• Fun with Acronis sludge (snapman.sys)

    From Paul@3:633/10 to All on Mon May 25 19:22:08 2026
    I have a dual boot SSD in the Daily Driver machine.
    Most of the time, I'm booted to Windows 11.
    But a second OS, Windows 10, contains my copy of Visual Studio,
    which I use for the occasional short program compiles.

    So I attempt to boot, and instead of Windows 10 booting,
    I get a complaint about:

    tdrpman.sys # Original error 0xC0000428. When you take this out of the
    # picture, then the really bad news shows up...

    snapman.sys # Upper (and lower) filter driver, in storage stacks, deadly when it fails.
    # This is a "tendrils" problem, where a nasty thing that gets into
    # everything, is broken. Removing this, absolutely won't work.

    To cut a long story short, I used Safe Mode, which I have installed
    in my Boot Menu. Original, I was laser focused on just using vanilla Safe Mode (which didn't work). I actually went off and had a nap, as I needed
    time to think about what kind of storage device I would need to
    escape from snapman. I had a run-in with snapman years ago, it is
    a driver which Acronis adds to things. Originally, not even Acronis
    knew how to remove it, but a poster in their forum explained the
    order needed for removal (so it would not jam and break the machine
    before the cleanup was complete). Acronis eventually incorporated the
    forum poster advice, so later versions of Acronis products, could
    *remove* snapman properly (as some products by Acronis, relied on
    snapman being out of the way).

    This download, last released Jan 2026, cleans up various things,
    such as snapman.sys and tdrpman.sys . But you need to tip the OS
    upright enough, to be able to use this. For example, you would
    run this, after you had used an Acronis Trial Product.

    Name: Acronis cleanup tool.exe
    Size: 8,387,384 bytes (8190 KiB)
    SHA256: E0F003BDC091191BC349368DCC2D329E9F71775CCDC8D9EF3905DB45802B5353

    So my order of recovery, the steps were:

    1) Attempt to boot, select the Win10 row in my boot menu, then
    press F8 (as I have Safe Mode installed). If you want Safe Mode
    installed, you can do this with bcdedit. Don't wait until the last minute,
    in case you have trouble doing a BCD edit while using the offline method
    (Command Prompt from the installer DVD or Rufus stick).

    If you were doing it offline, it's like this, adding F8.

    # F8 boot menu for Windows 10, using Command Prompt window in Troubleshooting section of DVD

    dir /AH C:\boot\BCD # verify it is there.

    bcdedit /store C:\boot\BCD /set {bootmgr} displaybootmenu True

    If Windows is running at the moment, using Command Prompt Administrator.
    (Occasionally, bcdedit commands executed in Powershell, fail for syntax reasons.)

    bcdedit /set {bootmgr} displaybootmenu True

    When you boot, there will be a black WinXP-era boot menu, but with F8 near the bottom.

    2) Now, when your Win10 breaks because of Acronis and some sort of signing issue
    that just decides to bite today, you can

    Highlight the Win10 boot item (so F8 knows which OS you want)

    Press F8, the Safe Mode choice screen appears

    Press "7" to disable driver signing.

    3) Now, you're in. Go to Control Panels (control.exe), Programs and Features
    and select removal of the thing that installed snapman. I don't have any
    Acronis trials, only Seagate DiscWizard cloning software was installed for test.
    I selected "remove" and Seagate DiscWizard indicates that you must reboot right
    away, for the uninstallation phase to complete (which presumably involves the
    "many services" that Acronis likes to inject).

    4) Boot back into Windows 10. This time, you should not need F8 and "7",
    just try to bring up the OS in normal mode now.

    Next, use "Acronis cleanup tool.exe", selecting "Y" for each step, so it
    can remove stuff. Even though Seagate DiscWizard was the culprit, Acronis
    can still scan for its services fleet for removal. It will ask you if you
    want to kill File Explorer. Everything except the Acronis Terminal will
    turn black, but this is OK, as Acronis will restart File Explorer for you
    moments later and your desktop wallpaper will come back. You will again be
    queried about rebooting, and this gives a second opportunity for the "services squad"
    to be removed.

    5) When Windows 10 comes up this time, you will be clear of Acronis (or whatever
    product that uses Acronis). Seagate had DiscWizard, which is Acronis TIH, and
    Western Digital has a software offering of the same thing (just with their
    own name for it).

    Anyway, I wasn't too happy earlier this afternoon, and if there is some
    reason this bit me today, it would be good if others are prepared for
    this with their own F8 key. Instead of having to get F8 some other way.

    Acronis is the only company, where their reach extends past their grasp,
    and as soon as snapman showed up as an error at boot time, I knew
    what the hell orbit I'd fallen into -- an Acronis-inspired orbit.
    My Win10 is now back to normal. My objective, was to not have to hand
    edit the Registry while "offline", as that was an alternative method
    suggested for cleanup.

    This could just as easily have happened on Win11, but I don't
    think I have any snapman on this OS :-)

    Paul




    --- PyGate Linux v1.5.15
    * Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)
  • From ....winston@3:633/10 to All on Mon May 25 21:41:51 2026
    On 05/25/2026 7:22 PM, Paul wrote:
    I have a dual boot SSD in the Daily Driver machine.
    Most of the time, I'm booted to Windows 11.
    But a second OS, Windows 10, contains my copy of Visual Studio,
    which I use for the occasional short program compiles.

