC AdBot (Login to Remove)

 


#2 HonorGamer

HonorGamer

  • Malware Study Hall Sophomore
  • 65 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia
  • Local time:12:42 PM

Posted 29 June 2018 - 11:29 PM

If you are able to boot up in safe mode, follow this: https://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

#3 aswiseman

aswiseman
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:42 PM

Posted 30 June 2018 - 03:13 AM

Thanks for the reply!

 

I should have mentioned the blue screen also happens in Safe Mode :-(

I also tried the 'last known good' boot, but that didn't get me anywhere, either.



#4 axe0

axe0

  • Malware Study Hall Junior
  • 289 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Netherlands
  • Local time:06:42 PM

Posted 30 June 2018 - 08:41 AM

Could you provide the files in C:\Windows\Minidump, as a zip file, via a WinPE.
Kind regards,
Axe0




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users