xp memorydump - new hardware

**Y3PP3R** · April 27th, 2007, 06:38 AM

Hey guys,

I changed my proc from athlon 64 3200+ venice to a ahtlon 64 x2 3800+ yesterday, and my ram from 2 x twinmos 512mb pc3200 cl3 to 2x 1gb kingston pc3200 cl2, and my 2x Gf 6600GT (sli) to 1x Gf 7900GS. My mb is an Asus A8N-SLI Deluxe.

Now, if I start windows xp (pro), my desktop loads and moments after, bsod with DRIVER_IRQL_NOT_LESS_OR_EQUAL thing, and it does a memorydump.

So, I booted in safemode, that worked! I updated my proc driver from AMD, and my forceware, and copied the memory.dmp to a stick for analysis on my notebook.

I also wanted to mention that my bios set the memory in 'auto detect' to CL3, so I manually set it to CL2. Do I have to change any of the other options too, if I do that?

Anyway, the BSOD is still there. I was thinking about a wrong Hardware Abstraction Layer, but that's wrong I think, because I can boot to the desktop. Here is the !analyze -v log for my .dmp, hope anybody knows what to check next.

Code:

Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [I:\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\dev\dbg cache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Thu Apr 26 21:12:50.609 2007 (GMT+2)
System Uptime: 0 days 0:01:23.234
Loading Kernel Symbols
............................................................................................
Loading User Symbols

Loading unloaded module list
.............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {81, 2, 0, 8a3cd358}

Probably caused by : ntkrnlmp.exe ( nt!KiTrap0E+238 )

Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000081, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8a3cd358, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  00000081 

CURRENT_IRQL:  2

FAULTING_IP: 
+ffffffff8a3cd358
8a3cd358 0000            add     byte ptr [eax],al

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  Idle

TRAP_FRAME:  805563b4 -- (.trap ffffffff805563b4)
ErrCode = 00000000
eax=00000081 ebx=ffdff000 ecx=8a3cd34c edx=8a393e50 esi=ffdff9c0 edi=80560f00
eip=8a3cd358 esp=80556428 ebp=80556428 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
8a3cd358 0000            add     byte ptr [eax],al          ds:0023:00000081=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8a3cd358 to 804e0aac

STACK_TEXT:  
805563b4 8a3cd358 badb0d00 8a393e50 f759a406 nt!KiTrap0E+0x238
WARNING: Frame IP not in any known module. Following frames may be wrong.
80556428 804dcd22 8a393e50 8a381000 00000000 0x8a3cd358
80556450 804dcc07 00000000 0000000e 00000000 nt!KiRetireDpcList+0x61
80556454 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTrap0E+238
804e0aac f7457000000200  test    dword ptr [ebp+70h],20000h

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiTrap0E+238

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  42250f77

FAILURE_BUCKET_ID:  0xD1_nt!KiTrap0E+238

BUCKET_ID:  0xD1_nt!KiTrap0E+238

Followup: MachineOwner

And an systemlog error that I think is wrong (also have an error for timeserver not able to sync and services not starting in safemode):
Sorry, it's dutch, but you can get the numbers from it and source.

Code:

Type gebeurtenis: Fout
Bron van gebeurtenis: sfsync02
Categorie van gebeurtenis: Geen
Gebeurtenis-ID: 12
Datum: 27-4-2007
Tijd: 1:09:43
Gebruiker: n.v.t.
Computer: JT-GAMEBAK
Beschrijving: 
Kan beschrijving voor gebeurtenis-ID (12) in bron (sfsync02) niet vinden. De lokale computer beschikt wellicht niet over de benodigde registergegevens of DLL-berichtbestanden om berichten van een externe computer te kunnen weergeven.

**NooNoo** · April 27th, 2007, 01:06 PM

Welcome to Windrivers Y3pp3r

If you set the ram back to cl3, does the bsod go away?

Can you please translate Kan beschrijving voor gebeurtenis-ID (12) in bron (sfsync02) niet vinden. De lokale computer beschikt wellicht niet over de benodigde registergegevens of DLL-berichtbestanden om berichten van een externe computer te kunnen weergeven.

You seem to have something called "StarForce Protection System" which is the software that uses sfsync02. you could try their removal tool to see if that solves the problem.

**Y3PP3R** · April 27th, 2007, 01:18 PM

I allready placed my old RAM back and set it back to autodetect, still the same. I'll try the removal tool.

Originally Posted by NooNoo

Can you please translate Kan beschrijving voor gebeurtenis-ID (12) in bron (sfsync02) niet vinden. De lokale computer beschikt wellicht niet over de benodigde registergegevens of DLL-berichtbestanden om berichten van een externe computer te kunnen weergeven.

Translation:
Cannot find description for event-id 12 in source sfsync02. Possibly the local computer doesn't have the necessary registerdata or dll-messagefiles to report messages from remote computers.