Help! Blue Screen after Uninstall

HELP! Source Drive Blue Screen After Botched Cloning

This is getting ridiculous.

I tried to clone a 200GB vista x86 source drive to a new 300GB drive using True Image Workstation v9.1.x.
Both source drive and destination drives have exactly one partition. Upon reboot, True Image reported an error on writng(why the hell would you need to write to the source drive?) during step 1: clearing drive. I aborted the operation and rebooted back to the source vista x86 without any problem.

Now, since TIW is not working, I decided to uninstall it. Upon reboot, vista blue screened half way into the boot process. Multiple repair using vista install dvd did not fix the problem.

I can understand software not compatible with vista, but how can an uninstall corrupt the OS so bad that it cannot be fixed by simple means?

 

This is getting ridiculous.

True Image Workstation 9.1.x failed to clone my vista x86 drive due to a write error to the source drive during step 1: clearing drive.

I removed the destination drive and rebooted back to the source drive. Then I uninstalled TIW and rebooted to complete the uninstallation. Vista started to blue screen half way during boot. Repair with vista install dvd didn't work.

How can something like this happen? Help please.

 

Chances are this error is caused the un-installer leaving an "Upper Filters" entry in the registry. Upper Filters refer to driver files that are found in the Windows\System32\Drivers folder. The un-install most likely removed the driver file snapman.sys but left the "snapman" Upper Filter entry in the registry. On boot, Windows reads the Upper Filters lines in the registry and looks for the corresponding sys file. If it is missing you will get a BSOD.

This is a very easy fix, but a pain in the butt to describe. You can check for this situation by booting with the Vista DVD.

1. Boot with the Vista DVD.
2. Choose Repair Computer.
3. At the menu, choose Command Prompt. This will put you on a command line in WinPE 2.0.
4. Enter "regedit" without the quotes.
5. Highlight HKLM in the left pane.
6. Go to the File menu and choose Load Hive.
7. In the source box, navigate to the C: drive where Vista is installed. Drill down to C:\Windows\System32\Config. Choose the "System" entry. Hit Okay. In the next window name the hive "Remote System" without the quotes.
8. Hit the plus next to HKLM. You will see a key named "Remote System". Drill down to HKLM\Remote System\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}. Look in the right pane for an Upper Filters line. If you see "snapman" without the quotes, you need to delete it. Only delete snapman by using the Edit/Modify menu entry. Make sure any other Upper Filters remain.
9. You should also check HKLM\Remote System\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F} for Upper Filter entries. If you see snapman or timounter, remove them as well.
10. Now you must Unload the Remote System hive. Highlight it in the left pane. Go the the File menu and choose Unload Hive. This will save the changes in the Vista registry.


You could also get past the BSOD by copying snapman.sys into the c:\Windows\System32\Drivers folder. Again you can use the command prompt from the Vista DVD to do this.

If you found this situation chances are good your Vista will now boot normally. Good luck.

 

Thanks for the reply.
Tried it but it didn't work. There were indeed snapman entries in both keys.
I also verified that the entries were removed by restarting the vista repair/regedit.

Any other suggestions before I snap and reinstall vista from scratch?

 

Re: HELP! Source Drive Blue Screen After Botched Cloning

Can you boot into Vista's Safe Mode? If you can, you might check and make sure there are no TI services setup that didn't get removed in the uninstall. Maybe clear the registry of "Acronis" and "True Image" entries.

I'm guessing something was left in the uninstall that is crashing Vista when it's loading. I don't know if Vista's Repair option will fix that type of problem (it seems to not have in your case).

Uninstalling an "only" OS is usually not at option. If Vista is screwed up to the point it won't boot and repairs are not working, then the best thing would be to just reinstall. Delete the partition and create a new one or have Vista use the entire drive.

 

Too bad that didn't work.

Did you try copying snapman.sys back into C:\Windows\System32\Drivers? I've seen this solve a BSOD a few times after a bad install of TI when the file is missing. You can get the file a number of ways. If you have the ability, it can be extracted from the installer. There is also a snapapi.exe download from Acronis that is used to update the snapman driver. It can be extracted from the download. If all else fails, you can install TI in another system (XP is fine) and then uninstall it after you get the file.

If this works, we'll work further to pin down the source of the entry that is causing the system to search for snapman.sys and correct it.

Hey, who knows, maybe this isn't even related to Acronis at all.

 

Hello sunfish,

Thank you for choosing Acronis Workstation Disk Backup Software.

Could you please let us know the exact error message you have received? If it is possible please use a digital camera to make shots of the screen.

Also please let us know if it is possible to boot "Last Known Good Configuration" or "Safe mode" of Windows Vista.

