[SOLVED] SFC fail, WinRE options fail, volsnap.sys corrupt? How to run SFCfix.exe in WinRE?

Kayem68 · Mar 29, 2016

Hello, My Windows 10 Automatic Repair fails to repair problems on boot.
SFC /Scannow runs to completion with a response of "Windows Resource Protection could not perform the requested operation."
From WinRE: Tried all Startup Settings, Startup Repair, even System Restore and both "keep my files" and "remove everything" fail.

-System Restore would find no restore points while drive was encrypted. After unencrypting System Restore found 1 restore point (possibly the date things went haywire?) but I get a memory error when attempting to restore.

-System Image Recovery finds no images which I don't think is surprising, I don't think an image ever existed on the laptop to my knowledge.

-Startup Repair runs for a while but states "Startup Repair couldn't repair your PC"directs me to c:\windows\system32\logfiles\srt\srttrail.txt which states "Root cause found: Boot critical file c:\windows\system32\drivers\volsnap.sys is corrupt."

I suspect this happened after an update but I don't know for sure because I shutdown (fastboot and faststartup disabled) one night and upon booting the next day I was prompted for my BitLocker key. Gave it the key but just went through all the failed repair attempts.
I suspected that BitLocker may be getting in the way so I decrypted the drive so that is out of the way but still have same issues.

Tried to run SFCfix.exe in WinRE which seems to be the only environment I can get working and get "The subsystem needed to support the image type is not present."

Not sure where to turn next? Any help is appreciated.

Kayem68 · Mar 30, 2016

Not sure if this will be helpful but attached are my srttrail.txt and CBS folder prior to running SFCfix.exe

zcomputerwiz · Apr 1, 2016

Do you know what type of disk you have in your computer (e.g. Seagate 1TB HDD, Samsung SSD, etc.)?

Kayem68 · Apr 3, 2016

zcomputerwiz said:
Do you know what type of disk you have in your computer (e.g. Seagate 1TB HDD, Samsung SSD, etc.)?

SSD, it is listed in the BIOS as
LITEONIT LMT-256L9M-11 MSATA 256GB

zcomputerwiz · Apr 6, 2016

Could you zip and upload the VolSnap.sys file from the machine to a file sharing service (OneDrive, DropBox, SendSpace, etc.) and include the link here?

Kayem68 · Apr 6, 2016

zcomputerwiz said:
Could you zip and upload the VolSnap.sys file from the machine to a file sharing service (OneDrive, DropBox, SendSpace, etc.) and include the link here?

Just attached it as it is quite small.

zcomputerwiz · Apr 7, 2016

It looks like a section of the file has been modified. Do you know if this machine had been infected?

Try renaming the one on the machine (something like volsnap.bad) and then copy this one in: View attachment volsnap_good.zip

Kayem68 · Apr 11, 2016

Good news! The computer booted right up after replacing the volsnap.sys file.
No, I don't think it has been infected but it's hard to say something like that definitively.
I'll throw a bunch of scanners at it to make sure its clean.

THANKS, I'll report back my findings...

zcomputerwiz · Apr 11, 2016

Very good! I'll mark the thread solved.

Please let me know if you encounter any problems and I will continue to assist you.

Kayem68 · Apr 13, 2016

Not finding any rootkits or malware from my scans so far. I'll throw a couple more scanners at it but I think you solved my issue.
Thanks, I'll be hitting the donate button next.

Thx again.

Search

Search

[SOLVED] SFC fail, WinRE options fail, volsnap.sys corrupt? How to run SFCfix.exe in WinRE?

Kayem68

Contributor

Kayem68

Contributor

Attachments

zcomputerwiz

Windows Update Expert

Kayem68

Contributor

zcomputerwiz

Windows Update Expert

Kayem68

Contributor

Attachments

zcomputerwiz

Windows Update Expert

Kayem68

Contributor

zcomputerwiz

Windows Update Expert

Kayem68

Contributor