Win2000 memoery dump

Hi,

I have a win2000 server sp4. And last night it reboot by itself with memory
dump. Here is event log:

Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: 8/11/2006
Time: 8:14:21 p.m.
User: N/A
Computer: WIN2K
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a
(0xc00172fc, 0x00000002, 0x00000000, 0x8044074e). Microsoft Windows 2000
[v15.2195]. A dump was saved in: C:\WINNT\MEMORY.DMP.

So I use dumpchk.exe to analysis the dump file. Here is the dumpchk.exe
output. Can any expert tell me what cause my server reboot please?

Cheers,

Tao

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
C:\Program Files\Debugging Tools for Windows>dumpchk -y
http://msdl.microsoft.com/download/symbols c:\winnt\memory.dmp

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\winnt\memory.dmp]
Kernel Complete Dump File: Full address space is available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580
Debug session time: Wed Nov 8 20:10:47.703 2006 (GMT+13)
System Uptime: 19 days 8:09:22.453
Loading Kernel Symbols
.................................................. .................................................. .....
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
Loading unloaded module list
..............
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {c00172fc, 2, 0, 8044074e}

Probably caused by : memory_corruption ( nt!MiDeleteValidAddress+24 )

Followup: MachineOwner
---------

----- 32 bit Kernel Full Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000893
KdSecondaryVersion 00000000
DirectoryTableBase 1d72a000
PfnDataBase 820d6000
PsLoadedModuleList 80481580
PsActiveProcessHead 80483008
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 0000000a
BugCheckParameter1 c00172fc
BugCheckParameter2 00000002
BugCheckParameter3 00000000
BugCheckParameter4 8044074e
PaeEnabled 00000000
KdDebuggerDataBlock 8046d470

Physical Memory Description:
Number of runs: 4 (limited to 4)
FileOffset Start Address Length
00001000 00001000 0001f000
00020000 00030000 00070000
00090000 00100000 00eff000
00f8f000 01000000 1eff0000
Last Page: 1ff7e000 1ffef000