Having collected the above information please submit a request for technical support. Attach all the collected files and information to your request along with the step-by-step description of the actions taken before the problem appears and the link to this thread. We will investigate the problem and try to provide you with a solution.

P.S. I have merged two threads you have started since they are about the same issue. Please try to avoid posting duplicate requests in the future as it makes us as well as other forum members do a double work sometimes.

Thank you.
--
Aleksandr Isakov

 

It wouldn't boot to safe mode but did boot with "Last Known Good Configuration".
snapman.sys was still in system32\drivers.

A few things:
1. the uninstall process remove a lowerFilters from the {4D36E967-E325-11CE-BFC1-08002BE10318} key;
2. under the "Last Known Good Configuration", snapman and timounter are both loaded;
3. I can reproduce the BSOD by removing snapman and timounter from the driver load list. The uninstall process was probably doing the same thing;
4. I didn't create two threads of the same thing -- your web site returned an error for the first post becasue I wasn't logged in;
5. Hope you guys have enough clues to help clean up my system. I feel like getting hit by a bullet and live, but as soon as I remove it I die.
6. I cloned my drive by using a piece of freeware. However, I still have to run a vista dvd repair to fix the winloader problem to make the drive bootable, but it's no big deal really.

 

Today I had the same problem uninstalling TI (Trial Enterprise 9.1 3854 /Windows Vista Ultimate), and solved by Mustang's solution

Thanks

 

Now this is getting interesting.

You mentioned the uninstall removed a lower filter from {4D36E967-E325-11CE-BFC1-08002BE10318}. Neither Vista nor TI installs a lower filter entry at this key. The lower filter was probably installed by another piece of software or a driver for a piece of hardware in your system. It could be the missing lower filter that caused the BSOD. You may have discovered a conflict between the TI uninstaller and that piece of software or hardware. Please post back with the name of the missing lower filter.

It would be very helpful to know what program or driver originally installed the lower filter. Here are some tips to help you pin it down:

1. Do a Google search for the name of the missing lower filter. See if you can see any references to a specific program or piece of hardware that you have in your system.

2. Trace the lower filter back through the registry. Search the registry for the lower filter name to see if you find any references to a manufacturer of one of your programs or a piece of hardware in your system. Look in HKLM\System\CurrentControlSet\Services and HKLM\System\CurrentControlSet\Enum and HKLM\System\CurrentControlSet\Enum\Root for manufacturer names associated with the lower filter.

 

Hi Jimmy,

Cool. Glad it worked.

 

The lowe filter "fvevol ecache" removed is actually in the other key.

I don't think the unwarranted removal of the lower filter by the TI uninstaller has anything to do with the problem since the problem pesists with or without that lower filter.

Essentially, TI 9.1.x cannot be uninstalled without casuing a BSOD on my computer.

Some more info:
1. VIA P4M800 chipset
2. Daemon Tools sptd driver installed
3. Core 2 Duo CPU with Disabled Bit ON
4. Nvidia Forceware 9719
5. Creative X-Fi Extreme driver

Btw, the BSOD message was stopped: 0x0000007B, no other info like .sys or .dll mentioned.

 

Other users have reported problems with True Image and Daemon Tools.

 

I agree. Fvevol and ecache are both Microsoft drivers included in the lower filters at {71A27CDD-812A-11D0-BEC7-08002BE2092F}. Frevol.sys is the driver for Bitlocker drive encryption included only in the Ultimate and Enterprise versions of Vista. Ecache.sys is a special memory cache driver called ReadyBoost Caching Device. I tried removing both of these lower filters from a Vista Ultimate system and it booted successfully. The system was slower to start, but it did boot.

As DwnNdrty mentioned, I do remember seeing something about the latest version of Daemon Tool sptd causing some problems. This may give you something to further investigate. I haven't looked into this problem myself.

Other than that, I don't know what else to tell you.

 

Here is the thread discussing Daemon Tools:

https://www.wilderssecurity.com/showthread.php?t=175955

 

Removed Daemon Tools and sptd (v1.39), rebooted, removed snapman, rebooted, BSOD.

Booted back to LKGC(DT and sptd not installed), installed TIW 9.1.x, rebooted, uninstalled TIW 9.1.x, rebooted, BSOD.

Also noticed that the TIW uninstall process left AcrSch2Svc in Automatic startup mode, which is a harmless nusiance.

 

You have a very unusual situation. It's common practice to uninstall TI before upgrading to a new version. Installing TI over the top of an existing installation is very untrustworthy. You must have some conflict with another program or a driver. If I were you, I would do a clean install of Vista to a spare hard drive without installing any other programs. Then try doing the install of TI and test if it works properly. Then uninstall it and see what happens.