Sudden BSOD when Watching a movie from over network, error 0x000000d1

ShiroNeko · 31 Jan 2015

Hi, Just today, I got sick and sat down to watch a movie and now two times during it, I've gotten BSODs. Worth mentioning is that the file is streamed over windows file sharing and that I had FFXIV running in background. Last BSOD happened just as a friend called on Skype.

Stop Message:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0xfffff8800598e000, 0x0000000000000002, 0x0000000000000000, 0xfffff880047e879e). A dump was saved in: C:\Windows\Minidump\013115-19312-01.dmp. Report Id: 013115-19312-01.

Any idea what caused it?

//Kind regards, me

koolkat77 · 02 Feb 2015

Please uninstall Daemon Tools. It uses a driver called sptd.sys which is known to cause BSODs in Windows 7.

SPTD Removal:

Uninstall the software using Add/Remove Programs.
Reboot the system.
Once the program is uninstalled, run sptd.sys uninstaller to remove the driver from your system.
DuplexSecure - Downloads

As an alternative, many people recommend the use of Total Mounter or Magic ISO

Update the driver below:

Driver Reference Table

Sometimes drivers remain and do not get completely uninstalled.

Driver Removal Process:

Download Driver Sweeper to the desired location.
Extract the files from the zip.
Uninstall the driver Program & Features - Control Panel.
Run Driver Sweeper, check the drivers you want to uninstall or clean registry leftovers of.

Link to full tutorial: Drivers - Clean Left over Files after Uninstalling

Code:

Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\YUSRA\Downloads\Compressed\ROZE-PC-2015-01-31_124050_00\013115-19468-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03c60000 PsLoadedModuleList = 0xfffff800`03ea3890
Debug session time: Sat Jan 31 16:39:06.205 2015 (UTC + 6:00)
System Uptime: 9 days 4:40:14.921
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
...........................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff8800598e000, 2, 0, fffff8800415e79e}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : Rt64win7.sys ( Rt64win7+7579e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff8800598e000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800415e79e, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003f0d100
GetUlongFromAddress: unable to read from fffff80003f0d1c0
 fffff8800598e000 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
Rt64win7+7579e
fffff880`0415e79e 410fb609        movzx   ecx,byte ptr [r9]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre

DPC_STACK_BASE:  FFFFF80000BA2FB0

TRAP_FRAME:  fffff80000b9c680 -- (.trap 0xfffff80000b9c680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000009daa014 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800415e79e rsp=fffff80000b9c818 rbp=0000000000004755
 r8=0000000000008eaa  r9=fffff8800598e000 r10=0000000000000000
r11=fffff8800598a8da r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
Rt64win7+0x7579e:
fffff880`0415e79e 410fb609        movzx   ecx,byte ptr [r9] ds:fffff880`0598e000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003cd5169 to fffff80003cd5bc0

STACK_TEXT:  
fffff800`00b9c538 fffff800`03cd5169 : 00000000`0000000a fffff880`0598e000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c540 fffff800`03cd3de0 : fffffa80`0d2a9ba0 00000000`00000001 00000000`00000001 00000000`000097d2 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c680 fffff880`0415e79e : 00000000`00000000 00000000`0000352b 00000000`000005ea fffff880`0598a8c0 : nt!KiPageFault+0x260
fffff800`00b9c818 00000000`00000000 : 00000000`0000352b 00000000`000005ea fffff880`0598a8c0 00000000`00000008 : Rt64win7+0x7579e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Rt64win7+7579e
fffff880`0415e79e 410fb609        movzx   ecx,byte ptr [r9]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Rt64win7+7579e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Rt64win7

IMAGE_NAME:  Rt64win7.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4df1baab

FAILURE_BUCKET_ID:  X64_0xD1_Rt64win7+7579e

BUCKET_ID:  X64_0xD1_Rt64win7+7579e

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xd1_rt64win7+7579e

FAILURE_ID_HASH:  {bf100c70-c912-adaa-49e2-be3078b64800}

Followup: MachineOwner
---------

0: kd> lmvm Rt64win7
start             end                 module name
fffff880`040e9000 fffff880`0416e000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        Fri Jun 10 12:33:15 2011 (4DF1BAAB)
    CheckSum:         0008B67F
    ImageSize:        00085000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Clean boot

