win2003 Ent. server crash few times a day

musta

Solid State Member
Messages
7
Before i post my debug logs id like to mention that all these stops started on win2000 server which i upgraded to win2003 server. only devices that i came from old system are : memory; video card; hard disk and network interface card (and also 8signs firewall software).

Yesterday i applied SP1 and it didnot changed anything - stops continue to happen.


This is my last debug log (without symbols installed yet) :


Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [*********]
Kernel Complete Dump File: Full address space is available

Symbol search path is: *** Invalid ***
************************************************** **************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
************************************************** **************************
Executable search path is:
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Thu Jul 14 02:19:41.359 2005 (GMT+3)
System Uptime: 0 days 3:56:08.938
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
.................................................. ...................................
Loading unloaded module list
.......
Loading User Symbols
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {cfbb440, 2, 1, 8082d69f}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Module load completed but symbols could not be loaded for afd.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for tcpip.sys -
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for TDI.SYS -
Probably caused by : TDI.SYS ( TDI+1064 )

Followup: MachineOwner
---------

kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0cfbb440, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8082d69f, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************

MODULE_NAME: TDI

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42435cd6

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
0cfbb440

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmUnlockPages+112
8082d69f c20400 ret 0x4

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8082d69f to 80826493

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f78e29a0 8082d69f badb0d00 867dde40 f78e29d0 nt!Kei386EoiHelper+0x2897
f78e2a38 f6df3c68 84935ca8 849499c8 f78e2a60 nt!MmUnlockPages+0x112
f78e2a78 f6e3ffe2 00000e20 f6e3ffe2 8580e630 afd+0x1dc68
f78e2ae4 f6e3f7ca 866305c8 00001850 f78e2c3c tcpip!IPRcvComplete+0x236e
f78e2ba4 f6e3df9f 86712008 0be115d5 0be115d5 tcpip!IPRcvComplete+0x1b56
f78e2c04 f6e3d9e8 00000024 8644b120 f6e3f54d tcpip!IPRcvComplete+0x32b
f78e2cb8 f6e42fb6 86712008 f78e2d30 0000001c tcpip!IPRcvPacket+0x262
f78e2d64 f75f8064 f6e776c0 86712008 867a2020 tcpip!IPRcvComplete+0x5342
f78e2d80 808203bd 86712008 00000000 867a2020 TDI+0x1064
f78e2dac 80905d2c f6e776c0 00000000 00000000 nt!KeRemoveQueue+0x274
f78e2ddc 80828499 80820300 00000001 00000000 nt!ObGetObjectSecurity+0x107
00000000 00000000 00000000 00000000 00000000 nt!strchr+0x26a


FOLLOWUP_IP:
TDI+1064
f75f8064 5f pop edi

SYMBOL_STACK_INDEX: 8

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: TDI+1064

IMAGE_NAME: TDI.SYS

STACK_COMMAND: kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------


I can only add that this stop has "Bugcheck String: 0x0000000a" but previous stop had different bugcheck : " Bugcheck String: 0x00000050". Also previous debug log had "IMAGE_NAME: AFD.SYS".

Any comments ?
 
====================================================


One more crash after 34 hours.



Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: C:\WINNT\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Fri Jul 15 21:23:33.078 2005 (GMT+3)
System Uptime: 1 days 10:38:59.656
Loading Kernel Symbols
.................................................. ....................................
Loading unloaded module list
...........
Loading User Symbols
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {cfbae00, 2, 1, 8082d69f}

Probably caused by : TDI.SYS ( TDI!CTEpEventHandler+32 )

Followup: MachineOwner
---------

kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0cfbae00, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8082d69f, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0cfbae00

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmUnlockPages+87d
8082d69f c20400 ret 0x4

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from f667dc68 to 8082d69f

TRAP_FRAME: f78ea9a0 -- (.trap fffffffff78ea9a0)
ErrCode = 00000002
eax=867dd700 ebx=00000000 ecx=867dd700 edx=867dd930 esi=84abdbc8 edi=849f19b0
eip=8082d69f esp=f78eaa14 ebp=f78eaa38 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MmUnlockPages+0x87d:
8082d69f c20400 ret 0x4
Resetting default scope

