About 4 days ago I started having BSOD. The minidumps point to volsnap.sys as the problem, but I dont know where to go from here. I also checked out system restore and its turned on for my hard drive, but there are no restore points created. Im guessing these are related? I have run sfc /scannow and chkdsk /r on the drive and both came back clean. Can someone help me figure out what I need to do next to resolve this, please? Thanks in advance! Here is the latest minidump file debugged: Microsoft (R) Windows Debugger Version 6.9.0003.113 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Documents and Settings\ejohnson.000\My Documents\minidumps\mw4 May 2013\050113-207278-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: C:\Windows\Symbols Executable search path is: Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.22280.amd64fre.win7sp1_ldr.130318-1534 Kernel base = 0xfffff800`02e07000 PsLoadedModuleList = 0xfffff800`0304b670 Debug session time: Wed May 1 12:59:27.960 2013 (GMT-5) System Uptime: 0 days 22:52:04.532 Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe Loading Kernel Symbols .................................................................................................................................................................................................... Loading User Symbols Loading unloaded module list .............................. Unable to load image \SystemRoot\system32\drivers\volsnap.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for volsnap.sys ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000007E, {ffffffffc0000005, fffff880015bc24e, fffff8800e5a4908, fffff8800e5a4160} Probably caused by : volsnap.sys ( volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x1a24e)+0 ) Followup: MachineOwner --------- 6: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff880015bc24e, The address that the exception occurred at Arg3: fffff8800e5a4908, Exception Record Address Arg4: fffff8800e5a4160, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". FAULTING_IP: volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x1a24e)+0 fffff880`015bc24e 44892490 mov dword ptr [rax+rdx*4],r12d EXCEPTION_RECORD: fffff8800e5a4908 -- (.exr 0xfffff8800e5a4908) ExceptionAddress: fffff880015bc24e (volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x1a24e)) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000001 Parameter[1]: 0000000000000000 Attempt to write to address 0000000000000000 CONTEXT: fffff8800e5a4160 -- (.cxr 0xfffff8800e5a4160) rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000007 rdx=0000000000000000 rsi=0000000000000002 rdi=fffff8800e5a4c98 rip=fffff880015bc24e rsp=fffff8800e5a4b40 rbp=0000000000000001 r8=0000000000000001 r9=0000000000000001 r10=fffff8800e5a4c5c r11=0000000000000007 r12=0000000000000110 r13=fffffa802094f128 r14=ffffffffffffffe0 r15=0000000000000000 iopl=0 nv up ei ng nz ac pe cy cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010293 volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x1a24e): fffff880`015bc24e 44892490 mov dword ptr [rax+rdx*4],r12d ds:002b:00000000`00000000=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". WRITE_ADDRESS: 0000000000000002 FAILED_INSTRUCTION_ADDRESS: +0 00000000`00000000 ?? ??? BUGCHECK_STR: 0x7E DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880015bc24e STACK_TEXT: fffff880`0e5a4b40 00000000`00000000 : 00000000`00000108 00000000`00000000 fffffa80`22de61b0 00000111`000004a3 : volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x1a24e) fffff880`0e5a4b48 00000000`00000108 : 00000000`00000000 fffffa80`22de61b0 00000111`000004a3 00000008`00000111 : 0x0 fffff880`0e5a4b50 00000000`00000000 : fffffa80`22de61b0 00000111`000004a3 00000008`00000111 fffff880`0e5a4c98 : 0x108 fffff880`0e5a4b58 fffffa80`22de61b0 : 00000111`000004a3 00000008`00000111 fffff880`0e5a4c98 00000000`000003b0 : 0x0 fffff880`0e5a4b60 00000111`000004a3 : 00000008`00000111 fffff880`0e5a4c98 00000000`000003b0 00000000`0000003b : 0xfffffa80`22de61b0 fffff880`0e5a4b68 00000008`00000111 : fffff880`0e5a4c98 00000000`000003b0 00000000`0000003b fffffa80`2094f198 : 0x111`000004a3 fffff880`0e5a4b70 fffff880`0e5a4c98 : 00000000`000003b0 00000000`0000003b fffffa80`2094f198 fffffa80`2094f128 : 0x8`00000111 fffff880`0e5a4b78 00000000`000003b0 : 00000000`0000003b fffffa80`2094f198 fffffa80`2094f128 00000000`00000c33 : 0xfffff880`0e5a4c98 fffff880`0e5a4b80 00000000`0000003b : fffffa80`2094f198 fffffa80`2094f128 00000000`00000c33 fffff880`0e5a4c98 : 0x3b0 fffff880`0e5a4b88 fffffa80`2094f198 : fffffa80`2094f128 00000000`00000c33 fffff880`0e5a4c98 00000000`00003837 : 0x3b fffff880`0e5a4b90 fffffa80`2094f128 : 00000000`00000c33 fffff880`0e5a4c98 00000000`00003837 fffff880`0e5a4d10 : 0xfffffa80`2094f198 fffff880`0e5a4b98 00000000`00000c33 : fffff880`0e5a4c98 00000000`00003837 fffff880`0e5a4d10 00000000`00000007 : 0xfffffa80`2094f128 fffff880`0e5a4ba0 fffff880`0e5a4c98 : 00000000`00003837 fffff880`0e5a4d10 00000000`00000007 fffff880`0e5a4c3c : 0xc33 fffff880`0e5a4ba8 00000000`00003837 : fffff880`0e5a4d10 00000000`00000007 fffff880`0e5a4c3c fffff880`015dc3fc : 0xfffff880`0e5a4c98 fffff880`0e5a4bb0 fffff880`0e5a4d10 : 00000000`00000007 fffff880`0e5a4c3c fffff880`015dc3fc 00000000`00000002 : 0x3837 fffff880`0e5a4bb8 00000000`00000007 : fffff880`0e5a4c3c fffff880`015dc3fc 00000000`00000002 fffff880`0e5a4c40 : 0xfffff880`0e5a4d10 fffff880`0e5a4bc0 fffff880`0e5a4c3c : fffff880`015dc3fc 00000000`00000002 fffff880`0e5a4c40 fffff880`0e5a4c20 : 0x7 fffff880`0e5a4bc8 fffff880`015dc3fc : 00000000`00000002 fffff880`0e5a4c40 fffff880`0e5a4c20 fffff880`0e5a4c60 : 0xfffff880`0e5a4c3c fffff880`0e5a4bd0 00000000`00000002 : fffff880`0e5a4c40 fffff880`0e5a4c20 fffff880`0e5a4c60 fffff880`0e5a4cf0 : volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x3a3fc) fffff880`0e5a4bd8 fffff880`0e5a4c40 : fffff880`0e5a4c20 fffff880`0e5a4c60 fffff880`0e5a4cf0 fffffa80`2094f128 : 0x2 fffff880`0e5a4be0 fffff880`0e5a4c20 : fffff880`0e5a4c60 fffff880`0e5a4cf0 fffffa80`2094f128 fffff880`0e5a4d10 : 0xfffff880`0e5a4c40 fffff880`0e5a4be8 fffff880`0e5a4c60 : fffff880`0e5a4cf0 fffffa80`2094f128 fffff880`0e5a4d10 0000006a`7afd8000 : 0xfffff880`0e5a4c20 fffff880`0e5a4bf0 fffff880`0e5a4cf0 : fffffa80`2094f128 fffff880`0e5a4d10 0000006a`7afd8000 0000003b`01d0fc00 : 0xfffff880`0e5a4c60 fffff880`0e5a4bf8 fffffa80`2094f128 : fffff880`0e5a4d10 0000006a`7afd8000 0000003b`01d0fc00 00000000`00000000 : 0xfffff880`0e5a4cf0 fffff880`0e5a4c00 fffff880`0e5a4d10 : 0000006a`7afd8000 0000003b`01d0fc00 00000000`00000000 000000ee`000003a7 : 0xfffffa80`2094f128 fffff880`0e5a4c08 0000006a`7afd8000 : 0000003b`01d0fc00 00000000`00000000 000000ee`000003a7 00000948`0000088b : 0xfffff880`0e5a4d10 fffff880`0e5a4c10 0000003b`01d0fc00 : 00000000`00000000 000000ee`000003a7 00000948`0000088b 00000b69`00000a33 : 0x6a`7afd8000 fffff880`0e5a4c18 00000000`00000000 : 000000ee`000003a7 00000948`0000088b 00000b69`00000a33 00000ecf`00000c33 : 0x3b`01d0fc00 fffff880`0e5a4c20 000000ee`000003a7 : 00000948`0000088b 00000b69`00000a33 00000ecf`00000c33 00000000`00000000 : 0x0 fffff880`0e5a4c28 00000948`0000088b : 00000b69`00000a33 00000ecf`00000c33 00000000`00000000 00000000`00000000 : 0xee`000003a7 fffff880`0e5a4c30 00000b69`00000a33 : 00000ecf`00000c33 00000000`00000000 00000000`00000000 00000000`00000001 : 0x948`0000088b fffff880`0e5a4c38 00000ecf`00000c33 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : 0xb69`00000a33 fffff880`0e5a4c40 00000000`00000000 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`23576010 : 0xecf`00000c33 fffff880`0e5a4c48 00000000`00000000 : 00000000`00000001 00000000`00000000 fffffa80`23576010 fffffa80`22eac550 : 0x0 fffff880`0e5a4c50 00000000`00000001 : 00000000`00000000 fffffa80`23576010 fffffa80`22eac550 fffffa80`2300a000 : 0x0 fffff880`0e5a4c58 00000000`00000000 : fffffa80`23576010 fffffa80`22eac550 fffffa80`2300a000 fffffa80`236ce000 : 0x1 fffff880`0e5a4c60 fffffa80`23576010 : fffffa80`22eac550 fffffa80`2300a000 fffffa80`236ce000 fffffa80`231d4000 : 0x0 fffff880`0e5a4c68 fffffa80`22eac550 : fffffa80`2300a000 fffffa80`236ce000 fffffa80`231d4000 fffffa80`2367d000 : 0xfffffa80`23576010 fffff880`0e5a4c70 fffffa80`2300a000 : fffffa80`236ce000 fffffa80`231d4000 fffffa80`2367d000 fffffa80`2300d000 : 0xfffffa80`22eac550 fffff880`0e5a4c78 fffffa80`236ce000 : fffffa80`231d4000 fffffa80`2367d000 fffffa80`2300d000 00000000`00000000 : 0xfffffa80`2300a000 fffff880`0e5a4c80 fffffa80`231d4000 : fffffa80`2367d000 fffffa80`2300d000 00000000`00000000 00000000`00000000 : 0xfffffa80`236ce000 fffff880`0e5a4c88 fffffa80`2367d000 : fffffa80`2300d000 00000000`00000000 00000000`00000000 fffff880`03369040 : 0xfffffa80`231d4000 fffff880`0e5a4c90 fffffa80`2300d000 : 00000000`00000000 00000000`00000000 fffff880`03369040 00000000`00000000 : 0xfffffa80`2367d000 fffff880`0e5a4c98 00000000`00000000 : 00000000`00000000 