May be causing problem with a driver at shut down

[Paul44070]

I only mention this for your information, since I doubt that CleanMem is at fault here.
I'm guessing that a driver does not know that CleanMem has freed up memory.

Using Debugging Tools for Windows on a Minidump file shows that the driver:
symsnap.sys
which is a part of "Norton Save and Restore", is named as the likely cause of some BSOD's that I have seen at Windows shut-down.

********************************************
*                                                                            *
*                        Bugcheck Analysis                            *
*                                                                            *
********************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff4, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80580bef, If non-zero, the instruction address which referenced the bad memory
   address.
Arg4: 00000000, (reserved)

The entire Minidump file is available on request.
-------------------------------
I suspect that the driver is trying to address memory that CleanMem has freed-up, so I have stopped using the CleanMem program as a test to see what happens.
So far I have not had any more BSOD's at shutdown.
I use Norton's Live Update, so if there is an updated version of this driver I should have received it.
-------------------------------
Win XP Pro SP3
StorageCraft Volume Snap-Shot   (Verified) Symantec Corporation   c:\winnt\system32\drivers\symsnap.sys
Size: 134 K
Time: 5/7/2008 3:59 PM
Version: 7.0.16.26305
StorageCraft Volume Snap-Shot

[Shane]

Cleanmem only does the running processes. it tells window which process by the process id. drivers and dll's dont have an id so i am not able to clean those.

I also have a lot of cleanmem users with nortons save and restore who have no trouble.

when i get home tonight i will help you dig into it and lets find the cause 

Shane

[Shane]

I am finding all kinds of info for symsnap.sys BSOD's on nortons website.

This person has the same version of the file as you with crashes.
http://www.symantec.com/connect/forums/besr-bsod

Shows that having the version 6 file on other machines dont have the blue screen.

Shane

[Paul44070]

Seems like the ones that I've found are from people who are using Backup Exec and Windows Server OS.
I've been using Save and Restore for quite a while on my XP machine, and it's only relatively recently that I started getting BSOD's just before the machine's power light should go off.

As I said, I think it's a problem with their driver trying to access memory after CleanMem has been used.
I'm going to give it a few more days, and try a few more shutdowns, before I use CleanMem again.
I don't normally do shutdowns if I can avoid it, but use Suspend mode whenever possible.
Hate that startup time on this old machine!

[Shane]

How odd that it is during shutdown that it crashes and not during the backup.

Disable cleanmem from the task scheduler and see how things doe

I know cleanmem isn't cleaning the driver itself, perhaps the Norton process then?
You can always add the Norton processes to cleanmem's ignore list

Shane

[Paul44070]

How odd that it is during shutdown that it crashes and not during the backup.

I read one other report from someone who also had the BSOD occur (involving the same driver) "within 1 second" of the machine's power turning off. No help there, though.
I've tried at least 2 shutdowns since my last use of CleanMem: no BSOD's so far.

Disable cleanmem from the task scheduler and see how things doe

I disabled the scheduled task a long time ago. I would usually right-click the tray icon and clean memory when I exited all of the the programs that I was running, if memory usage hadn't dropped to the mid 30's.

I know cleanmem isn't cleaning the driver itself, perhaps the Norton process then?
You can always add the Norton processes to cleanmem's ignore list

I didn't realize that there was an ignore list. I'll look into that when I start using the program again.
Thanks.

[Shane]

CleanMem_Settings.exe will give you some extra options.

If it is cleanmem causing it, this will be the first program

Or it could be more of a side effect of something, who knows. When windows is shutting down all the programs are closed anyways. The drivers are the last thing to close down. So any of the programs cleanmem would have cleaned are already closed.

The driver has already done its work and windows is telling it to stop and close. Then you have your Blue screen.

That driver file is the same they use in the backup exec.

This is a long shot, but its always good to cover all the bases just to be sure. Have you ran a memory tester at all yet?
Chances of it being bad memory are low though, given the fact the system runs fine normally and this is only at shut down.