STACK_TEXT:
f78eaa38 f667dc68 849ecdc0 866c8580 f78eaa60 nt!MmUnlockPages+0x87d
f78eaa78 f6769fe2 00000e20 f6769fe2 847179d0 afd!AfdBReceiveEventHandler+0x1e1
f78eaae4 f67697ca 84ae9b70 00001850 f78eac3c tcpip!IndicateData+0x273
f78eaba4 f6767f9f 86458940 0be115d5 0be115d5 tcpip!TCPRcv+0x93f
f78eac04 f67679e8 00000024 862d4008 f676954d tcpip!DeliverToUser+0x189
f78eacb8 f676cfb6 86458940 f78ead30 0000001c tcpip!IPRcvPacket+0x66c
f78ead64 f7678064 f67a16c0 86458940 867a2b40 tcpip!LoopXmitRtn+0x195
f78ead80 808203bd 86458940 00000000 867a2b40 TDI!CTEpEventHandler+0x32
f78eadac 80905d2c f67a16c0 00000000 00000000 nt!ExpWorkerThread+0xeb
f78eaddc 80828499 80820300 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
TDI!CTEpEventHandler+32
f7678064 5f pop edi

SYMBOL_STACK_INDEX: 7

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: TDI!CTEpEventHandler+32

MODULE_NAME: TDI

IMAGE_NAME: TDI.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 42435cd6

STACK_COMMAND: .trap fffffffff78ea9a0 ; kb

FAILURE_BUCKET_ID: 0xA_W_TDI!CTEpEventHandler+32

BUCKET_ID: 0xA_W_TDI!CTEpEventHandler+32

Followup: MachineOwner
---------

Any ideas where to start ?
 
Next crash :

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: aba9640e, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8082ef51, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: aba9640e

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmUnlockPages+3eb
8082ef51 804f0e01 or byte ptr [edi+0xe],0x1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 80844abd to 8082ef51

MISALIGNED_IP:
nt!MmUnlockPages+3eb
8082ef51 804f0e01 or byte ptr [edi+0xe],0x1

TRAP_FRAME: f78e296c -- (.trap fffffffff78e296c)
ErrCode = 00000002
eax=85fbb5c8 ebx=81a53974 ecx=81a53974 edx=00000002 esi=00000003 edi=aba96400
eip=8082ef51 esp=f78e29e0 ebp=f78e2a10 iopl=0 nv up ei ng nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
nt!MmUnlockPages+0x3eb:
8082ef51 804f0e01 or byte ptr [edi+0xe],0x1 ds:0023:aba9640e=??
Resetting default scope

STACK_TEXT:
f78e2a10 80844abd 85fbb5a8 8435faa4 8435f9c8 nt!MmUnlockPages+0x3eb
f78e2a38 f660fc27 84379568 85fd3e70 f78e2a60 nt!IopfCompleteRequest+0x211
8435f9c8 85fbb5a8 00000000 00000000 84385018 afd!AfdBReceiveEventHandler+0x187
WARNING: Frame IP not in any known module. Following frames may be wrong.
f78e2ae4 f66fb7ca 84353b40 00001850 f78e2c3c 0x85fbb5a8
f78e2ba4 f66f9f9f 86587be0 0be115d5 0be115d5 tcpip!TCPRcv+0x93f
f78e2c04 f66f99e8 00000024 862c0c30 f66fb54d tcpip!DeliverToUser+0x189
f78e2cb8 f66fefb6 86587be0 f78e2d30 0000001b tcpip!IPRcvPacket+0x66c
f78e2d64 f7688064 f67336c0 86587be0 867a2020 tcpip!LoopXmitRtn+0x195
f78e2d80 808203bd 86587be0 00000000 867a2020 TDI!CTEpEventHandler+0x32
f78e2dac 80905d2c f67336c0 00000000 00000000 nt!ExpWorkerThread+0xeb
f78e2ddc 80828499 80820300 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
TDI!CTEpEventHandler+32
f7688064 5f pop edi

SYMBOL_STACK_INDEX: 8

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: TDI!CTEpEventHandler+32

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: .trap fffffffff78e296c ; kb