fffff880`03369040 00000000`00000000 fffffa80`1b8d1190 : 0xfffffa80`2300d000 fffff880`0e5a4ca0 00000000`00000000 : fffff880`03369040 00000000`00000000 fffffa80`1b8d1190 fffffa80`2094f100 : 0x0 fffff880`0e5a4ca8 fffff880`03369040 : 00000000`00000000 fffffa80`1b8d1190 fffffa80`2094f100 fffffa80`22de61b0 : 0x0 fffff880`0e5a4cb0 00000000`00000000 : fffffa80`1b8d1190 fffffa80`2094f100 fffffa80`22de61b0 fffffa80`2094f100 : 0xfffff880`03369040 fffff880`0e5a4cb8 fffffa80`1b8d1190 : fffffa80`2094f100 fffffa80`22de61b0 fffffa80`2094f100 00000000`00000080 : 0x0 fffff880`0e5a4cc0 fffffa80`2094f100 : fffffa80`22de61b0 fffffa80`2094f100 00000000`00000080 00000000`01d0fc00 : 0xfffffa80`1b8d1190 fffff880`0e5a4cc8 fffffa80`22de61b0 : fffffa80`2094f100 00000000`00000080 00000000`01d0fc00 fffff880`015ddfae : 0xfffffa80`2094f100 fffff880`0e5a4cd0 fffffa80`2094f100 : 00000000`00000080 00000000`01d0fc00 fffff880`015ddfae fffffa80`0001f700 : 0xfffffa80`22de61b0 fffff880`0e5a4cd8 00000000`00000080 : 00000000`01d0fc00 fffff880`015ddfae fffffa80`0001f700 fffffa80`1b8d1190 : 0xfffffa80`2094f100 fffff880`0e5a4ce0 00000000`01d0fc00 : fffff880`015ddfae fffffa80`0001f700 fffffa80`1b8d1190 fffff880`0e5a4d40 : 0x80 fffff880`0e5a4ce8 fffff880`015ddfae : fffffa80`0001f700 fffffa80`1b8d1190 fffff880`0e5a4d40 fffffa80`2094f178 : 0x1d0fc00 fffff880`0e5a4cf0 fffffa80`0001f700 : fffffa80`1b8d1190 fffff880`0e5a4d40 fffffa80`2094f178 0000003b`01d0fc00 : volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x3bfae) fffff880`0e5a4cf8 fffffa80`1b8d1190 : fffff880`0e5a4d40 fffffa80`2094f178 0000003b`01d0fc00 fffffa80`23811010 : 0xfffffa80`0001f700 fffff880`0e5a4d00 fffff880`0e5a4d40 : fffffa80`2094f178 0000003b`01d0fc00 fffffa80`23811010 fffff880`015ddee0 : 0xfffffa80`1b8d1190 fffff880`0e5a4d08 fffffa80`2094f178 : 0000003b`01d0fc00 fffffa80`23811010 fffff880`015ddee0 fffffa80`2094f100 : 0xfffff880`0e5a4d40 fffff880`0e5a4d10 0000003b`01d0fc00 : fffffa80`23811010 fffff880`015ddee0 fffffa80`2094f100 00000000`00000001 : 0xfffffa80`2094f178 fffff880`0e5a4d18 fffffa80`23811010 : fffff880`015ddee0 fffffa80`2094f100 00000000`00000001 fffff800`0311a64a : 0x3b`01d0fc00 fffff880`0e5a4d20 fffff880`015ddee0 : fffffa80`2094f100 00000000`00000001 fffff800`0311a64a 00000000`00000000 : 0xfffffa80`23811010 fffff880`0e5a4d28 fffffa80`2094f100 : 00000000`00000001 fffff800`0311a64a 00000000`00000000 fffffa80`235b6040 : volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x3bee0) fffff880`0e5a4d30 00000000`00000001 : fffff800`0311a64a 00000000`00000000 fffffa80`235b6040 00000000`00000080 : 0xfffffa80`2094f100 fffff880`0e5a4d38 fffff800`0311a64a : 00000000`00000000 fffffa80`235b6040 00000000`00000080 fffffa80`18735890 : 0x1 fffff880`0e5a4d40 00000000`00000000 : fffffa80`235b6040 00000000`00000080 fffffa80`18735890 fffffa80`18735890 : nt!_NULL_IMPORT_DESCRIPTOR <PERF> (nt+0x31364a) fffff880`0e5a4d48 fffffa80`235b6040 : 00000000`00000080 fffffa80`18735890 fffffa80`18735890 00000000`00000000 : 0x0 fffff880`0e5a4d50 00000000`00000080 : fffffa80`18735890 fffffa80`18735890 00000000`00000000 00000000`00000000 : 0xfffffa80`235b6040 fffff880`0e5a4d58 fffffa80`18735890 : fffffa80`18735890 00000000`00000000 00000000`00000000 fffff800`02e6b086 : 0x80 fffff880`0e5a4d60 fffffa80`18735890 : 00000000`00000000 00000000`00000000 fffff800`02e6b086 fffff880`03364180 : 0xfffffa80`18735890 fffff880`0e5a4d68 00000000`00000000 : 00000000`00000000 fffff800`02e6b086 fffff880`03364180 fffffa80`235b6040 : 0xfffffa80`18735890 fffff880`0e5a4d70 00000000`00000000 : fffff800`02e6b086 fffff880`03364180 fffffa80`235b6040 fffffa80`1bc1d6a0 : 0x0 fffff880`0e5a4d78 fffff800`02e6b086 : fffff880`03364180 fffffa80`235b6040 fffffa80`1bc1d6a0 00000000`00000000 : 0x0 fffff880`0e5a4d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDbgWriteCheck+0x5b FOLLOWUP_IP: volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x1a24e)+0 fffff880`015bc24e 44892490 mov dword ptr [rax+rdx*4],r12d SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: volsnap!_NULL_IMPORT_DESCRIPTOR <PERF> (volsnap+0x1a24e)+0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: volsnap IMAGE_NAME: volsnap.sys DEBUG_FLR_IMAGE_TIMESTAMP: 5080417e STACK_COMMAND: .cxr 0xfffff8800e5a4160 ; kb FAILURE_BUCKET_ID: X64_0x7E_NULL_IP_volsnap!_NULL_IMPORT_DESCRIPTOR__PERF__(volsnap+0x1a24e)+0 BUCKET_ID: X64_0x7E_NULL_IP_volsnap!_NULL_IMPORT_DESCRIPTOR__PERF__(volsnap+0x1a24e)+0 Followup: MachineOwner ---------

