Hi all

I have a problem in random receiving BSOD 0x000000d1
I was earlier receiving some other BSOD error, but then changed memory module, and then was everything ok, untill now

It's happening when i'm on-line, and playing "World of Warcraft" or "Live for Speed", and it annoys me very much

So i think that problem is in my network (maybe i'm wrong).

I have Wireless Air Live Access Point.

I also tried to read dumps with "WinDBG" and get the solution myself, but i don't know anything about that, and it shows me some errors too, so i don't know how to setup that program too

I added zipped mem dumps

pls, help me

And sorry, i firstly opened this thread in "introduce forums" by mistake

Me again

I did little research my self, and tried to find reason for my error.
Tried to make WinDbg to work, and here are the results:



Microsoft (R) Windows Debugger Version 6.6.0007.5

Loading Dump File [C:\WINDOWS\Minidump\Mini031607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a520
Debug session time: Fri Mar 16 00:23:52.703 2007 (GMT+1)
System Uptime: 0 days 3:13:43.308

Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.............................................
Loading User Symbols
Loading unloaded module list

* Bugcheck Analysis *


Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {0, ff, 1, 1a01ba}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Unable to load image NDIS.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for NDIS.sys
*** ERROR: Module load completed but symbols could not be loaded for NDIS.sys
Probably caused by : win32k.sys ( win32k+b52 )

Followup: MachineOwner
---------

kd> .symfix
No downstream store given, using C:\Program Files\Debugging Tools for Windows\sym
kd> .reload
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.....................................
Loading User Symbols
Loading unloaded module list
..........
kd> .sympath
Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
kd> .reload
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.....................................
Loading User Symbols
Loading unloaded module list
..........
kd> .reload
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
.....................................
Loading User Symbols
Loading unloaded module list
..........
kd> !analyze -v

* Bugcheck Analysis *


DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 001a01ba, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


MODULE_NAME: win32k

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
00000000

CURRENT_IRQL: ff

FAULTING_IP:
+1a01ba
001a01ba 0000 add byte ptr [eax],al

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 804dbe67 to 001a01ba

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b82a7c98 804dbe67 ffffd8f0 ffffffff 1007d7a7 0x1a01ba
b82a7cc0 804db856 b82a7d0c 853fe8a0 ffdff120 nt!KiDispatchInterrupt+0x5f3
b82a7cd4 804dc0f7 853fe958 853fe8a0 804dc01c nt!ExReleaseResourceLite+0x206
b82a7ce0 804dc01c b82a7d64 0012fd08 0012fd28 nt!KeDelayExecutionThread+0x1ee
b82a7cfc bf800b52 b82a7d2c 00000001 b82a7d54 nt!KeDelayExecutionThread+0x113
b82a7d54 804de7ec 00000000 0012fd28 0012fd50 win32k!LeaveCrit+0xc
00000000 00000000 00000000 00000000 00000000 nt!ZwYieldExecution+0xb78


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!LeaveCrit+c
bf800b52 ff25bcb298bf jmp dword ptr [win32k!_imp__KeLeaveCriticalRegion (bf98b2bc)]

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: win32k!LeaveCrit+c

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: win32k.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

kd> .sympath
Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
kd> .reload
Loading Kernel Symbols
.............................................
Loading User Symbols
Loading unloaded module list
..........
kd> !analyze -v

* Bugcheck Analysis *


DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 001a01ba, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000000

CURRENT_IRQL: ff

FAULTING_IP:
+1a01ba
001a01ba 0000 add byte ptr [eax],al

PROCESS_NAME: LFS.exe

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 804dbe67 to 001a01ba

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b82a7c98 804dbe67 ffffd8f0 ffffffff 1007d7a7 0x1a01ba
853fe900 80559e40 000b59d3 06001008 b82a6d10 nt!KiInsertTimerTable+0x1b
853fe914 853fe8a0 86057f60 853fe910 00010000 nt!KiDispatcherReadyListHead+0x40
853fe918 86057f60 853fe910 00010000 00000000 0x853fe8a0
853fe91c 853fe910 00010000 00000000 00000000 0x86057f60
853fe920 00010000 00000000 00000000 853fe8a0 0x853fe910
853fe924 00000000 00000000 853fe8a0 00000000 0x10000


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiInsertTimerTable+1b
804dbe67 8d3cc500965580 lea edi,nt!KiTimerTableListHead (80559600)[eax*8]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 434c56bb

