Hi everyone,
for some time now, I have been experiencing a wide variety of PC problems. It all started when I bought a new MoBo (MSI K8N Diamond), two new memory sticks (VData 512mb PC3200 DDR400) to work together with the memory I was already using (2x VData 512mb PC3200 DDR400), and an AMD Athlon X2 64 4400+. Immediately it became clear that the CPU was damaged (is sent back to AMD), so now I have borrowed an X2 4200+ from a friend, which works just lovely. However, I did get my fair share of BSOD errors: PFN_LIST_CORRUPT and DRIVER_IRQL_NOT_LESS_OR_EQUAL. Close examination revealed the newly bought modules were not exactly the same as the older ones, CL2.5 vs CL3, respectively. So now I am only using the two CL2.5 modules and hoped that would solve my problems. Well, not quite. At the moment my pc crashes randomly, showing me the following BSOD: DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1). While I was typing this message it happened as well…
I have checked the EventViewer in Windows, but no logs have been created for these crashes. I loaded the Minidump crash report into WinDbg and get a fingerprint of what's going wrong, but that info is beyond what I can understand. What I can tell is that every crash report is exactly identical, leaving me to hypothesise that it is just one problem, but that's just my speculation.
First, my system specs:
Mainboard: MSI K8N diamond
Power supply: Coolermaster Extrm Power 430W Voeding V2.
Memory: 1 GB (2 x 512 mb) VData PC3200 DDR400 CL2.5
VGA: Connect3D Radeon X800 GTO with an Arctic 5 cooler
HDD: Maxtor DiamondMax 10 160GB 7200rpm 8MB cache
Sound: Creative Soundblaster Audigy 2 zs
Netwerk: US Robotics WLAN
Software:
OS: Windows XP Professional
Anti-virus: Avast 4.7 Home Editie
Firewall: Outpost Firewall Pro ver. 3.51.759.6511 (462)
All hardware is using the latest drivers, mobo has the latest bios version and the software is also completely up-to-date.
Finally, the WinDbg bug analysis:
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini092306-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: C:\WINDOWS\system32
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sat Sep 23 15:53:41.937 2006 (GMT-6)
System Uptime: 0 days 1:27:50.644
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
...............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information. BugCheck 100000D1, {71a5df52, 2, 8, 71a5df52}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 71a5df52, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 71a5df52, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 0
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
71a5df52
CURRENT_IRQL: 2
FAULTING_IP:
+71a5df52
71a5df52 ?? ???
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 00000000 to 71a5df52
STACK_TEXT:
007ef078 00000000 006667a8 00000000 00000000 0x71a5df52
STACK_COMMAND: kb
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
0: kd> lmvm nt
start end module name
804d7000 806e2000 nt (export symbols) ntkrpamp.exe
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Tue Mar 01 17:34:38 2005 (42250A1E)
CheckSum: 001EE722
ImageSize: 0020B000
File version: 5.1.2600.2622
Product version: 5.1.2600.2622
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 5.1.2600.2622
FileVersion: 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
So, if anyone can help me out, I would appreciate it tremendously!!!
Kind regards,
Wouter Nijhof
for some time now, I have been experiencing a wide variety of PC problems. It all started when I bought a new MoBo (MSI K8N Diamond), two new memory sticks (VData 512mb PC3200 DDR400) to work together with the memory I was already using (2x VData 512mb PC3200 DDR400), and an AMD Athlon X2 64 4400+. Immediately it became clear that the CPU was damaged (is sent back to AMD), so now I have borrowed an X2 4200+ from a friend, which works just lovely. However, I did get my fair share of BSOD errors: PFN_LIST_CORRUPT and DRIVER_IRQL_NOT_LESS_OR_EQUAL. Close examination revealed the newly bought modules were not exactly the same as the older ones, CL2.5 vs CL3, respectively. So now I am only using the two CL2.5 modules and hoped that would solve my problems. Well, not quite. At the moment my pc crashes randomly, showing me the following BSOD: DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1). While I was typing this message it happened as well…
I have checked the EventViewer in Windows, but no logs have been created for these crashes. I loaded the Minidump crash report into WinDbg and get a fingerprint of what's going wrong, but that info is beyond what I can understand. What I can tell is that every crash report is exactly identical, leaving me to hypothesise that it is just one problem, but that's just my speculation.
First, my system specs:
Mainboard: MSI K8N diamond
Power supply: Coolermaster Extrm Power 430W Voeding V2.
Memory: 1 GB (2 x 512 mb) VData PC3200 DDR400 CL2.5
VGA: Connect3D Radeon X800 GTO with an Arctic 5 cooler
HDD: Maxtor DiamondMax 10 160GB 7200rpm 8MB cache
Sound: Creative Soundblaster Audigy 2 zs
Netwerk: US Robotics WLAN
Software:
OS: Windows XP Professional
Anti-virus: Avast 4.7 Home Editie
Firewall: Outpost Firewall Pro ver. 3.51.759.6511 (462)
All hardware is using the latest drivers, mobo has the latest bios version and the software is also completely up-to-date.
Finally, the WinDbg bug analysis:
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini092306-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: C:\WINDOWS\system32
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sat Sep 23 15:53:41.937 2006 (GMT-6)
System Uptime: 0 days 1:27:50.644
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
...............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information. BugCheck 100000D1, {71a5df52, 2, 8, 71a5df52}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 71a5df52, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 71a5df52, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 0
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
71a5df52
CURRENT_IRQL: 2
FAULTING_IP:
+71a5df52
71a5df52 ?? ???
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 00000000 to 71a5df52
STACK_TEXT:
007ef078 00000000 006667a8 00000000 00000000 0x71a5df52
STACK_COMMAND: kb
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
0: kd> lmvm nt
start end module name
804d7000 806e2000 nt (export symbols) ntkrpamp.exe
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Tue Mar 01 17:34:38 2005 (42250A1E)
CheckSum: 001EE722
ImageSize: 0020B000
File version: 5.1.2600.2622
Product version: 5.1.2600.2622
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 5.1.2600.2622
FileVersion: 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
So, if anyone can help me out, I would appreciate it tremendously!!!
Kind regards,
Wouter Nijhof
