Random BSOD every 6-7 hour

Hi -

Eset contributes in BSOD's.

Code:

Start Menu\Programs\ESET	Public:Start Menu\Programs\ESET	Public
Start Menu\Programs\ESET\ESET Smart Security	Public:Start Menu\Programs\ESET\ESET Smart Security	Public

Please remove it using its removal tool from here: Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

We recommended Microsoft Security Essentials from a strict BSOD perspective. Is most compatible & provides best stability compared to other antivirus app/Internet Security Software.

• Microsoft Security Essentials, Free antivirus for windows
• Malwarebytes Anti-Malware Free
• Good and Free system security combination

   Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.
Make scans with the following:

-Kaspersky TDSSKiller

• Anti-rootkit utility TDSSKiller

In addition, run the tools referred to in the tutorial below as well as WDO:

• How to Scan Suspicious Files using Online Scanners
• How to Use Windows Defender Offline

Perform a System File Check to check the integrity of all protected Windows 7 :

1. Click on the start
2. Type CMD on Search
3. Left click and Run as Administrator
4. Type
   Code:

   SFC /scannow

Full tutorial here:

• SFC /Scannow Command - System File Checker

Number down items at start-up. Keep only your anti-virus, this also improves the time for logging into windows.

• Startup Programs - Change
• Troubleshoot Application Conflicts by Performing a Clean Startup

Check your hard drive(s) for errors by running chkdsk

• Check your hard disk for errors
• Disk Check

Upload a screenshot of your hard disk using CrystalDiskInfo:

• CrystalDiskInfo Standard Edition
• How to Upload and Post a Screenshot and File in Seven Forums

Make a hard drive test from the hard drive manufacturers website:

• Hard Drive Diagnostic Procedure

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• RAM - Test with Memtest86+

   Note

Pay close attention to part 3 of the tutorial in order to rule out the faulty stick.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

If Memtest86+ does not find any errors with ram run Windows Memory Diagnostics for 7-8 passes following its tutorial:

• Memory Diagnostics Tool

Let us know the results.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {c0, 2, 1, fffff8800183ff5d}

Probably caused by : volsnap.sys ( volsnap!VspWriteVolumePhase32+5d )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000000000c0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800183ff5d, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003514100
GetUlongFromAddress: unable to read from fffff800035141c0
 00000000000000c0 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
volsnap!VspWriteVolumePhase32+5d
fffff880`0183ff5d 48898ac0000000  mov     qword ptr [rdx+0C0h],rcx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TAG_NOT_DEFINED_c000000f:  FFFFF80004822FB0

TRAP_FRAME:  fffff8000481c330 -- (.trap 0xfffff8000481c330)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa80066e3320
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800183ff5d rsp=fffff8000481c4c0 rbp=0000000000000000
 r8=00000000000078f0  r9=0000000000000000 r10=fffff80003266000
r11=0000000000000306 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
volsnap!VspWriteVolumePhase32+0x5d:
fffff880`0183ff5d 48898ac0000000  mov     qword ptr [rdx+0C0h],rcx ds:00000000`000000c0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032db1e9 to fffff800032dbc40