Troubleshoot Application Conflicts by Performing a Clean Startup

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

How to Change, Add, or Remove Startup Programs in Windows 7

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

Click on the
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

SFC /SCANNOW Command - System File Checker

ShiroNeko · 04 Feb 2015

I've uninstalled Deamon Tools, and its still crashing.
All the latest crashes seems to be at or around ntoskrnl.exe/hal.dll

Its probably the RAM that's gone bad, right?

koolkat77 · 04 Feb 2015

Code:

Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\YUSRA\Downloads\Compressed\ROZE-PC-2015-02-04_164739_09\020415-24944-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18700.amd64fre.win7sp1_gdr.141211-1742
Machine Name:
Kernel base = 0xfffff800`03c56000 PsLoadedModuleList = 0xfffff800`03e99890
Debug session time: Wed Feb  4 21:41:02.404 2015 (UTC + 6:00)
System Uptime: 0 days 1:36:07.247
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff8800658e000, 2, 0, fffff8800437179e}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : Rt64win7.sys ( Rt64win7+7579e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff8800658e000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800437179e, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003f03100
GetUlongFromAddress: unable to read from fffff80003f031c0
 fffff8800658e000 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
Rt64win7+7579e
fffff880`0437179e 410fb609        movzx   ecx,byte ptr [r9]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre

DPC_STACK_BASE:  FFFFF80000BA2FB0

TRAP_FRAME:  fffff80000b9c680 -- (.trap 0xfffff80000b9c680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=000000002d3d3e82 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800437179e rsp=fffff80000b9c818 rbp=000000000000189b
 r8=0000000000003136  r9=fffff8800658e000 r10=0000000000000000
r11=fffff880065813da r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
Rt64win7+0x7579e:
fffff880`0437179e 410fb609        movzx   ecx,byte ptr [r9] ds:fffff880`0658e000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003ccc429 to fffff80003ccce80

STACK_TEXT:  
fffff800`00b9c538 fffff800`03ccc429 : 00000000`0000000a fffff880`0658e000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c540 fffff800`03ccb0a0 : fffffa80`0d08f060 fffffa80`12ca72b0 fffffa80`0d095010 00000000`000008f6 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c680 fffff880`0437179e : 00000000`00000000 00000000`0000352b 00000000`000005ea fffff880`065813c0 : nt!KiPageFault+0x260
fffff800`00b9c818 00000000`00000000 : 00000000`0000352b 00000000`000005ea fffff880`065813c0 00000000`00000008 : Rt64win7+0x7579e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Rt64win7+7579e
fffff880`0437179e 410fb609        movzx   ecx,byte ptr [r9]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Rt64win7+7579e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Rt64win7

IMAGE_NAME:  Rt64win7.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4df1baab

FAILURE_BUCKET_ID:  X64_0xD1_Rt64win7+7579e

BUCKET_ID:  X64_0xD1_Rt64win7+7579e

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xd1_rt64win7+7579e

FAILURE_ID_HASH:  {bf100c70-c912-adaa-49e2-be3078b64800}

Followup: MachineOwner
---------

0: kd> lmvm Rt64win7
start             end                 module name
fffff880`042fc000 fffff880`04381000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        Fri Jun 10 12:33:15 2011 (4DF1BAAB)
    CheckSum:         0008B67F
    ImageSize:        00085000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please update the driver.

ShiroNeko · 11 Feb 2015

This seems to be resolved for now. I have bought a new PCI-E network card in case it reemerges.

Completely uninstalling the card and removing the older drivers seems to have made it possible to pull in the newer driver.
Also, Removing Daemon tools did not solve the problem. Despite this, I have now replaced DT with VirtualCloneDrive, as the suggested replacements on this forum is not free of charge.

//Regards