MODULE_NAME: hardware

IMAGE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED
 
Followup: MachineOwner
---------

eax=ffdff13c ebx=00000002 ecx=00000001 edx=40000000 esi=ffdff120 edi=aba9640e
eip=80826493 esp=f78e2954 ebp=f78e296c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x2a1:
80826493 833dc0828a8000 cmp dword ptr [nt!KiFreezeFlag (808a82c0)],0x0 ds:0023:808a82c0=00000000
ChildEBP RetAddr Args to Child
f78e296c 8082ef51 badb0d00 00000002 f78e29b0 nt!KiTrap0E+0x2a1 (FPO: [0,0] TrapFrame @ f78e296c)
f78e2a10 80844abd 85fbb5a8 8435faa4 8435f9c8 nt!MmUnlockPages+0x3eb (FPO: [Non-Fpo])
f78e2a38 f660fc27 84379568 85fd3e70 f78e2a60 nt!IopfCompleteRequest+0x211 (FPO: [Non-Fpo])
8435f9c8 85fbb5a8 00000000 00000000 84385018 afd!AfdBReceiveEventHandler+0x187 (FPO: [Non-Fpo])
WARNING: Frame IP not in any known module. Following frames may be wrong.
f78e2ae4 f66fb7ca 84353b40 00001850 f78e2c3c 0x85fbb5a8
f78e2ba4 f66f9f9f 86587be0 0be115d5 0be115d5 tcpip!TCPRcv+0x93f (FPO: [Non-Fpo])
f78e2c04 f66f99e8 00000024 862c0c30 f66fb54d tcpip!DeliverToUser+0x189 (FPO: [Non-Fpo])
f78e2cb8 f66fefb6 86587be0 f78e2d30 0000001b tcpip!IPRcvPacket+0x66c (FPO: [Non-Fpo])
f78e2d64 f7688064 f67336c0 86587be0 867a2020 tcpip!LoopXmitRtn+0x195 (FPO: [Non-Fpo])
f78e2d80 808203bd 86587be0 00000000 867a2020 TDI!CTEpEventHandler+0x32 (FPO: [Non-Fpo])
f78e2dac 80905d2c f67336c0 00000000 00000000 nt!ExpWorkerThread+0xeb (FPO: [Non-Fpo])
f78e2ddc 80828499 80820300 00000001 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
start end module name
80800000 80a6b000 nt ntoskrnl.exe Fri Mar 25 02:41:23 2005 (42435E33)
80a6b000 80a97000 hal halaacpi.dll Fri Mar 25 02:28:37 2005 (42435B35)
bf800000 bf9cf000 win32k win32k.sys Fri Mar 25 02:40:09 2005 (42435DE9)
bf9cf000 bf9e5000 dxg dxg.sys Fri Mar 25 02:27:25 2005 (42435AED)
bf9e5000 bfa41480 ati2dvaa ati2dvaa.dll Tue Mar 25 11:43:38 2003 (3E8024CA)
f64f7000 f6513000 dump_atapi dump_atapi.sys Fri Mar 25 02:28:49 2005 (42435B41)
f653b000 f654c000 Fips Fips.SYS Fri Mar 25 02:40:33 2005 (42435E01)
f654c000 f65c2000 mrxsmb mrxsmb.sys Fri Mar 25 02:41:13 2005 (42435E29)
f65c2000 f65f2000 rdbss rdbss.sys Fri Mar 25 02:40:49 2005 (42435E11)
f65f2000 f661c000 afd afd.sys Fri Mar 25 02:40:43 2005 (42435E0B)
f668c000 f6695000 dump_WMILIB dump_WMILIB.SYS Tue Mar 25 09:13:00 2003 (3E80017C)
f669c000 f66a6000 Dxapi Dxapi.sys Tue Mar 25 09:06:01 2003 (3E7FFFD9)
f66bc000 f66ed000 netbt netbt.sys Fri Mar 25 02:40:31 2005 (42435DFF)
f66ed000 f674e000 tcpip tcpip.sys Fri Mar 25 02:40:31 2005 (42435DFF)
