TechSpot

Random BSOD 0x000000d1

By MilanMilas
Mar 15, 2007
Topic Status:
Not open for further replies.
  1. Hi all:)

    I have a problem in random receiving BSOD 0x000000d1
    I was earlier receiving some other BSOD error, but then changed memory module, and then was everything ok, untill now:(

    It's happening when i'm on-line, and playing "World of Warcraft" or "Live for Speed", and it annoys me very much:(

    So i think that problem is in my network (maybe i'm wrong).

    I have Wireless Air Live Access Point.

    I also tried to read dumps with "WinDBG" and get the solution myself, but i don't know anything about that, and it shows me some errors too, so i don't know how to setup that program too:(

    I added zipped mem dumps

    pls, help me

    And sorry, i firstly opened this thread in "introduce forums" by mistake:(
  2. MilanMilas

    MilanMilas Newcomer, in training Topic Starter

    Me again:)

    I did little research my self, and tried to find reason for my error.
    Tried to make WinDbg to work, and here are the results:



    Microsoft (R) Windows Debugger Version 6.6.0007.5

    Loading Dump File [C:\WINDOWS\Minidump\Mini031607-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available


    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a520
    Debug session time: Fri Mar 16 00:23:52.703 2007 (GMT+1)
    System Uptime: 0 days 3:13:43.308

    Unable to load image ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    .............................................
    Loading User Symbols
    Loading unloaded module list

    * Bugcheck Analysis *


    Use !analyze -v to get detailed debugging information.

    BugCheck 100000D1, {0, ff, 1, 1a01ba}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *** WARNING: Unable to verify timestamp for win32k.sys
    *** ERROR: Module load completed but symbols could not be loaded for win32k.sys
    Unable to load image NDIS.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for NDIS.sys
    *** ERROR: Module load completed but symbols could not be loaded for NDIS.sys
    Probably caused by : win32k.sys ( win32k+b52 )

    Followup: MachineOwner
    ---------

    kd> .symfix
    No downstream store given, using C:\Program Files\Debugging Tools for Windows\sym
    kd> .reload
    Unable to load image ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    .....................................
    Loading User Symbols
    Loading unloaded module list
    ..........
    kd> .sympath
    Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
    kd> .reload
    Unable to load image ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    .....................................
    Loading User Symbols
    Loading unloaded module list
    ..........
    kd> .reload
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
    Loading Kernel Symbols
    .....................................
    Loading User Symbols
    Loading unloaded module list
    ..........
    kd> !analyze -v

    * Bugcheck Analysis *


    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: 000000ff, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 001a01ba, address which referenced memory

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.


    MODULE_NAME: win32k

    FAULTING_MODULE: 804d7000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58

    WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
    unable to get nt!MmSpecialPoolEnd
    unable to get nt!MmPoolCodeStart
    unable to get nt!MmPoolCodeEnd
    00000000

    CURRENT_IRQL: ff

    FAULTING_IP:
    +1a01ba
    001a01ba 0000 add byte ptr [eax],al

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: WRONG_SYMBOLS

    BUGCHECK_STR: 0xD1

    LAST_CONTROL_TRANSFER: from 804dbe67 to 001a01ba

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    b82a7c98 804dbe67 ffffd8f0 ffffffff 1007d7a7 0x1a01ba
    b82a7cc0 804db856 b82a7d0c 853fe8a0 ffdff120 nt!KiDispatchInterrupt+0x5f3
    b82a7cd4 804dc0f7 853fe958 853fe8a0 804dc01c nt!ExReleaseResourceLite+0x206
    b82a7ce0 804dc01c b82a7d64 0012fd08 0012fd28 nt!KeDelayExecutionThread+0x1ee
    b82a7cfc bf800b52 b82a7d2c 00000001 b82a7d54 nt!KeDelayExecutionThread+0x113
    b82a7d54 804de7ec 00000000 0012fd28 0012fd50 win32k!LeaveCrit+0xc
    00000000 00000000 00000000 00000000 00000000 nt!ZwYieldExecution+0xb78