We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible. You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking. If you are overclocking stop. (chances are if you dont know if you are, you are not)a To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder. We need at least 2 DMP FILES to diagnose and confirm The procedure: * Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine. * Zip up the copy. * Attach the ZIP archive to your post using the "paperclip" (file attachments) button. (if available on your site, MS doesnt have this) *Please upload them to a file sharing service like Skydrive or"Rapidshare" and put a link to them in your reply. Link for how to upload below. http://www.wikihow.com/Use-SkyDrive To ensure minidumps are enabled: * Go to Start, in the Search Box type: sysdm.cpl, press Enter. * Under the Advanced tab, click on the Startup and Recovery Settings... button. * Ensure that Automatically restart is unchecked. * Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies). * Ensure that the Small Dump Directory is listed as %systemroot%\Minidump. * OK your way out. * Reboot if changes have been made. Please also run MSinfo32 and upload the output as well. To run MSinfo32 please go to start>run>MSinfo32 Go to "file" "save" and upload the saved file with the DMPS (Instructions for XP, Vista, Win 7, Win 8) System specs are extremely useful so please include whatever you know. Team Zigzag3143.com Wanikiya & Dyami -Team-ZigZag. www.ZigZag3143.com

https://dl.dropboxusercontent.com/u/35001640/dump%20files/050213-240319-01.dmp try that... this is the latest minidump. working on the system info.

