bugchecks and blue screens IRQL... plz help

hey

I'm posting here cause to what I read in some threads some of you guys look very good with debuging that kind of stuff, and I'm getting quite lost as I don't know where to look now that the RAM is out of cause for my problem.

That's a new PC, experiencing bugchecks, and some IRQL_DRIVER_NOT_LESS_OR_EQUAL crashes. I brought it back to the shop, they updated RAID drivers, but no chance. I tested the RAM the last 24 hours when I was away with memtest, and in 55 passes, not a single error.

I can't figure out where that comes from, and any help would be much appreciated, or I'll have to bring that PC back to the shop (and it's heavy, the shop's far, and I'm not sure they're so good there :( )

I'm attaching my minidumps to the message, if specs or anything more needed, pleas ask.

Would be very appreciated if someone could have a look thanks

BTW I updated my profile with specs, as read in message to new people

you can find my CPU-Z here:
http://www.abcdef.ch/perso/cpuz/cpuz.htm

and my OS is WinXP home

by the way, CPU-Z shows the RAM at 400MHz, but it should be 800MHz (and actually is in the BIOS), what does this mean ?

hey

I love your forums, in two days I found more infos, todos and small reasons to hope than on all other forums I tried before. I found many starts of explanation, but I don't have the trained eyes to go to the right conclusion.
So, following the procedure here http://forums.majorgeeks.com/showthread.php?t=35246 that I found on another thread, I did analyze my minidumps a bit. I'll copy down a short version of them, keeping only what seems to be important to my n00b's eyes. If info is missing, the text export of Windbg is attached to this post.

I had this one three times, two times it came from smc.exe, sygate personal firewall (now bought by Norton :(), once it was caused by svchost.exe, in which case the exception_code is different (see below).

Windbg extracts:

BugCheck 1000008E, {c0000005, 8054a51a, 9f66fc94, 0}
Probably caused by : memory_corruption

---------

0: kd> !analyze -v
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8054a51a, The address that the exception occurred at
Arg3: 9f66fc94, Trap Frame
Arg4: 00000000

Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExFreePoolWithTag+23a
8054a51a 668b4efa mov cx,word ptr [esi-6]
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x8E
PROCESS_NAME: Smc.exe


/************************/
/* now the svchost exception: */
/************************/

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
nt!IoCreateFile+77
80575797 ff ???

/*****************************/

All three tell me as BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT.

I also had a look at the BSOD and it gave me that:

/*****************************/

Unable to load image ha20x2k.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for ha20x2k.sys
*** ERROR: Module load completed but symbols could not be loaded for ha20x2k.sys

BugCheck 100000D1, {224, 2, 0, a1c400e7}

Probably caused by : ha20x2k.sys ( ha20x2k+a60e7 )

0: kd> !analyze -v
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Arguments:
Arg1: 00000224, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: a1c400e7, address which referenced memory

Debugging Details:
------------------
READ_ADDRESS: 00000224
CURRENT_IRQL: 2
FAULTING_IP:
ha20x2k+a60e7
a1c400e7 8b8324020000 mov eax,dword ptr [ebx+224h]
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: BF2.exe
LAST_CONTROL_TRANSFER: from 00000000 to a1c400e7
STACK_TEXT:
bacc7dc4 00000000 898ca8d4 00000f97 a5ef6844 ha20x2k+0xa60e7
STACK_COMMAND: kb
FOLLOWUP_IP:
ha20x2k+a60e7
a1c400e7 8b8324020000 mov eax,dword ptr [ebx+224h]

SYMBOL_STACK_INDEX: 0


BUCKET_ID: 0xD1_ha20x2k+a60e7


So, I read something on your forums about that ha20x2ks.sys file from X-Fi causing BSOD, and maybe I'll have a problem with that too, but as the crashes seem to happen with different softwares (my firewall and svchost for the moment) and that memory_corruption is a term that appears quite some times here, I wonder if the guilty would be the RAM (which passed memtest 55 times for the memories), and if this default makes happen the other ones (so maybe my firewall is still ok ?).

Now what should I do next ? How can I know which stick is guilty if they pass memtest ? Should I try one stick at a time and try see which one causes the crashes and take that back to the shop ? Or should I go into software solutions (change my firewall, don't know what to do for svchost.exe and try to solve that ha20x2k.sys thing?)

Any advise would make my day...

Check www.soundblaster.com for an update for your sound card. Your driver date is the 1st of June, there's an update dated the 19th of Sep, but there's more than one version of that card.

And yes, check each stick one at a time (7 passes is enough).

thanks for your answer, I'll go watch that. I still would have one question as I see mainly memory_corruption AND smc.exe in my dumps.

So the question will be: is it more likely that a failing application/driver makes a wrong "memory_corruption" diagnostic, or that a corrupted memory makes a wrong guiltiness on an application/driver ?

I uninstalled my firewall yesterday for windows default firewall... , and had not a crash in the evening (well I already had evenings without crashes before, but two days ago I had 3 crashes in one evening...). Btw anyone could give me a good soft firewall working a bit like Sygate personal, that means: easy to configure, not done by Norton or Microsoft, and not too expensive ?