Crashdump Win2k Server

my windows 2000 server (sp4, latest updates) is crashing from time to time
whit BSOD error 0A (irql_not_less_or_equal). i analyzed the crashdump (64k
dump) with the debugging tools, but i am not able to find out, what the
cause of the crashes is.
maybe anyone can help me analyze this?

here the log file from debugger:


Microsoft (R) Windows Debugger Version 6.4.0007.2

Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT.SBS\Minidump\Mini052105-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\winnt.sbs\symbols

Executable search path is:

Unable to load image ntoskrnl.exe, Win32 error 2

*** WARNING: symbols timestamp is wrong 0x42258bf7 0x3ee6c002 for
ntoskrnl.exe

Windows 2000 Kernel Version 2195 (Service Pack 4) MP (2 procs) Free x86
compatible

Kernel base = 0x80400000 PsLoadedModuleList = 0x80485ac0

Debug session time: Sat May 21 07:34:13.656 2005 (GMT+2)

System Uptime: not available

Unable to load image ntoskrnl.exe, Win32 error 2

*** WARNING: symbols timestamp is wrong 0x42258bf7 0x3ee6c002 for
ntoskrnl.exe

Loading Kernel Symbols

............................................................................................................

Loading unloaded module list

................

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 1c, 0, 8042d43f}

Probably caused by : ntoskrnl.exe ( nt!KeConnectInterrupt+90 )

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at
an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 00000000, memory referenced

Arg2: 0000001c, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: 8042d43f, address which referenced memory

Debugging Details:

------------------


READ_ADDRESS: unable to read from 80482fac

unable to read from 80482a08

unable to read from 804828e0

unable to read from 80474e00

unable to read from 804828f8

unable to read from 80482a04

unable to read from 80474e04

unable to read from 80482ac4

unable to read from 80482f80

00000000

CURRENT_IRQL: 1c

FAULTING_IP:

nt!KeConnectInterrupt+90

8042d43f ?? ???

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 00000000 to 8046b11c

STACK_TEXT:

bce55cb8 00000000 00000000 0000001c 00000000 nt!ExAllocatePoolWithTag+0x3b1


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:

nt!KeConnectInterrupt+90

8042d43f ?? ???

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KeConnectInterrupt+90

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42258bf7

FAILURE_BUCKET_ID: 0xA_nt!KeConnectInterrupt+90

BUCKET_ID: 0xA_nt!KeConnectInterrupt+90

Followup: MachineOwner

---------





.

Relevant Pages