https://dl.dropboxusercontent.com/u/35001640/msinfo32-20130504_1051.nfo here is the msinfo32 results... thanks in advance!

MW This crash was related to a memory exception (usually a driver) but did not ID the driver. I suspect it was Symantec and an easy way to find out would be to remove and replace it with MSE (at least to test). I am fairly sure it is not volsnap. Symantec is a frequent cause of BSOD's. I would remove and replace it with Microsoft Security Essentials AT LEAST TO TEST http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN For Norton 360 use thishttp://symantec.pcperformancetools.com/norton-360-how-to-uninstall.html http://www.microsoft.com/security_essentials/ If you continue to crash when it is removed please run the 2 below tests. These crashes were caused by memory corruption (probably a driver). Please run these two tests to verify your memory and find which driver is causing the problem. *Dont forget to upload any further DMP files (especially those when verifier is running) *If you are overclocking anything reset to default before running these tests. In other words STOP!!! If you dont know what this means you probably arent 1-Memtest. *Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. http://www.memtest.org *Boot from the CD, and leave it running for at least 5 or 6 passes. *Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot. *Test the sticks individually, and if you find a good one, test it in all slots. Any errors are indicative of a memory problem. If a known good stick fails in a motherboard slot it is probably the slot. 2-Driver verifier Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. *But sometimes it'll crash and won't tell you the driver. *Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier. *I'd suggest that you first backup your data and then make sure you've got access to another computer so you can contact us if problems arise. *Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature). Here is the procedure: - Go to Start and type in "verifier" (without the quotes) and press Enter - Select "Create custom settings (for code developers)" and click "Next" - Select "Select individual settings from a full list" and click "Next" - Select everything EXCEPT FOR "Low Resource Simulation" and click "Next" - Select "Select driver names from a list" and click "Next" *Then select all drivers NOT provided by Microsoft and click "Next" - Select "Finish" on the next page. *Reboot the system and wait for it to crash to the Blue Screen. *Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation. *If you can't get into Windows because it crashes too soon, try it in Safe Mode. *If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created. *Further Reading http://support.microsoft.com/kb/244617 This is a very common bugcheck. Usually the exception address pinpointsthe driver/function that caused the problem. Always note this addressas well as the link date of the driver/image that contains this address. If this happens, make sure a debugger gets connected, and thesystem is booted /DEBUG. This will let us see why this breakpoint ishappening.Arguments:Arg1: ffffffffc0000005, The exception code that was not handled0xC0000005: STATUS_ACCESS_VIOLATION indicates a memory access violation occurred. Wanikiya & Dyami -Team-ZigZag. www.ZigZag3143.com

