STOP code when Norton is scanning

[Wai_Wai]

STOP code when Norton is scanning (?)
System Info:
- Wins XP Pro SP1
- Norton SystemWorks 2005 (including Utilities, Anti-Virus, CleanSweep)

============================================================================

The case is rather complex. I don't know if it is really related to Norton Anti-virus, or its other components, or even my hardware. Anyway the case is as follows:

Memtest told me my computer failed
Recently I ran memtest86 v3.1a (http://www.memtest86.com/). I found some errors in test 5 and 8. In fact, I could sometimes pass all tests with no errors, but sometimes not.

I wonder the following components are faulty:
- RAM (Kingmax DDR400 512MB*2. I got 2 RAM of the same brand and module)
- Motherboard (Asus A7N8X-X, non-deluxe one)
..<-- In fact I got A7N8X-VM/400 previously. But due to compatibility issues with my RAM said by Asus distributor, I exchanged this with A7N8X-X.
- Display card (Asus Radeon a9200se)


Use programs to pinpoint the cause of trouble!!
Then I decided to run other stability/stress/benchmark tests. The programs I ran were:
- 3d mark 2001 SE (Passed. 4100-4300 marks. I've run for several times.)
- 3d mark 03 (Passed. 631 mark)
- Mother Monitor 5.3.7.0 (Below 50 degree. Voltage is stable.)
- Prime95 23.8.1
(http://www.mersenne.org/freesoft.htm)
[Blend-mode stress test, with custom RAM usage (750-800MB). I've run for 3 times:
1st - 2 hrs. 1 error: 6BC84F91, expected E91EEB5A
2nd - 9 hrs. STOP code: DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1). Details shown in next paragraph
3rd - 5 hrs. No error.]


How did the STOP code occur
It was the second time I ran Prime95. The programs I was running at that time:
- Norton Anti-virus 2005 (Scheduled full-system virus scan)
- Zone Alarm 5.5
- Prime 95 23.8.1
- Motherboard Monitor 5.3.7.0
- Yahoo Messenger &/or ICQ (Not sure if I was running either, or both)
- Windows Messenger (It just stayed i the system tray, and couldn't turn off. I didn't use it at all)

The PF usage: about 0.96GB (I got 1GB RAM)

When Norton scheduled full-system virus scan had been run for about 30 mins, a STOP code DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) occurred. A full memory dump was generated. I used Windows debugging tools to check the dump file. The analysis is at the end of my post.

Q:
Does anyone know which causes the problems of the memtest errors, and the STOP code?
Is it possible for a faulty driver to cause my computer failed to pass all memory tests in memtest?

Tell me if you need more information.


Memory Dump Analysis
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft (R) Windows Debugger Version 6.4.0004.4
Copyright (c) Microsoft Corporation. All rights
reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is
available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/s...INDOWS/Symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 1) UP
Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp2.040919-1003
Kernel base = 0x804d5000 PsLoadedModuleList =
0x80550dd0
Debug session time: Fri Dec 24 21:11:06.593 2004
(GMT+8)
System Uptime: 0 days 11:24:52.197
Loading Kernel Symbols
.................................................................................................... .........................
Loading unloaded module list
................
Loading User Symbols
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {ff4d8d4e, 2, 0, ff4d8d4e}

*** ERROR: Symbol file could not be found. Defaulted
to export symbols for SYMTDI.SYS -
Probably caused by : SYMTDI.SYS (
SYMTDI!DisconnectTCPSession+1da9 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or
completely invalid) address at an
interrupt request level (IRQL) that is too high. This
is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ff4d8d4e, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write
operation
Arg4: ff4d8d4e, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: ff4d8d4e Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:
+ffffffffff4d8d4e
ff4d8d4e ?? ???

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 084df1d9 to 8052ee23

SYMBOL_ON_RAW_STACK: 1

STACK_TEXT:
f7c72c98 084df1d9 0000000a f74d8d4e 00000002
nt!KeBugCheckEx+0x19
WARNING: Frame IP not in any known module. Following
frames may be wrong.
f7c72cb4 862e6af8 002e6af8 862e6af8 ffc72ce0 0x84df1d9
ff00005f 00000000 00000000 00000000 00000000
0x862e6af8


STACK_COMMAND: dds @$csp ; kb

FAILED_INSTRUCTION_ADDRESS:
+ffffffffff4d8d4e
ff4d8d4e ?? ???

FOLLOWUP_IP:
SYMTDI!DisconnectTCPSession+1da9
b2f7ba38 55 push ebp

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SYMTDI!DisconnectTCPSession+1da9

MODULE_NAME: SYMTDI

IMAGE_NAME: SYMTDI.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41705aad

FAILURE_BUCKET_ID:
0xD1_CODE_AV_BAD_IP_SYMTDI!DisconnectTCPSession+1da9

BUCKET_ID:
0xD1_CODE_AV_BAD_IP_SYMTDI!DisconnectTCPSession+1da9

Followup: MachineOwner
---------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++