Webmaster: Please help me with updating the post.
After updating, please delete this post.
STOP code when Norton is scanning (?) [ver 4]
Basic System Info:
- Wins XP Pro SP1
- Norton SystemWorks 2005 (including Utilities, Anti-Virus, CleanSweep)
============================================================================
The case is rather complex. I don't know if it is really related to Norton Anti-virus, or its other components, or even my hardware.
It is very long. Look for the bold heading to spot out the information useful to you, or you can ask me about the relevant info and I will quote for you. Anyway the case is as follows:
Memtest told me my computer failed
Recently I ran memtest86 v3.1a (
http://www.memtest86.com/). I found some errors in some tests. The details are as follows:
Test 1: RAM A in DIMM1
I have run memtest for several times.
No error.
Test 2: RAM B in DIMM1
I have run memtest for several times.
No error.
Test 3: RAM A in DIMM2, RAM B in DIMM3
I have run memtest for several times.
Errors were sometimes detected, sometimes not.
Errors were found in test 5. 2-4 errors were once found, ranging from 996-1021MB
Errors were found in test 8. 2 errors were once found, in 1002.8 and 1017.3MB respectively.
Test 4: RAM B in DIMM2, RAM A in DIMM3
I have run memtest once.
Errors were detected!
Errors were found in test 10. 9 errors were found, ranging from 535-723MB.
From the above results, what implications could we draw?
I don't think the problems lies on DIMM slots, or it should give rise to a lot of errors, right?
I just don't know whether my RAM are faulty or not.
Should I ask the manufacturer for RAM replacement?
Info about my system
I wonder the following components are faulty:
- RAM (Kingmax DDR400 512MB*2. I got 2 RAM of the same brand and module)
- Motherboard (Asus A7N8X-X, non-deluxe one)
..<-- In fact I got A7N8X-VM/400 previously. But due to compatibility issues with my RAM said by Asus distributor, I exchanged this with A7N8X-X.
- AGP display card (Asus Radeon a9200se)
More Info:
Hardware:
- CPU: AMD Althon XP 2500+
- On-board sound card
- I only use one PCI, ie Ethernet network 10/100Mbps card.
- I use high-end HE-420 power supply unit (3 fans, max watt: 500)
- I don't have any USB or SCSI hard drive to my computer.
Software:
- Wins XP Pro SP1
- Norton SystemWorks 2005 (including Utilities, Anti-Virus, CleanSweep)
Other Issues:
- I never overclock anything
- IRQ issue: Asus technicans once said the sharing nature of IRQ is not a problem when we are using Wins XP. I don’t know if they are correct. Anyway I posted my IRQ table at the end of my post.
- I think I don't have overheating, insufficient pwoersupply problems.
Use programs to pinpoint the cause of trouble!!
Then I decided to run other stability/stress/benchmark tests. The programs I ran were:
- 3d mark 2001 SE (Passed. 4100-4300 marks. I've run for several times.)
- 3d mark 03 (Passed. 631 mark)
- Mother Monitor 5.3.7.0 (Below 50 degree. Voltage is stable.)
- Prime95 23.8.1
(
http://www.mersenne.org/freesoft.htm)
[Blend-mode stress test, with custom RAM usage (750-800MB). I've run for 3 times:
1st - 2 hrs. 1 error: 6BC84F91, expected E91EEB5A
2nd - 9 hrs. STOP code: DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1). Details shown in next paragraph
3rd - 5 hrs. No error.]
How did the STOP code occur
It was the second time I ran Prime95. The programs I was running at that time:
- Norton Anti-virus 2005 (Scheduled full-system virus scan)
- Zone Alarm 5.5
- Prime 95 23.8.1
- Motherboard Monitor 5.3.7.0
- Yahoo Messenger &/or ICQ (Not sure if I was running either, or both)
- Windows Messenger (It just stayed i the system tray, and couldn't turn off. I didn't use it at all)
The PF usage: about 0.96GB (I got 1GB RAM)
When Norton scheduled full-system virus scan had been run for about 30 mins, a STOP code DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) occurred. A full memory dump was generated. I used Windows debugging tools to check the dump file. The analysis is at the end of my post.
Q:
Does anyone know which causes the problems of the memtest errors, and the STOP code?
Is it possible for a faulty driver to cause my computer failed to pass all memory tests in memtest?
Tell me if you need more information.
===================================
Attachment:
- Memory Dump Analysis
- IRQ Table
Memory Dump Analysis
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft (R) Windows Debugger Version 6.4.0004.4
Copyright (c) Microsoft Corporation. All rights
reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is
available
Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols;C:/WINDOWS/Symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 1) UP
Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp2.040919-1003
Kernel base = 0x804d5000 PsLoadedModuleList =
0x80550dd0
Debug session time: Fri Dec 24 21:11:06.593 2004
(GMT+8)
System Uptime: 0 days 11:24:52.197
Loading Kernel Symbols
.............................................................................................................................
Loading unloaded module list
................
Loading User Symbols
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {ff4d8d4e, 2, 0, ff4d8d4e}
*** ERROR: Symbol file could not be found. Defaulted
to export symbols for SYMTDI.SYS -
Probably caused by : SYMTDI.SYS (
SYMTDI!DisconnectTCPSession+1da9 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or
completely invalid) address at an
interrupt request level (IRQL) that is too high. This
is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ff4d8d4e, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write
operation
Arg4: ff4d8d4e, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: ff4d8d4e Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
+ffffffffff4d8d4e
ff4d8d4e ?? ???
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 084df1d9 to 8052ee23
SYMBOL_ON_RAW_STACK: 1
STACK_TEXT:
f7c72c98 084df1d9 0000000a f74d8d4e 00000002
nt!KeBugCheckEx+0x19
WARNING: Frame IP not in any known module. Following
frames may be wrong.
f7c72cb4 862e6af8 002e6af8 862e6af8 ffc72ce0 0x84df1d9
ff00005f 00000000 00000000 00000000 00000000
0x862e6af8
STACK_COMMAND: dds @$csp ; kb
FAILED_INSTRUCTION_ADDRESS:
+ffffffffff4d8d4e
ff4d8d4e ?? ???
FOLLOWUP_IP:
SYMTDI!DisconnectTCPSession+1da9
b2f7ba38 55 push ebp
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: SYMTDI!DisconnectTCPSession+1da9
MODULE_NAME: SYMTDI
IMAGE_NAME: SYMTDI.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 41705aad
FAILURE_BUCKET_ID:
0xD1_CODE_AV_BAD_IP_SYMTDI!DisconnectTCPSession+1da9
BUCKET_ID:
0xD1_CODE_AV_BAD_IP_SYMTDI!DisconnectTCPSession+1da9
Followup: MachineOwner
---------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
IRQ
Resources---Device---Status
IRQ 0 System Clock OK
-
-
IRQ 3 [Ã
UserAgent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.5) Gecko/20041217 MultiZilla/1.8.0.0a