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!LeaveCrit+c
    bf800b52 ff25bcb298bf jmp dword ptr [win32k!_imp__KeLeaveCriticalRegion (bf98b2bc)]

    SYMBOL_STACK_INDEX: 5

    SYMBOL_NAME: win32k!LeaveCrit+c

    FOLLOWUP_NAME: MachineOwner

    IMAGE_NAME: win32k.sys

    BUCKET_ID: WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    kd> .sympath
    Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
    kd> .reload
    Loading Kernel Symbols
    .............................................
    Loading User Symbols
    Loading unloaded module list
    ..........
    kd> !analyze -v

    * Bugcheck Analysis *


    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: 000000ff, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 001a01ba, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS: 00000000

    CURRENT_IRQL: ff

    FAULTING_IP:
    +1a01ba
    001a01ba 0000 add byte ptr [eax],al

    PROCESS_NAME: LFS.exe

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xD1

    LAST_CONTROL_TRANSFER: from 804dbe67 to 001a01ba

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    b82a7c98 804dbe67 ffffd8f0 ffffffff 1007d7a7 0x1a01ba
    853fe900 80559e40 000b59d3 06001008 b82a6d10 nt!KiInsertTimerTable+0x1b
    853fe914 853fe8a0 86057f60 853fe910 00010000 nt!KiDispatcherReadyListHead+0x40
    853fe918 86057f60 853fe910 00010000 00000000 0x853fe8a0
    853fe91c 853fe910 00010000 00000000 00000000 0x86057f60
    853fe920 00010000 00000000 00000000 853fe8a0 0x853fe910
    853fe924 00000000 00000000 853fe8a0 00000000 0x10000


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!KiInsertTimerTable+1b
    804dbe67 8d3cc500965580 lea edi,nt!KiTimerTableListHead (80559600)[eax*8]

    SYMBOL_STACK_INDEX: 1

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 434c56bb

    SYMBOL_NAME: nt!KiInsertTimerTable+1b

    FAILURE_BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b

    BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b

    Followup: MachineOwner
    ---------

    kd> lmvm win32k
    start end module name
    bf800000 bf9c1180 win32k (deferred)
    Mapped memory image file: win32k.sys\43446A581c1180\win32k.sys
    Image path: win32k.sys
    Image name: win32k.sys
    Timestamp: Thu Oct 06 02:05:44 2005 (43446A58)
    CheckSum: 001CB2E4
    ImageSize: 001C1180
    File version: 5.1.2600.2770
    Product version: 5.1.2600.2770
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 3.7 Driver
    File date: 00000000.00000000
    Translations: 041d.04b0
    CompanyName: Microsoft Corporation
    ProductName: Operativsystemet Microsoft® Windows®
    InternalName: win32k.sys
    OriginalFilename: win32k.sys
    ProductVersion: 5.1.2600.2770
    FileVersion: 5.1.2600.2770 (xpsp_sp2_gdr.051005-1513)
    FileDescription: Win32-drivrutin för flera användare
    LegalCopyright: © Microsoft Corporation. Med ensamrätt.
    kd> lmvm nt
    start end module name
    804d7000 806eb400 nt # (pdb symbols) ntoskrnl.pdb\53D901D8DB1340B4B49A8F1155E449E22\ntoskrnl.pdb
    Loaded symbol image file: ntoskrnl.exe
    Mapped memory image file: ntoskrnl.exe\434C56BB214400\ntoskrnl.exe
    Image path: ntoskrnl.exe
    Image name: ntoskrnl.exe
    Timestamp: Wed Oct 12 02:20:11 2005 (434C56BB)
    CheckSum: 00217DC2
    ImageSize: 00214400
    File version: 5.1.2600.2774
    Product version: 5.1.2600.2774
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 1.0 App
    File date: 00000000.00000000
    Translations: 0404.04b0
    CompanyName: Microsoft Corporation
    ProductName: Microsoft(R) Windows(R) Operating System
    InternalName: ntoskrnl.exe
    OriginalFilename: ntoskrnl.exe
    ProductVersion: 5.1.2600.2774
    FileVersion: 5.1.2600.2774 (xpsp.051011-1528)
    FileDescription: NT Kernel & System
    LegalCopyright: (C) Microsoft Corporation. All rights reserved.




