Random BSOD on VM

[cor277]

Please help...

this is the dmp analyzed

------------------------------------------------------------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Minidump\Mini052909-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8ec8
Debug session time: Fri May 29 15:20:59.017 2009 (GMT+2)
System Uptime: 0 days 3:59:36.526
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
.............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {1002, d0000002, 1, 9733bb81}

Probably caused by : ntoskrnl.exe ( nt!KiInsertQueueApc+17e )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00001002, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 9733bb81, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00001002

CURRENT_IRQL: 2

FAULTING_IP:
+5
9733bb81 c60001 mov byte ptr [eax],1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 80832b44 to 9733bb81

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f78becf8 80832b44 9733bb28 0a9f53a2 00000000 0x9733bb81
f78bed50 8088f82f 00000000 0000000e 00000000 nt!KiInsertQueueApc+0x17e
f78bed54 00000000 0000000e 00000000 00000000 nt!islower+0x5


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiInsertQueueApc+17e
80832b44 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiInsertQueueApc+17e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 49c22bca

FAILURE_BUCKET_ID: 0xD1_nt!KiInsertQueueApc+17e

BUCKET_ID: 0xD1_nt!KiInsertQueueApc+17e

Followup: MachineOwner
---------

 

[Route44]

0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
The system attempted to access pageable memory using a kernel process IRQL that was too high. The most typical cause is a bad device driver (one that uses improper addresses). It can also be caused by caused by faulty or mismatched RAM, or a damaged pagefile.

Unfortunately your dump only cited a Windows driver and these are usually too general to be of much help. So...

1. Give us your system specs including security software and third party software such as Daemon Tools, etc.

2. Tell us how long these crashes have been occuring and when, i.e. surfing the net, playing games, randomnly, using particular software, etc.

3. Attach to your next post the 5 latest minidumps (not the one you just posted). Notice the Manage Attachments button at the bottom when you go to post the next time. You can Zip up to five files per Zip. Please do us a favor and don’t Zip each one individually.