f674e000 f6767000 ipsec ipsec.sys Fri Mar 25 02:40:49 2005 (42435E11)
f680f000 f684f000 update update.sys Fri Mar 25 02:40:27 2005 (42435DFB)
f684f000 f6877000 ks ks.sys Fri Mar 25 02:41:03 2005 (42435E1F)
f689f000 f68d6000 rdpdr rdpdr.sys Fri Mar 25 02:30:20 2005 (42435B9C)
f68d6000 f68e9000 raspptp raspptp.sys Fri Mar 25 02:40:43 2005 (42435E0B)
f68e9000 f6903000 ndiswan ndiswan.sys Fri Mar 25 02:40:46 2005 (42435E0E)
f6903000 f6918000 rasl2tp rasl2tp.sys Fri Mar 25 02:40:29 2005 (42435DFD)
f6930000 f6943000 i8042prt i8042prt.sys Fri Mar 25 02:41:05 2005 (42435E21)
f6962000 f6973600 el90xbc5 el90xbc5.sys Wed Aug 14 07:27:20 2002 (3D59DC28)
f698b000 f69a6000 VIDEOPRT VIDEOPRT.SYS Fri Mar 25 02:29:53 2005 (42435B81)
f69a6000 f69f5d80 ati2mtaa ati2mtaa.sys Wed Oct 30 20:49:15 2002 (3DC029AB)
f6a26000 f6a33000 netbios netbios.sys Fri Mar 25 02:33:21 2005 (42435C51)
f6a36000 f6a43000 wanarp wanarp.sys Fri Mar 25 02:34:07 2005 (42435C7F)
f6a46000 f6a54000 msgpc msgpc.sys Fri Mar 25 02:33:31 2005 (42435C5B)
f6a56000 f6a63000 Npfs Npfs.SYS Fri Mar 25 02:30:04 2005 (42435B8C)
f6a66000 f6a71000 Msfs Msfs.SYS Fri Mar 25 02:30:04 2005 (42435B8C)
f6a76000 f6a82000 vga vga.sys Fri Mar 25 02:29:54 2005 (42435B82)
f6a86000 f6a90000 flpydisk flpydisk.sys Tue Mar 25 09:04:32 2003 (3E7FFF80)
f7222000 f72396e0 AMBRIM AMBRIM.sys Tue Jan 06 02:13:02 2004 (3FF9FD8E)
f723a000 f7259000 Mup Mup.sys Fri Mar 25 02:40:49 2005 (42435E11)
f7259000 f728f000 NDIS NDIS.sys Fri Mar 25 02:40:26 2005 (42435DFA)
f728f000 f7324000 Ntfs Ntfs.sys Fri Mar 25 02:40:29 2005 (42435DFD)
f7324000 f734b000 KSecDD KSecDD.sys Fri Mar 25 02:28:53 2005 (42435B45)
f734b000 f7370000 fltmgr fltmgr.sys Fri Mar 25 02:30:25 2005 (42435BA1)
f7370000 f7383000 CLASSPNP CLASSPNP.SYS Fri Mar 25 02:40:23 2005 (42435DF7)
f7383000 f739f000 atapi atapi.sys Fri Mar 25 02:28:49 2005 (42435B41)
f739f000 f73c9000 volsnap volsnap.sys Fri Mar 25 02:29:10 2005 (42435B56)
f73c9000 f73f5000 dmio dmio.sys Fri Mar 25 02:30:02 2005 (42435B8A)
f73f5000 f741c000 ftdisk ftdisk.sys Fri Mar 25 02:29:00 2005 (42435B4C)
f741c000 f7432000 pci pci.sys Fri Mar 25 02:34:14 2005 (42435C86)
f7432000 f7466000 ACPI ACPI.sys Fri Mar 25 02:34:09 2005 (42435C81)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 09:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 09:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Fri Mar 25 02:28:48 2005 (42435B40)
f74b7000 f74c7000 MountMgr MountMgr.sys Fri Mar 25 02:27:23 2005 (42435AEB)
f74c7000 f74d2000 PartMgr PartMgr.sys Fri Mar 25 02:40:34 2005 (42435E02)