SYMBOL_NAME: nt!KiInsertTimerTable+1b

FAILURE_BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b

BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b

Followup: MachineOwner
---------

kd> lmvm win32k
start end module name
bf800000 bf9c1180 win32k (deferred)
Mapped memory image file: win32k.sys\43446A581c1180\win32k.sys
Image path: win32k.sys
Image name: win32k.sys
Timestamp: Thu Oct 06 02:05:44 2005 (43446A58)
CheckSum: 001CB2E4
ImageSize: 001C1180
File version: 5.1.2600.2770
Product version: 5.1.2600.2770
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 041d.04b0
CompanyName: Microsoft Corporation
ProductName: Operativsystemet Microsoft® Windows®
InternalName: win32k.sys
OriginalFilename: win32k.sys
ProductVersion: 5.1.2600.2770
FileVersion: 5.1.2600.2770 (xpsp_sp2_gdr.051005-1513)
FileDescription: Win32-drivrutin för flera användare
LegalCopyright: © Microsoft Corporation. Med ensamrätt.
kd> lmvm nt
start end module name
804d7000 806eb400 nt # (pdb symbols) ntoskrnl.pdb\53D901D8DB1340B4B49A8F1155E449E22\ntoskrnl.pdb
Loaded symbol image file: ntoskrnl.exe
Mapped memory image file: ntoskrnl.exe\434C56BB214400\ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Oct 12 02:20:11 2005 (434C56BB)
CheckSum: 00217DC2
ImageSize: 00214400
File version: 5.1.2600.2774
Product version: 5.1.2600.2774
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0404.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft(R) Windows(R) Operating System
InternalName: ntoskrnl.exe
OriginalFilename: ntoskrnl.exe
ProductVersion: 5.1.2600.2774
FileVersion: 5.1.2600.2774 (xpsp.051011-1528)
FileDescription: NT Kernel & System
LegalCopyright: (C) Microsoft Corporation. All rights reserved.




Now i don't know is that all that i could get from WinDbg, but i don't understand much of it
Some device or driver is making this error on some IRQ address, but don't know what device or driver?
Or maybe some file is not good, or i should defragment my win partition because of fault part of pagefile???
Really don't know what to do.
I can for example play "Live for Speed" around 15-30 mins, and then windows shows me that BSOD. Even when i'm not on line.

Help!

I had to shorten this message (it's too long), but i think i cutted unimportant parts, mostly dots and errors in the beginning

looks like you have faulty ram

tnx for reply

Ok tnx, i'll check that out. I already had one faulty RAM module, before one month or so, and i changed it, and tought that's it
I'll try switching places (i have 2 modules of 512MB), and let u know if it happens again.

Hello again

I switched my RAM modules, and everything was ok, untill now...
Two times today i got 0x000000d1 BSOD, and both, while i was playing "Live for Speed". First time on the internet, and second time, i wasn't connected.
Now i tried third RAM slot, and combinations with it

Are you sure it's RAM problem?

Here's error:

Loading Dump File [C:\WINDOWS\Minidump\Mini031907-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.051011-1528
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a520
Debug session time: Mon Mar 19 22:05:09.343 2007 (GMT+1)
System Uptime: 0 days 0:36:35.944
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {0, ff, 1, 11f01d2}

Probably caused by : ntoskrnl.exe ( nt!KiInsertTimerTable+1b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 011f01d2, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000000

CURRENT_IRQL: ff

FAULTING_IP:
+11f01d2
011f01d2 0000 add byte ptr [eax],al

PROCESS_NAME: LFS.exe

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 804dbe67 to 011f01d2

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b8c96c98 804dbe67 ffffd8f0 ffffffff 1ce23755 0x11f01d2
86976a40 80559e40 000224fc 06001008 b8c968c8 nt!KiInsertTimerTable+0x1b
86976a54 869769e0 85ede7e8 86976a50 00010000 nt!KiDispatcherReadyListHead+0x40
86976a58 85ede7e8 86976a50 00010000 00000000 0x869769e0
86976a5c 86976a50 00010000 00000000 00000000 0x85ede7e8
86976a60 00010000 00000000 00000000 869769e0 0x86976a50
86976a64 00000000 00000000 869769e0 00000000 0x10000


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiInsertTimerTable+1b
804dbe67 8d3cc500965580 lea edi,nt!KiTimerTableListHead (80559600)[eax*8]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 434c56bb

SYMBOL_NAME: nt!KiInsertTimerTable+1b

FAILURE_BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b

BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b

Followup: MachineOwner
---------

I don't know am i using WinDbg well, so i attached 2 zipped minidumps also.

I forgot to tell you, that i earlier have installed AutoPatcher_XP_Nov06_ENU_Full, so maybe there's problem... or it can only fix problems?

HELP PLS!!!