Me again
I did little research my self, and tried to find reason for my error.
Tried to make WinDbg to work, and here are the results:
Microsoft (R) Windows Debugger Version 6.6.0007.5
Loading Dump File [C:\WINDOWS\Minidump\Mini031607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a520
Debug session time: Fri Mar 16 00:23:52.703 2007 (GMT+1)
System Uptime: 0 days 3:13:43.308
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.............................................
Loading User Symbols
Loading unloaded module list
* Bugcheck Analysis *
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {0, ff, 1, 1a01ba}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Unable to load image NDIS.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for NDIS.sys
*** ERROR: Module load completed but symbols could not be loaded for NDIS.sys
Probably caused by : win32k.sys ( win32k+b52 )
Followup: MachineOwner
---------
kd> .symfix
No downstream store given, using C:\Program Files\Debugging Tools for Windows\sym
kd> .reload
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.....................................
Loading User Symbols
Loading unloaded module list
..........
kd> .sympath
Symbol search path is: SRV**
http://msdl.microsoft.com/download/symbols
kd> .reload
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.....................................
Loading User Symbols
Loading unloaded module list
..........
kd> .reload
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
.....................................
Loading User Symbols
Loading unloaded module list
..........
kd> !analyze -v
* Bugcheck Analysis *
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 001a01ba, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
MODULE_NAME: win32k
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
00000000
CURRENT_IRQL: ff
FAULTING_IP:
+1a01ba
001a01ba 0000 add byte ptr [eax],al
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 804dbe67 to 001a01ba
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b82a7c98 804dbe67 ffffd8f0 ffffffff 1007d7a7 0x1a01ba
b82a7cc0 804db856 b82a7d0c 853fe8a0 ffdff120 nt!KiDispatchInterrupt+0x5f3
b82a7cd4 804dc0f7 853fe958 853fe8a0 804dc01c nt!ExReleaseResourceLite+0x206
b82a7ce0 804dc01c b82a7d64 0012fd08 0012fd28 nt!KeDelayExecutionThread+0x1ee
b82a7cfc bf800b52 b82a7d2c 00000001 b82a7d54 nt!KeDelayExecutionThread+0x113
b82a7d54 804de7ec 00000000 0012fd28 0012fd50 win32k!LeaveCrit+0xc
00000000 00000000 00000000 00000000 00000000 nt!ZwYieldExecution+0xb78
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!LeaveCrit+c
bf800b52 ff25bcb298bf jmp dword ptr [win32k!_imp__KeLeaveCriticalRegion (bf98b2bc)]
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: win32k!LeaveCrit+c
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: win32k.sys
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
kd> .sympath
Symbol search path is: SRV**
http://msdl.microsoft.com/download/symbols
kd> .reload
Loading Kernel Symbols
.............................................
Loading User Symbols
Loading unloaded module list
..........
kd> !analyze -v
* Bugcheck Analysis *
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 001a01ba, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 00000000
CURRENT_IRQL: ff
FAULTING_IP:
+1a01ba
001a01ba 0000 add byte ptr [eax],al
PROCESS_NAME: LFS.exe
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 804dbe67 to 001a01ba
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b82a7c98 804dbe67 ffffd8f0 ffffffff 1007d7a7 0x1a01ba
853fe900 80559e40 000b59d3 06001008 b82a6d10 nt!KiInsertTimerTable+0x1b
853fe914 853fe8a0 86057f60 853fe910 00010000 nt!KiDispatcherReadyListHead+0x40
853fe918 86057f60 853fe910 00010000 00000000 0x853fe8a0
853fe91c 853fe910 00010000 00000000 00000000 0x86057f60
853fe920 00010000 00000000 00000000 853fe8a0 0x853fe910
853fe924 00000000 00000000 853fe8a0 00000000 0x10000
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiInsertTimerTable+1b
804dbe67 8d3cc500965580 lea edi,nt!KiTimerTableListHead (80559600)[eax*8]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 434c56bb
SYMBOL_NAME: nt!KiInsertTimerTable+1b
FAILURE_BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b
BUCKET_ID: 0xD1_W_nt!KiInsertTimerTable+1b
Followup: MachineOwner
---------
kd> lmvm win32k
start end module name
bf800000 bf9c1180 win32k (deferred)
Mapped memory image file: win32k.sys\43446A581c1180\win32k.sys
Image path: win32k.sys
Image name: win32k.sys
Timestamp: Thu Oct 06 02:05:44 2005 (43446A58)
CheckSum: 001CB2E4
ImageSize: 001C1180
File version: 5.1.2600.2770
Product version: 5.1.2600.2770
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 041d.04b0
CompanyName: Microsoft Corporation
ProductName: Operativsystemet Microsoft® Windows®
InternalName: win32k.sys
OriginalFilename: win32k.sys
ProductVersion: 5.1.2600.2770
FileVersion: 5.1.2600.2770 (xpsp_sp2_gdr.051005-1513)
FileDescription: Win32-drivrutin för flera användare
LegalCopyright: © Microsoft Corporation. Med ensamrätt.
kd> lmvm nt
start end module name
804d7000 806eb400 nt # (pdb symbols) ntoskrnl.pdb\53D901D8DB1340B4B49A8F1155E449E22\ntoskrnl.pdb
Loaded symbol image file: ntoskrnl.exe
Mapped memory image file: ntoskrnl.exe\434C56BB214400\ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Oct 12 02:20:11 2005 (434C56BB)
CheckSum: 00217DC2
ImageSize: 00214400
File version: 5.1.2600.2774
Product version: 5.1.2600.2774
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0404.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft(R) Windows(R) Operating System
InternalName: ntoskrnl.exe
OriginalFilename: ntoskrnl.exe
ProductVersion: 5.1.2600.2774
FileVersion: 5.1.2600.2774 (xpsp.051011-1528)
FileDescription: NT Kernel & System
LegalCopyright: (C) Microsoft Corporation. All rights reserved.
Now i don't know is that all that i could get from WinDbg, but i don't understand much of it
Some device or driver is making this error on some IRQ address, but don't know what device or driver?
Or maybe some file is not good, or i should defragment my win partition because of fault part of pagefile???
Really don't know what to do.
I can for example play "Live for Speed" around 15-30 mins, and then windows shows me that BSOD. Even when i'm not on line.
Help!
I had to shorten this message (it's too long), but i think i cutted unimportant parts, mostly dots and errors in the beginning