f74d7000 f74e7000 disk disk.sys Fri Mar 25 02:28:58 2005 (42435B4A)
f74e7000 f74f3000 Dfs Dfs.sys Fri Mar 25 02:30:28 2005 (42435BA4)
f74f7000 f7507000 uagp35 uagp35.sys Fri Mar 25 02:34:11 2005 (42435C83)
f7507000 f7511000 crcdisk crcdisk.sys Fri Mar 25 02:29:40 2005 (42435B74)
f7617000 f7626000 amdk7 amdk7.sys Fri Mar 25 02:28:40 2005 (42435B38)
f7627000 f7630000 watchdog watchdog.sys Fri Mar 25 02:30:19 2005 (42435B9B)
f7637000 f7641400 fetnd5b fetnd5b.sys Thu Apr 24 06:28:02 2003 (3EA759C2)
f7647000 f7652000 fdc fdc.sys Fri Mar 25 02:28:43 2005 (42435B3B)
f7657000 f7661000 kbdclass kbdclass.sys Tue Mar 25 09:03:10 2003 (3E7FFF2E)
f7667000 f7670000 ndistapi ndistapi.sys Fri Mar 25 02:34:11 2005 (42435C83)
f7677000 f7686000 raspppoe raspppoe.sys Fri Mar 25 02:34:16 2005 (42435C88)
f7687000 f7692000 TDI TDI.SYS Fri Mar 25 02:35:34 2005 (42435CD6)
f7697000 f76a2000 ptilink ptilink.sys Fri Mar 25 02:28:25 2005 (42435B29)
f76a7000 f76b0000 raspti raspti.sys Fri Mar 25 02:34:16 2005 (42435C88)
f76b7000 f76c6000 termdd termdd.sys Fri Mar 25 02:27:15 2005 (42435AE3)
f76c7000 f76d1000 mouclass mouclass.sys Tue Mar 25 09:03:09 2003 (3E7FFF2D)
f76d7000 f76e0000 mssmbios mssmbios.sys Fri Mar 25 02:34:14 2005 (42435C86)
f76e7000 f76f5000 NDProxy NDProxy.SYS Fri Mar 25 02:34:13 2005 (42435C85)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 09:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 09:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 09:04:46 2003 (3E7FFF8E)
f771f000 f7726000 viaide viaide.sys Tue Mar 25 09:04:49 2003 (3E7FFF91)
f7727000 f772e000 dmload dmload.sys Tue Mar 25 09:08:08 2003 (3E800058)
f772f000 f7734880 amdagp2k amdagp2k.sys Tue Dec 11 22:51:50 2001 (3C1671E6)
f77af000 f77b7000 audstub audstub.sys Tue Mar 25 09:09:12 2003 (3E800098)
f77df000 f77e7000 Fs_Rec Fs_Rec.SYS Tue Mar 25 09:08:36 2003 (3E800074)
f77e7000 f77ee000 Null Null.SYS Tue Mar 25 09:03:05 2003 (3E7FFF29)
f77ef000 f77f6000 Beep Beep.SYS Tue Mar 25 09:03:04 2003 (3E7FFF28)
f77f7000 f77ff000 mnmdd mnmdd.SYS Tue Mar 25 09:07:53 2003 (3E800049)
f77ff000 f7807000 RDPCDD RDPCDD.sys Tue Mar 25 09:03:05 2003 (3E7FFF29)
f7817000 f781f000 rasacd rasacd.sys Tue Mar 25 09:11:50 2003 (3E800136)
f788f000 f7896000 dxgthk dxgthk.sys Tue Mar 25 09:05:52 2003 (3E7FFFD0)
f7987000 f7988100 amdeide amdeide.sys Mon Jan 14 16:40:26 2002 (3C42EDDA)
f79ad000 f79ae280 swenum swenum.sys Fri Mar 25 02:27:42 2005 (42435AFE)
f7b21000 f7b218e0 hname hname.sys Thu Jun 21 16:26:14 2001 (3B31F5F6)
f7b3c000 f7b3d000 hmonitor hmonitor.sys Tue Mar 30 10:43:08 2004 (4069250C)
:(
 
Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: C:\WINNT\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Sun Jul 17 22:02:35.750 2005 (GMT+3)
System Uptime: 1 days 0:55:10.312
Loading Kernel Symbols
.....................................................................................
Loading unloaded module list
.......
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {cfbb6c0, 2, 1, 8082d69f}

Probably caused by : afd.sys ( afd!AfdBReceiveEventHandler+1e1 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0cfbb6c0, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8082d69f, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0cfbb6c0

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmUnlockPages+87d
8082d69f c20400 ret 0x4

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from f6d8ac68 to 8082d69f

TRAP_FRAME: 8089c450 -- (.trap ffffffff8089c450)
ErrCode = 00000002
eax=867ddb60 ebx=00000000 ecx=867ddb60 edx=867ddca0 esi=8514b6d0 edi=85154f88
eip=8082d69f esp=8089c4c4 ebp=8089c4e8 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MmUnlockPages+0x87d:
8082d69f c20400 ret 0x4
Resetting default scope

STACK_TEXT:
8089c4e8 f6d8ac68 8627d328 85dcf520 0189c528 nt!MmUnlockPages+0x87d
8089c528 f6e76fe2 00000012 00000e20 f6e76fe2 afd!AfdBReceiveEventHandler+0x1e1
86464d70 00000000 85e08aa0 86672908 86488030 tcpip!IndicateData+0x273


FOLLOWUP_IP:
afd!AfdBReceiveEventHandler+1e1
f6d8ac68 8b45f8 mov eax,[ebp-0x8]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: afd!AfdBReceiveEventHandler+1e1