were using Symantec Endpoint Security (enterprise) and its deployed to all computers in our organization. I dont think removing it is practical. also... how would symantec cause my system restore to not create the automatica restore points? Thanks

MW Noted. Since it isnt practical to remove Symantec the only was to track down the actual driver is by using Driver verifier. I would skip memtestWanikiya & Dyami -Team-ZigZag. www.ZigZag3143.com

ok, thanks... but it doesnt appear that system restore has been working properly, so how can I be sure that system restore will work if driver verifier messes things up?

Will do. Verifier is supposed to make your system crash so dont worry when it does. You might also want to run a system file check To run a system file check (SFC) Open an elevated cmd window (Go to start>type CMD>right click and run as administrator) Type SFC /scannow You may have to run this up to 3 times. http://support.microsoft.com/kb/929833 http://pcsupport.about.com/od/toolsofthetrade/ht/sfc-scannow.htm Wanikiya & Dyami -Team-ZigZag. www.ZigZag3143.com

ive run SFC once already with no errors found. so you are saying do verifier and then run SFC a few more times?

The one run of SFC should suffice. Do Verifier.Wanikiya & Dyami -Team-ZigZag. www.ZigZag3143.com

Hi, I am Chetan Savade from Symantec Technical Support Team. Issue hasn't occurred due to Symantec Endpoint Protection (SEP). You have not mentioned SEP version details so I checked SEP 11.x and SEP 12.1 fix notes till date. I don't see any BSOD issue related to volsnap.sys. SEP 11.x fix notes: http://www.symantec.com/docs/TECH174565 SEP 12.1 fix notes: http://www.symantec.com/docs/TECH163829 Regards, Chetan Savade Technical Support Engineer Symantec Corporation