    Now i don't know is that all that i could get from WinDbg, but i don't understand much of it:(
    Some device or driver is making this error on some IRQ address, but don't know what device or driver?:(
    Or maybe some file is not good, or i should defragment my win partition because of fault part of pagefile???
    Really don't know what to do.
    I can for example play "Live for Speed" around 15-30 mins, and then windows shows me that BSOD. Even when i'm not on line.

    Help!

    I had to shorten this message (it's too long), but i think i cutted unimportant parts, mostly dots and errors in the beginning:)
  3. gully

    gully Newcomer, in training

    looks like you have faulty ram
  4. MilanMilas

    MilanMilas Newcomer, in training Topic Starter

    tnx for reply

    Ok tnx, i'll check that out. I already had one faulty RAM module, before one month or so, and i changed it, and tought that's it:(
    I'll try switching places (i have 2 modules of 512MB), and let u know if it happens again.
  5. MilanMilas

    MilanMilas Newcomer, in training Topic Starter

    Hello again:)

    I switched my RAM modules, and everything was ok, untill now...
    Two times today i got 0x000000d1 BSOD, and both, while i was playing "Live for Speed". First time on the internet, and second time, i wasn't connected.
    Now i tried third RAM slot, and combinations with it:(

    Are you sure it's RAM problem?

    Here's error:

    Loading Dump File [C:\WINDOWS\Minidump\Mini031907-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp.051011-1528
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a520
    Debug session time: Mon Mar 19 22:05:09.343 2007 (GMT+1)
    System Uptime: 0 days 0:36:35.944
    Loading Kernel Symbols
    ...................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 100000D1, {0, ff, 1, 11f01d2}

    Probably caused by : ntoskrnl.exe ( nt!KiInsertTimerTable+1b )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: 000000ff, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 011f01d2, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS: 00000000

    CURRENT_IRQL: ff

    FAULTING_IP:
    +11f01d2
    011f01d2 0000 add byte ptr [eax],al

    PROCESS_NAME: LFS.exe

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xD1

    LAST_CONTROL_TRANSFER: from 804dbe67 to 011f01d2

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    b8c96c98 804dbe67 ffffd8f0 ffffffff 1ce23755 0x11f01d2
    86976a40 80559e40 000224fc 06001008 b8c968c8 nt!KiInsertTimerTable+0x1b
    86976a54 869769e0 85ede7e8 86976a50 00010000 nt!KiDispatcherReadyListHead+0x40
    86976a58 85ede7e8 86976a50 00010000 00000000 0x869769e0
    86976a5c 86976a50 00010000 00000000 00000000 0x85ede7e8
    86976a60 00010000 00000000 00000000 869769e0 0x86976a50
    86976a64 00000000 00000000 869769e0 00000000 0x10000


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!KiInsertTimerTable+1b
    804dbe67 8d3cc500965580 lea edi,nt!KiTimerTableListHead (80559600)[eax*8]

    SYMBOL_STACK_INDEX: 1

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 434c56bb

    SYMBOL_NAME: nt!KiInsertTimerTable+1b

    FAILURE_BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b

    BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b

    Followup: MachineOwner
    ---------

    I don't know am i using WinDbg well, so i attached 2 zipped minidumps also.

    I forgot to tell you, that i earlier have installed AutoPatcher_XP_Nov06_ENU_Full, so maybe there's problem... or it can only fix problems?

    HELP PLS!!!
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.