MODULE_NAME: afd

IMAGE_NAME: afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42435e0b

STACK_COMMAND: .trap ffffffff8089c450 ; kb

FAILURE_BUCKET_ID: 0xA_W_afd!AfdBReceiveEventHandler+1e1

BUCKET_ID: 0xA_W_afd!AfdBReceiveEventHandler+1e1
 
Followup: MachineOwner
---------

eax=ffdff13c ebx=00000002 ecx=00000001 edx=40000000 esi=ffdff120 edi=0cfbb6c0
eip=80826493 esp=8089c438 ebp=8089c450 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x2a1:
80826493 833dc0828a8000 cmp dword ptr [nt!KiFreezeFlag (808a82c0)],0x0 ds:0023:808a82c0=00000000
ChildEBP RetAddr Args to Child
8089c450 8082d69f badb0d00 867ddca0 8089c480 nt!KiTrap0E+0x2a1 (FPO: [0,0] TrapFrame @ 8089c450)
8089c4e8 f6d8ac68 8627d328 85dcf520 0189c528 nt!MmUnlockPages+0x87d (FPO: [Non-Fpo])
8089c528 f6e76fe2 00000012 00000e20 f6e76fe2 afd!AfdBReceiveEventHandler+0x1e1 (FPO: [Non-Fpo])
86464d70 00000000 85e08aa0 86672908 86488030 tcpip!IndicateData+0x273 (FPO: [Non-Fpo])
start end module name
80800000 80a6b000 nt ntoskrnl.exe Fri Mar 25 02:41:23 2005 (42435E33)
80a6b000 80a97000 hal halaacpi.dll Fri Mar 25 02:28:37 2005 (42435B35)
bf800000 bf9cf000 win32k win32k.sys Fri Mar 25 02:40:09 2005 (42435DE9)
bf9cf000 bf9e5000 dxg dxg.sys Fri Mar 25 02:27:25 2005 (42435AED)
bf9e5000 bfa41480 ati2dvaa ati2dvaa.dll Tue Mar 25 11:43:38 2003 (3E8024CA)
f6c72000 f6c8e000 dump_atapi dump_atapi.sys Fri Mar 25 02:28:49 2005 (42435B41)
f6cb6000 f6cc7000 Fips Fips.SYS Fri Mar 25 02:40:33 2005 (42435E01)
f6cc7000 f6d3d000 mrxsmb mrxsmb.sys Fri Mar 25 02:41:13 2005 (42435E29)
f6d3d000 f6d6d000 rdbss rdbss.sys Fri Mar 25 02:40:49 2005 (42435E11)
f6d6d000 f6d97000 afd afd.sys Fri Mar 25 02:40:43 2005 (42435E0B)
f6e37000 f6e68000 netbt netbt.sys Fri Mar 25 02:40:31 2005 (42435DFF)
f6e68000 f6ec9000 tcpip tcpip.sys Fri Mar 25 02:40:31 2005 (42435DFF)
f6ec9000 f6ee2000 ipsec ipsec.sys Fri Mar 25 02:40:49 2005 (42435E11)
f6f8a000 f6fca000 update update.sys Fri Mar 25 02:40:27 2005 (42435DFB)
f6fca000 f6ff2000 ks ks.sys Fri Mar 25 02:41:03 2005 (42435E1F)
f7002000 f700b000 dump_WMILIB dump_WMILIB.SYS Tue Mar 25 09:13:00 2003 (3E80017C)
f7022000 f702c000 Dxapi Dxapi.sys Tue Mar 25 09:06:01 2003 (3E7FFFD9)
f70ba000 f70f1000 rdpdr rdpdr.sys Fri Mar 25 02:30:20 2005 (42435B9C)
f70f1000 f7104000 raspptp raspptp.sys Fri Mar 25 02:40:43 2005 (42435E0B)
f7104000 f711e000 ndiswan ndiswan.sys Fri Mar 25 02:40:46 2005 (42435E0E)
f711e000 f7133000 rasl2tp rasl2tp.sys Fri Mar 25 02:40:29 2005 (42435DFD)
f7133000 f7146000 i8042prt i8042prt.sys Fri Mar 25 02:41:05 2005 (42435E21)
f7146000 f7157600 el90xbc5 el90xbc5.sys Wed Aug 14 07:27:20 2002 (3D59DC28)
f716f000 f718a000 VIDEOPRT VIDEOPRT.SYS Fri Mar 25 02:29:53 2005 (42435B81)
f718a000 f71d9d80 ati2mtaa ati2mtaa.sys Wed Oct 30 20:49:15 2002 (3DC029AB)
f7222000 f72396e0 AMBRIM AMBRIM.sys Tue Jan 06 02:13:02 2004 (3FF9FD8E)
f723a000 f7259000 Mup Mup.sys Fri Mar 25 02:40:49 2005 (42435E11)
f7259000 f728f000 NDIS NDIS.sys Fri Mar 25 02:40:26 2005 (42435DFA)
f728f000 f7324000 Ntfs Ntfs.sys Fri Mar 25 02:40:29 2005 (42435DFD)
f7324000 f734b000 KSecDD KSecDD.sys Fri Mar 25 02:28:53 2005 (42435B45)
f734b000 f7370000 fltmgr fltmgr.sys Fri Mar 25 02:30:25 2005 (42435BA1)
f7370000 f7383000 CLASSPNP CLASSPNP.SYS Fri Mar 25 02:40:23 2005 (42435DF7)
f7383000 f739f000 atapi atapi.sys Fri Mar 25 02:28:49 2005 (42435B41)
f739f000 f73c9000 volsnap volsnap.sys Fri Mar 25 02:29:10 2005 (42435B56)
f73c9000 f73f5000 dmio dmio.sys Fri Mar 25 02:30:02 2005 (42435B8A)
f73f5000 f741c000 ftdisk ftdisk.sys Fri Mar 25 02:29:00 2005 (42435B4C)
f741c000 f7432000 pci pci.sys Fri Mar 25 02:34:14 2005 (42435C86)
f7432000 f7466000 ACPI ACPI.sys Fri Mar 25 02:34:09 2005 (42435C81)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 09:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 09:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Fri Mar 25 02:28:48 2005 (42435B40)
f74b7000 f74c7000 MountMgr MountMgr.sys Fri Mar 25 02:27:23 2005 (42435AEB)
f74c7000 f74d2000 PartMgr PartMgr.sys Fri Mar 25 02:40:34 2005 (42435E02)
