STOP code when Norton is scanning

[Wai_Wai]

STOP code when Norton is scanning (?) (ver 2)

System Info:

- Wins XP Pro SP1

- Norton SystemWorks 2005 (including Utilities, Anti-Virus, CleanSweep)

============================================================================

The case is rather complex. I don't know if it is really related to Norton Anti-virus, or its other components, or even my hardware. Anyway the case is as follows:

Memtest told me my computer failed

Recently I ran memtest86 v3.1a (http://www.memtest86.com/). I found some errors in test 5 and 8. In fact, I could sometimes pass all tests with no errors, but sometimes not.

I wonder the following components are faulty:

- RAM (Kingmax DDR400 512MB*2. I got 2 RAM of the same brand and module)

- Motherboard (Asus A7N8X-X, non-deluxe one)

..<-- In fact I got A7N8X-VM/400 previously. But due to compatibility issues with my RAM said by Asus distributor, I exchanged this with A7N8X-X.

- AGP Display card (Asus Radeon a9200se)

Some relevant info:

- My sound card is on-board.

- My display card is on AGP. I only use one PCI, ie Ethernet network 10/100Mbps card.

- I don't have any USB or SCSI hard drive to my computer.

- I never overclock anything

Use programs to pinpoint the cause of trouble!!

Then I decided to run other stability/stress/benchmark tests. The programs I ran were:

- 3d mark 2001 SE (Passed. 4100-4300 marks. I've run for several times.)

- 3d mark 03 (Passed. 631 mark)

- Mother Monitor 5.3.7.0 (Below 50 degree. Voltage is stable.)

- Prime95 23.8.1

(http://www.mersenne.org/freesoft.htm)

[blend-mode stress test, with custom RAM usage (750-800MB). I've run for 3 times:

1st - 2 hrs. 1 error: 6BC84F91, expected E91EEB5A

2nd - 9 hrs. STOP code: DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1). Details shown in next paragraph

3rd - 5 hrs. No error.]

- By the way, how can I check the health of my HDD? I wonder if bad sector or other errors from HDD may cause problems.

How did the STOP code occur

It was the second time I ran Prime95. The programs I was running at that time:

- Norton Anti-virus 2005 (Scheduled full-system virus scan)

- Zone Alarm 5.5

- Prime 95 23.8.1

- Motherboard Monitor 5.3.7.0

- Yahoo Messenger &/or ICQ (Not sure if I was running either, or both)

- Windows Messenger (It just stayed i the system tray, and couldn't turn off. I didn't use it at all)

The PF usage: about 0.96GB (I got 1GB RAM)

When Norton scheduled full-system virus scan had been run for about 30 mins, a STOP code DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) occurred. A full memory dump was generated. I used Windows debugging tools to check the dump file. The analysis is at the end of my post.

Q:

Does anyone know which causes the problems of the memtest errors, and the STOP code?

Is it possible for a faulty driver to cause my computer failed to pass all memory tests in memtest?

Tell me if you need more information.

Memory Dump Analysis

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Microsoft ® Windows Debugger Version 6.4.0004.4

Copyright © Microsoft Corporation. All rights

reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]

Kernel Complete Dump File: Full address space is

available

Symbol search path is:

SRV*c:\symbols*http://msdl.microsoft.com/down...ols;C:/WINDOWS/Symbols

Executable search path is:

Windows XP Kernel Version 2600 (Service Pack 1) UP

Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp2.040919-1003

Kernel base = 0x804d5000 PsLoadedModuleList =

0x80550dd0

Debug session time: Fri Dec 24 21:11:06.593 2004

(GMT+8)

System Uptime: 0 days 11:24:52.197

Loading Kernel Symbols

....................................................................................................

.........................

Loading unloaded module list

................

Loading User Symbols

*******************************************************************************

*

*

* Bugcheck Analysis

*

*

*

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {ff4d8d4e, 2, 0, ff4d8d4e}

*** ERROR: Symbol file could not be found. Defaulted

to export symbols for SYMTDI.SYS -

Probably caused by : SYMTDI.SYS (

SYMTDI!DisconnectTCPSession+1da9 )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

*

*

* Bugcheck Analysis

*

*

*

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or

completely invalid) address at an

interrupt request level (IRQL) that is too high. This

is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: ff4d8d4e, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write

operation

Arg4: ff4d8d4e, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: ff4d8d4e Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:

+ffffffffff4d8d4e

ff4d8d4e ?? ???

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 084df1d9 to 8052ee23

SYMBOL_ON_RAW_STACK: 1

STACK_TEXT:

f7c72c98 084df1d9 0000000a f74d8d4e 00000002

nt!KeBugCheckEx+0x19

WARNING: Frame IP not in any known module. Following

frames may be wrong.

f7c72cb4 862e6af8 002e6af8 862e6af8 ffc72ce0 0x84df1d9

ff00005f 00000000 00000000 00000000 00000000

0x862e6af8

STACK_COMMAND: dds @$csp ; kb

FAILED_INSTRUCTION_ADDRESS:

+ffffffffff4d8d4e

ff4d8d4e ?? ???

FOLLOWUP_IP:

SYMTDI!DisconnectTCPSession+1da9

b2f7ba38 55 push ebp

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SYMTDI!DisconnectTCPSession+1da9

MODULE_NAME: SYMTDI

IMAGE_NAME: SYMTDI.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41705aad

FAILURE_BUCKET_ID:

0xD1_CODE_AV_BAD_IP_SYMTDI!DisconnectTCPSession+1da9

BUCKET_ID:

0xD1_CODE_AV_BAD_IP_SYMTDI!DisconnectTCPSession+1da9

Followup: MachineOwner

---------

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[getwired]

Because of the driver's name I'm inclined to think it isn't actually memory related - but I would try running one more memory test on it, this one - http://oca.microsoft.com/en/windiag.asp - to be sure.

What kind of NIC is in your system? Have you ever experienced any other blue screens on that system?