STACK_TEXT:  
fffff800`0481c1e8 fffff800`032db1e9 : 00000000`0000000a 00000000`000000c0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`0481c1f0 fffff800`032d9e60 : 00000000`00000000 00000000`00100111 00000000`00000000 00000000`0010ab7a : nt!KiBugCheckDispatch+0x69
fffff800`0481c330 fffff880`0183ff5d : fffffa80`03ddc470 00000000`031baa18 fffffa80`047f0680 00000000`0010ab7a : nt!KiPageFault+0x260
fffff800`0481c4c0 fffff880`018401fe : fffffa80`047f0680 00000000`00000000 fffffa80`03ddc470 00000000`00000000 : volsnap!VspWriteVolumePhase32+0x5d
fffff800`0481c520 fffff880`0182a7d5 : fffffa80`0658e250 fffffa80`0394a010 fffffa80`04712190 fffffa80`04712190 : volsnap!VspWriteVolumePhase3+0xee
fffff800`0481c560 fffff800`032df6d1 : fffffa80`0658e6cb 00000000`00000000 00000000`00000000 fffffa80`0658e250 : volsnap!VspPerformanceWrapperCompletionRoutine+0x55
fffff800`0481c5b0 fffff880`0190dbce : fffffa80`075d2c50 00000000`00001001 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff800`0481c6a0 fffff800`032df6d1 : 00000000`00000000 fffffa80`03640e00 fffffa80`075d2c50 fffff800`03222156 : CLASSPNP!TransferPktComplete+0x1ce
fffff800`0481c720 fffff880`00c8f41a : 00000000`00001000 00000000`00000001 fffffa80`06aeb990 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff800`0481c810 fffff880`00c8f242 : fffffa80`06aeb990 fffff880`00c91b53 fffffa80`075d2b80 fffffa80`041281b0 : ataport!IdeCompleteScsiIrp+0x62
fffff800`0481c840 fffff880`00c89e32 : 00000000`00000000 00000000`00000000 fffffa80`0363f500 fffffa80`041281b0 : ataport!IdeCommonCrbCompletion+0x5a
fffff800`0481c870 fffff880`00c92805 : fffffa80`0363e1a0 fffffa80`06aeb990 00000000`00000000 fffffa80`06aeb990 : ataport!IdeTranslateCompletedRequest+0x236
fffff800`0481c9a0 fffff880`00c92104 : fffffa80`0363e1a0 00000000`00000000 fffffa80`0363e1a0 00000000`00000000 : ataport!IdeProcessCompletedRequests+0x4d5
fffff800`0481cad0 fffff800`032e63fc : fffff800`03457e80 fffff800`03457e80 fffffa80`0363e050 fffffa80`0363e118 : ataport!IdePortCompletionDpc+0x1a8
fffff800`0481cb90 fffff800`032d394a : fffff800`03457e80 fffff800`03465cc0 00000000`00000000 fffff880`00c91f5c : nt!KiRetireDpcList+0x1bc
fffff800`0481cc40 00000000`00000000 : fffff800`0481d000 fffff800`04817000 fffff800`0481cc00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
volsnap!VspWriteVolumePhase32+5d
fffff880`0183ff5d 48898ac0000000  mov     qword ptr [rdx+0C0h],rcx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  volsnap!VspWriteVolumePhase32+5d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: volsnap

IMAGE_NAME:  volsnap.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce792c8

FAILURE_BUCKET_ID:  X64_0xD1_volsnap!VspWriteVolumePhase32+5d

BUCKET_ID:  X64_0xD1_volsnap!VspWriteVolumePhase32+5d

Followup: MachineOwner
---------

0: kd> k
Child-SP          RetAddr           Call Site
fffff800`0481c1e8 fffff800`032db1e9 nt!KeBugCheckEx
fffff800`0481c1f0 fffff800`032d9e60 nt!KiBugCheckDispatch+0x69
fffff800`0481c330 fffff880`0183ff5d nt!KiPageFault+0x260
fffff800`0481c4c0 fffff880`018401fe volsnap!VspWriteVolumePhase32+0x5d
fffff800`0481c520 fffff880`0182a7d5 volsnap!VspWriteVolumePhase3+0xee
fffff800`0481c560 fffff800`032df6d1 volsnap!VspPerformanceWrapperCompletionRoutine+0x55
fffff800`0481c5b0 fffff880`0190dbce nt!IopfCompleteRequest+0x341
fffff800`0481c6a0 fffff800`032df6d1 CLASSPNP!TransferPktComplete+0x1ce
fffff800`0481c720 fffff880`00c8f41a nt!IopfCompleteRequest+0x341
fffff800`0481c810 fffff880`00c8f242 ataport!IdeCompleteScsiIrp+0x62
fffff800`0481c840 fffff880`00c89e32 ataport!IdeCommonCrbCompletion+0x5a
fffff800`0481c870 fffff880`00c92805 ataport!IdeTranslateCompletedRequest+0x236
fffff800`0481c9a0 fffff880`00c92104 ataport!IdeProcessCompletedRequests+0x4d5
fffff800`0481cad0 fffff800`032e63fc ataport!IdePortCompletionDpc+0x1a8
fffff800`0481cb90 fffff800`032d394a nt!KiRetireDpcList+0x1bc
fffff800`0481cc40 00000000`00000000 nt!KiIdleLoop+0x5a