f74d7000 f74e7000 disk disk.sys Fri Mar 25 02:28:58 2005 (42435B4A)
f74e7000 f74f3000 Dfs Dfs.sys Fri Mar 25 02:30:28 2005 (42435BA4)
f74f7000 f7507000 uagp35 uagp35.sys Fri Mar 25 02:34:11 2005 (42435C83)
f7507000 f7511000 crcdisk crcdisk.sys Fri Mar 25 02:29:40 2005 (42435B74)
f7537000 f7541000 flpydisk flpydisk.sys Tue Mar 25 09:04:32 2003 (3E7FFF80)
f7547000 f7553000 vga vga.sys Fri Mar 25 02:29:54 2005 (42435B82)
f7557000 f7562000 Msfs Msfs.SYS Fri Mar 25 02:30:04 2005 (42435B8C)
f7567000 f7574000 Npfs Npfs.SYS Fri Mar 25 02:30:04 2005 (42435B8C)
f7577000 f7585000 msgpc msgpc.sys Fri Mar 25 02:33:31 2005 (42435C5B)
f7587000 f7594000 wanarp wanarp.sys Fri Mar 25 02:34:07 2005 (42435C7F)
f7597000 f75a4000 netbios netbios.sys Fri Mar 25 02:33:21 2005 (42435C51)
f7627000 f7636000 amdk7 amdk7.sys Fri Mar 25 02:28:40 2005 (42435B38)
f7637000 f7640000 watchdog watchdog.sys Fri Mar 25 02:30:19 2005 (42435B9B)
f7647000 f7651400 fetnd5b fetnd5b.sys Thu Apr 24 06:28:02 2003 (3EA759C2)
f7657000 f7662000 fdc fdc.sys Fri Mar 25 02:28:43 2005 (42435B3B)
f7667000 f7671000 kbdclass kbdclass.sys Tue Mar 25 09:03:10 2003 (3E7FFF2E)
f7677000 f7680000 ndistapi ndistapi.sys Fri Mar 25 02:34:11 2005 (42435C83)
f7687000 f7696000 raspppoe raspppoe.sys Fri Mar 25 02:34:16 2005 (42435C88)
f7697000 f76a2000 TDI TDI.SYS Fri Mar 25 02:35:34 2005 (42435CD6)
f76a7000 f76b2000 ptilink ptilink.sys Fri Mar 25 02:28:25 2005 (42435B29)
f76b7000 f76c0000 raspti raspti.sys Fri Mar 25 02:34:16 2005 (42435C88)
f76c7000 f76d6000 termdd termdd.sys Fri Mar 25 02:27:15 2005 (42435AE3)
f76d7000 f76e1000 mouclass mouclass.sys Tue Mar 25 09:03:09 2003 (3E7FFF2D)
f76e7000 f76f0000 mssmbios mssmbios.sys Fri Mar 25 02:34:14 2005 (42435C86)
f76f7000 f7705000 NDProxy NDProxy.SYS Fri Mar 25 02:34:13 2005 (42435C85)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 09:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 09:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 09:04:46 2003 (3E7FFF8E)
f771f000 f7726000 viaide viaide.sys Tue Mar 25 09:04:49 2003 (3E7FFF91)
f7727000 f772e000 dmload dmload.sys Tue Mar 25 09:08:08 2003 (3E800058)
f772f000 f7734880 amdagp2k amdagp2k.sys Tue Dec 11 22:51:50 2001 (3C1671E6)
f775f000 f7766000 dxgthk dxgthk.sys Tue Mar 25 09:05:52 2003 (3E7FFFD0)
f77bf000 f77c7000 audstub audstub.sys Tue Mar 25 09:09:12 2003 (3E800098)
f77d7000 f77df000 Fs_Rec Fs_Rec.SYS Tue Mar 25 09:08:36 2003 (3E800074)
f77df000 f77e6000 Null Null.SYS Tue Mar 25 09:03:05 2003 (3E7FFF29)
f77e7000 f77ee000 Beep Beep.SYS Tue Mar 25 09:03:04 2003 (3E7FFF28)
f77ef000 f77f7000 mnmdd mnmdd.SYS Tue Mar 25 09:07:53 2003 (3E800049)
f77f7000 f77ff000 RDPCDD RDPCDD.sys Tue Mar 25 09:03:05 2003 (3E7FFF29)
f77ff000 f7807000 rasacd rasacd.sys Tue Mar 25 09:11:50 2003 (3E800136)
f7987000 f7988100 amdeide amdeide.sys Mon Jan 14 16:40:26 2002 (3C42EDDA)
f79a3000 f79a4280 swenum swenum.sys Fri Mar 25 02:27:42 2005 (42435AFE)
f7af5000 f7af6000 hmonitor hmonitor.sys Tue Mar 30 10:43:08 2004 (4069250C)
f7af7000 f7af78e0 hname hname.sys Thu Jun 21 16:26:14 2001 (3B31F5F6)

Unloaded modules:
f698a000 f69a2000 parport.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f75a7000 f75b5000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f6d59000 f6d6d000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f6d58000 f6d6d000 serial.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77cf000 f77d4000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f6eed000 f6f02000 cdrom.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77c7000 f77cf000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
 
Its been around 72 hours uptime after i replaced 3com network adapter.
I hope the problem will be solved.
 
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.

I was about to say that your problem is hardware based...
but I was guessing either driver problems or a fault in RAM more than actual card problems...

can you set the IRQ individually on the card you took out? it could be that it is set wrong.
 
Back
Top Bottom