    So I attempt to boot, and instead of Windows 10 booting,
    I get a complaint about:

    tdrpman.sys # Original error 0xC0000428. When you take this out of the
    # picture, then the really bad news shows up...

    snapman.sys # Upper (and lower) filter driver, in storage stacks, deadly when it fails.
    # This is a "tendrils" problem, where a nasty thing that gets into
    # everything, is broken. Removing this, absolutely won't work.

    To cut a long story short, I used Safe Mode, which I have installed
    in my Boot Menu. Original, I was laser focused on just using vanilla Safe Mode
    (which didn't work). I actually went off and had a nap, as I needed
    time to think about what kind of storage device I would need to
    escape from snapman. I had a run-in with snapman years ago, it is
    a driver which Acronis adds to things. Originally, not even Acronis
    knew how to remove it, but a poster in their forum explained the
    order needed for removal (so it would not jam and break the machine
    before the cleanup was complete). Acronis eventually incorporated the
    forum poster advice, so later versions of Acronis products, could
    *remove* snapman properly (as some products by Acronis, relied on
    snapman being out of the way).

    This download, last released Jan 2026, cleans up various things,
    such as snapman.sys and tdrpman.sys . But you need to tip the OS
    upright enough, to be able to use this. For example, you would
    run this, after you had used an Acronis Trial Product.

    Name: Acronis cleanup tool.exe
    Size: 8,387,384 bytes (8190 KiB)
    SHA256: E0F003BDC091191BC349368DCC2D329E9F71775CCDC8D9EF3905DB45802B5353

    So my order of recovery, the steps were:

    1) Attempt to boot, select the Win10 row in my boot menu, then
    press F8 (as I have Safe Mode installed). If you want Safe Mode
    installed, you can do this with bcdedit. Don't wait until the last minute,
    in case you have trouble doing a BCD edit while using the offline method
    (Command Prompt from the installer DVD or Rufus stick).

    If you were doing it offline, it's like this, adding F8.

    # F8 boot menu for Windows 10, using Command Prompt window in Troubleshooting section of DVD

    dir /AH C:\boot\BCD # verify it is there.

    bcdedit /store C:\boot\BCD /set {bootmgr} displaybootmenu True

    If Windows is running at the moment, using Command Prompt Administrator.
    (Occasionally, bcdedit commands executed in Powershell, fail for syntax reasons.)

    bcdedit /set {bootmgr} displaybootmenu True

    When you boot, there will be a black WinXP-era boot menu, but with F8 near the bottom.

    2) Now, when your Win10 breaks because of Acronis and some sort of signing issue
    that just decides to bite today, you can

    Highlight the Win10 boot item (so F8 knows which OS you want)

    Press F8, the Safe Mode choice screen appears

    Press "7" to disable driver signing.

    3) Now, you're in. Go to Control Panels (control.exe), Programs and Features
    and select removal of the thing that installed snapman. I don't have any
    Acronis trials, only Seagate DiscWizard cloning software was installed for test.
    I selected "remove" and Seagate DiscWizard indicates that you must reboot right
    away, for the uninstallation phase to complete (which presumably involves the
    "many services" that Acronis likes to inject).

    4) Boot back into Windows 10. This time, you should not need F8 and "7",
    just try to bring up the OS in normal mode now.

    Next, use "Acronis cleanup tool.exe", selecting "Y" for each step, so it
    can remove stuff. Even though Seagate DiscWizard was the culprit, Acronis
    can still scan for its services fleet for removal. It will ask you if you
    want to kill File Explorer. Everything except the Acronis Terminal will
    turn black, but this is OK, as Acronis will restart File Explorer for you
    moments later and your desktop wallpaper will come back. You will again be
    queried about rebooting, and this gives a second opportunity for the "services squad"
    to be removed.

    5) When Windows 10 comes up this time, you will be clear of Acronis (or whatever
    product that uses Acronis). Seagate had DiscWizard, which is Acronis TIH, and
    Western Digital has a software offering of the same thing (just with their
    own name for it).

    Anyway, I wasn't too happy earlier this afternoon, and if there is some reason this bit me today, it would be good if others are prepared for
    this with their own F8 key. Instead of having to get F8 some other way.

    Acronis is the only company, where their reach extends past their grasp,
    and as soon as snapman showed up as an error at boot time, I knew
    what the hell orbit I'd fallen into -- an Acronis-inspired orbit.
    My Win10 is now back to normal. My objective, was to not have to hand
    edit the Registry while "offline", as that was an alternative method suggested for cleanup.

    This could just as easily have happened on Win11, but I don't
    think I have any snapman on this OS :-)

    Paul



    Possibly the free, included version provided by Seagate or Western
    Digital or something else.

    ATI 2025 Perpetual(5 License) installed in both o/s on my dual boot
    (Win10 Pro 22H2 ESU, Win11 Pro 25H2) Samsung 500 GB SSD, device also has
    4 TB HD. Note: The 500 GB SSD is mostly for testing, the primary boot
    on the device is the 256 GB Micron SSD with only Win11 Pro 25H2 which
    can easily be swapped via switching sata/power cable.

    No issues booting into either os.

    Fyi...tdrpman.sys and snapman.sys are not present on this device with
    ATI 2025 Perpetual, though iirc, they are included in ATI 2025
    Perpetual's 'Try and Decide' included feature which is not installed or enabled.



    --
    ...w­¤?ñ?¤

    --- PyGate Linux v1.5.15
    * Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)