Shane

[Paul44070]

I shut-down Windows again, after using a virtualization program: no problems.
Then booted from a Memtest 86+ v4.10 CD, and ran through 1-1/2 passes of all of the tests before I exited: no memory errors.
I'll probably start using CleanMem again tomorrow.

[Shane]

Let me know how it goes.

If you get a blue screen when you shut down try adding any Norton process or service to the ignore list and see how it goes

Shane

[Paul44070]

There have been no problems over the last couple of days. All (5 or 6?) shutdowns have been orderly.
I've run CleanMem manually with programs running in the foreground and with no programs running in the foreground. CleanMem has cleaned memory at least twice on its own, after memory in use reached 75%.
One of the 3 BSOD's that I previously experienced occurred on the same day as a hard drive backup, so I'll check that scenario in a few days.
No "ignore" settings have been set.

[Shane]

Let me know how it goes

Blue screen is coming from somewhere. You said it is during a drive backup. Have you check the drive for any bad sectors yet?
Again, just want to cover all bases.

Shane

[Paul44070]

Blue screen is coming from somewhere. You said it is during a drive backup. Have you check the drive for any bad sectors yet?

That particular BSOD occurred following a successful backup. At the time my backup USB drive would not Safely Disconnect, so I would shut-down Windows after the backup in order to disconnect the drive.
Two files on the drive were preventing the drive from being safely disconnected - files that are associated with Norton AV.

As with the other BSOD's, it seemed like the power light should be going out just before the BSOD occurred.
Of course, that's subjective: that it was that close to going out.
Once the blue screen showed up, a tap on the power button immediately shut off the power.

[Shane]

I could see the blue screen happening because if the usb drive is disconnected by windows while the driver still had a hold on those files then it would cause the driver to crash.

You said it was the Norton antivirus that had the lock. Perhaps a test would be is to have the Norton AV ignore the usb drive?
If the AV isn't scanning the usb driver perhaps it will allow it to finally disconnect as well?

A few years back when I use to use Norton I found a bug in their AV. I posted in their forum and a fix for it and they posted my fix on their site lol.

The bug was with the page file. When you had the page file set to a certain size say 2048mb the AV wouldn't let it get to that size. It kept it at only 300mb for some reason. The fix? To simply have the AV ignore the page file. Once that was done the page file grew to the proper size.

This was the corp version of the AV though.

I know you didn't ask but I told you anyways LOL

Shane

[Paul44070]

I should be so lucky. My Norton Scan Exclusions already include the entire drive (H:).

No matter what I do, there are still 2 "System" locks on files:
H:\System Volume Information\EfaData\SYMEFA.DB <-- a Symantec file
H:\System Volume Information\MountPointManagerRemoteDatabase
I've tried disabling the Norton AV auto-protect before a disconnect, but that didn't help.
I've also read about this problem at the Symantec Community web site, and tried everything that was suggested there.

Turned off System Restore; used "Unlocker" to delete the locks, which come right back again. The Windows Indexing Service is turned off, and I can't even remember what other settings I've changed in order to Safely Disconnect the drive.
So, as I said, I have been shutting down Windows before disconnecting it.
I haven't had any problems while he drive is being used.

[Shane]

Thats the main reason I left Norton a long time ago. It is amazing how deep their software gets into windows. When something breaks it is a nightmare.

Currently for my customers who like the free router I use Microsoft security essentials for the AV and Fbackup for backups
http://www.fbackup.com/

Had pretty could success with both of those over Norton. But that is simply my opinion and you should follow what you want

It looks like both of those files are the Norton backup related and not AV
http://community.norton.com/t5/Norton-360/SYMEFA-SYS-Blue-Screen/td-p/162081/page/3

And since those files are locked you cant disconnect the USB safely or those 2 files might become corrupt.

Shane