TechSpot

XP: memorydump analysis after renewing hardware

By Y3PP3R
Apr 27, 2007
  1. Hey guys,

    I changed my proc from athlon 64 3200+ venice to a ahtlon 64 x2 3800+ yesterday, and my ram from 2 x twinmos 512mb pc3200 cl3 to 2x 1gb kingston pc3200 cl2, and my 2x Gf 6600GT (sli) to 1x Gf 7900GS. My mb is an Asus A8N-SLI Deluxe.

    Now, if I start windows xp (pro), my desktop loads and moments after, bsod with DRIVER_IRQL_NOT_LESS_OR_EQUAL thing, and it does a memorydump.

    So, I booted in safemode, that worked! I updated my proc driver from AMD, and my forceware, and copied the memory.dmp to a stick for analysis on my notebook.

    I also wanted to mention that my bios set the memory in 'auto detect' to CL3, so I manually set it to CL2. Do I have to change any of the other options too, if I do that?

    Anyway, the BSOD is still there. I was thinking about a wrong Hardware Abstraction Layer, but that's wrong I think, because I can boot to the desktop. Here is the !analyze -v log for my .dmp, hope anybody knows what to check next.

    Code:
    Microsoft (R) Windows Debugger  Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [I:\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available
    
    Symbol search path is: SRV*c:\dev\dbg cache*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_gdr.050301-1519
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
    Debug session time: Thu Apr 26 21:12:50.609 2007 (GMT+2)
    System Uptime: 0 days 0:01:23.234
    Loading Kernel Symbols
    ............................................................................................
    Loading User Symbols
    
    Loading unloaded module list
    .............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {81, 2, 0, 8a3cd358}
    
    Probably caused by : ntkrnlmp.exe ( nt!KiTrap0E+238 )
    
    Followup: MachineOwner
    ---------
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 00000081, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 8a3cd358, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS:  00000081 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    +ffffffff8a3cd358
    8a3cd358 0000            add     byte ptr [eax],al
    
    DEFAULT_BUCKET_ID:  DRIVER_FAULT
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  Idle
    
    TRAP_FRAME:  805563b4 -- (.trap ffffffff805563b4)
    ErrCode = 00000000
    eax=00000081 ebx=ffdff000 ecx=8a3cd34c edx=8a393e50 esi=ffdff9c0 edi=80560f00
    eip=8a3cd358 esp=80556428 ebp=80556428 iopl=0         nv up ei pl nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
    8a3cd358 0000            add     byte ptr [eax],al          ds:0023:00000081=??
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from 8a3cd358 to 804e0aac
    
    STACK_TEXT:  
    805563b4 8a3cd358 badb0d00 8a393e50 f759a406 nt!KiTrap0E+0x238
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    80556428 804dcd22 8a393e50 8a381000 00000000 0x8a3cd358
    80556450 804dcc07 00000000 0000000e 00000000 nt!KiRetireDpcList+0x61
    80556454 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!KiTrap0E+238
    804e0aac f7457000000200  test    dword ptr [ebp+70h],20000h
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nt!KiTrap0E+238
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  42250f77
    
    FAILURE_BUCKET_ID:  0xD1_nt!KiTrap0E+238
    
    BUCKET_ID:  0xD1_nt!KiTrap0E+238
    
    Followup: MachineOwner
    
    And an systemlog error that I think is wrong (also have an error for timeserver not able to sync and services not starting in safemode):
    Sorry, it's dutch, but you can get the numbers from it and source.
    Code:
    Type gebeurtenis: Fout
    Bron van gebeurtenis: sfsync02
    Categorie van gebeurtenis: Geen
    Gebeurtenis-ID: 12
    Datum: 27-4-2007
    Tijd: 1:09:43
    Gebruiker: n.v.t.
    Computer: JT-GAMEBAK
    Beschrijving: 
    Kan beschrijving voor gebeurtenis-ID (12) in bron (sfsync02) niet vinden. De lokale computer beschikt wellicht niet over de benodigde registergegevens of DLL-berichtbestanden om berichten van een externe computer te kunnen weergeven.
    
     
  2. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    It is due to a driver fault. Since you upgraded to a new video card I would first zero in on that and update your video card driver and see if that takes care of the issue.
     
  3. raybay

    raybay TS Evangelist Posts: 7,241   +9

    "Wrong abstraction layer..." Holy Moley.
    It could be any driver, as drivers are the most likely cause. It could be your messing with the autodetect for the memory. It could be bad memory.
    Go to your ASUS manual and double check everything, since you have made a major change... and you have some major errors reported.
     
  4. Y3PP3R

    Y3PP3R TS Rookie Topic Starter

    It's just, the only thing I could find about ntkrnlmp.exe in combination with my context, that HAL thing... I switched my RAM back and took my wifi card out and used bios defaults and autodetect, still there, so ít's the proc or the vga card. But then again, only in normal mode, not safemode, so it has to be a driver.
     
  5. Y3PP3R

    Y3PP3R TS Rookie Topic Starter

    *SOLVED: AMD Dualcore optimizer removed*
     
  6. raybay

    raybay TS Evangelist Posts: 7,241   +9

    Thank you for taking the time to update us.
     
  7. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    I second raybay's thank you. It is nice to help someone and it is really nice to hear when someone has resolved an issue.

    You are the first person I have come across the net that had issues with the AMD dual core optimizer. I am going to have to keep this filed away for future reference.

    Can you tell us how you came to the conclusion it was this and not something else? Thanks.
     
  8. Y3PP3R

    Y3PP3R TS Rookie Topic Starter

    Well, I installed it yesterday before I changed the hardware, together with the (new) amd proc driver. When I got the bsod the first thing I did was remove it in safe mode (I thought).

    Because I was looking for drivers and applications to disable to rule them out on startup I used MSCONFIG, and there it still was. So I did not remove it! When I googled 'dualcore optimizer DRIVER_IRQL_NOT_LESS_OR_EQUAL' there were a few persons with the same problem. I disabled it, rebooted, nothing wrong. Then wend to program files\amd\optimizer and dubbleclicked it... instant BSOD. That's the story. Thank god I did not start to reinstall windows right away.
     
  9. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    Cool. I'll have to remember what you did because I have just gotten an X2 3800+ to replace my 3200+ and I am running XP Pro SP/2.

    Thanks again.
     
  10. Y3PP3R

    Y3PP3R TS Rookie Topic Starter

    Yeah, as a summary:

    If you get DRIVER_IRQL_NOT_LESS_OR_EQUAL BSOD after installing AMD Dualcore Optimizer:

    Boot in safe-mode. The uninstaller does not work in safe mode, but go to start -> run and type 'msconfig' without the quotes. On the last page (startup in english?) uncheck the entry to the Dualcore Optimizer. Reboot and remove the optimizer in normal mode.
     
  11. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    Thanks! :grinthumb I always love learning something new. It is a good day when you can.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...