KiProcessorBlock at 80480940
1 KiProcessorBlock entries:
ffdff120


Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580
Debug session time: Wed Nov 8 20:10:47.703 2006 (GMT+13)
System Uptime: 19 days 8:09:22.453
start end module name
80062000 80078840 hal Fri Mar 21 14:04:11 2003 (3E7A731B)
80400000 8059cd00 nt Fri Jun 16 19:04:41 2006 (44925809)
a0000000 a0190000 win32k Thu Oct 06 22:33:42 2005 (4344EF76)
a0190000 a01ebc00 ati2dvaa Wed Jun 12 13:33:48 2002 (3D06A4FC)
a07e0000 a07ed000 RDPDD unavailable (FFFFFFFE)
bbf40000 bbf55f20 RDPWD Fri Jun 17 18:41:40 2005 (42B270A4)
bbf56000 bbf69ac0 ipsec Tue Apr 22 06:19:40 2003 (3EA4363C)
bc186000 bc188f20 spud Sat Nov 20 12:36:27 1999 (3835DEFB)
bc19a000 bc1bcac0 Fastfat Tue Jul 19 22:44:42 2005 (42DCD99A)
bc5a5000 bc5df5a0 srv Fri Apr 21 04:54:35 2006 (4447BCCB)
bc648000 bc650a60 termdd Sat Mar 22 09:43:08 2003 (3E7B876C)
bc698000 bc6a7600 Cdfs Sat Apr 02 13:23:36 2005 (424DF418)
bc7bd000 bc7cef80 wdmaud Wed Apr 16 16:23:02 2003 (3E9CDAA6)
bc81f000 bc83e140 afd Tue Apr 12 09:31:21 2005 (425AECA9)
bc9a7000 bc9b85c0 dump_Fasttrak Thu May 23 15:28:23 2002 (3CEC61D7)
bc9b9000 bca1e620 mrxsmb Wed May 31 19:14:13 2006 (447D4245)
bca59000 bca82a20 rdbss Tue Jul 19 17:42:03 2005 (42DC92AB)
bcb23000 bcb4dd00 netbt Sat Apr 02 13:23:24 2005 (424DF40C)
bcb4e000 bcb9c240 tcpip Wed Apr 26 01:38:49 2006 (444E2669)
bfc01000 bfc046c0 dump_diskdump Wed Feb 26 08:18:04 2003 (3E5BC16C)
bfc25000 bfc4f3a0 update Wed Apr 16 16:22:01 2003 (3E9CDA69)
bfc62000 bfc85060 rdpdr Sat Mar 22 09:43:14 2003 (3E7B8772)
bfc86000 bfca5d00 KS Thu Dec 05 06:09:38 2002 (3DEE36D2)
bfca6000 bfcca1e0 portcls Wed Apr 16 16:11:22 2003 (3E9CD7EA)
bfccb000 bfd72f80 ALCXWDM Thu Mar 27 17:44:22 2003 (3E828FB6)
bfd73000 bfd96600 e100bnt5 Wed Mar 05 08:54:47 2003 (3E650487)
bfd97000 bfdb81e0 USBPORT Wed Apr 24 05:46:44 2002 (3CC59E04)
bfdb9000 bfe09740 ati2mtaa Wed Jun 12 13:33:35 2002 (3D06A4EF)
bfe2a000 bfe2d580 vga Sun Sep 26 06:37:40 1999 (37ED1674)
bfe32000 bfe48ba0 ndiswan Wed Apr 30 11:05:01 2003 (3EAF051D)
bfe69000 bfe7ebe0 Mup Fri Dec 03 16:37:23 2004 (41AFDF73)
bfe7f000 bfea8aa0 NDIS Wed Apr 30 11:05:01 2003 (3EAF051D)
bfea9000 bff26480 Ntfs Tue May 10 21:20:29 2005 (42807CDD)
bff27000 bff387c0 KSecDD Sun Sep 21 12:32:19 2003 (3F6CF193)
bff39000 bff4b1c0 Dfs Wed Feb 12 15:19:06 2003 (3E49AF1A)
bff4c000 bff6e000 fltmgr unavailable (FFFFFFFE)
bff6e000 bff85660 IdeChnDr Wed Oct 02 06:34:43 2002 (3D99EAC3)
bff86000 bff98180 SCSIPORT Fri Jul 15 00:24:06 2005 (42D65966)
bff99000 bffaa5c0 Fasttrak Thu May 23 15:28:23 2002 (3CEC61D7)
bffab000 bffc0180 atapi Wed Apr 02 06:08:25 2003 (3E89D599)
bffc1000 bffe29c0 dmio Thu Jan 16 08:47:04 2003 (3E25BAB8)
bffe3000 bffff5a0 ftdisk Fri Dec 03 16:29:58 2004 (41AFDDB6)
eb400000 eb40e6a0 pci Thu Jan 16 08:44:07 2003 (3E25BA07)
eb410000 eb41b680 isapnp Thu Jan 16 08:43:47 2003 (3E25B9F3)
eb420000 eb429220 ohci1394 Thu Jan 16 08:46:43 2003 (3E25BAA3)
eb430000 eb439e20 1394BUS Tue Apr 08 17:56:58 2003 (3E9264AA)
eb440000 eb448700 CLASSPNP Thu Jan 16 08:42:51 2003 (3E25B9BB)
eb470000 eb47ca80 rasl2tp Wed Apr 30 11:05:06 2003 (3EAF0522)
eb480000 eb48bc40 raspptp Thu May 15 11:47:00 2003 (3EC2D574)
eb490000 eb49ea20 parallel Thu Jan 16 08:47:14 2003 (3E25BAC2)
eb4a0000 eb4ac4c0 VIDEOPRT Thu Jan 16 08:47:20 2003 (3E25BAC8)
eb4c0000 eb4cf400 serial Wed Apr 16 16:19:39 2003 (3E9CD9DB)
eb4d0000 eb4d9ce0 NDProxy Fri Oct 01 11:25:35 1999 (37F3F16F)
eb4f0000 eb4f9be0 usbhub Wed Mar 19 11:30:41 2003 (3E77AC21)
eb500000 eb50c160 usbhub20 Thu Jan 16 08:45:59 2003 (3E25BA77)
eb520000 eb52b680 i8042prt Wed Apr 16 16:00:59 2003 (3E9CD57B)
eb530000 eb538fa0 Npfs Sun Oct 10 12:58:07 1999 (37FFD68F)
eb540000 eb548680 msgpc Thu Jan 16 08:54:25 2003 (3E25BC71)
eb550000 eb5581a0 netbios Wed Oct 13 08:34:19 1999 (38038D3B)
eb600000 eb608240 Fips Wed May 10 03:28:29 2000 (39182E9D)
eb660000 eb66b8c0 sysaudio Wed Apr 16 16:21:44 2003 (3E9CDA58)
eb680000 eb685520 PCIIDEX Wed Feb 26 07:31:08 2003 (3E5BB66C)
eb688000 eb68f4c0 MountMgr Tue Aug 16 20:40:55 2005 (4301A697)
eb690000 eb697720 disk Thu Jan 16 08:43:05 2003 (3E25B9C9)
eb698000 eb69d100 agp440 Thu Jan 16 08:47:07 2003 (3E25BABB)
eb6a0000 eb6a4a00 usbehci Wed Apr 24 05:46:55 2002 (3CC59E0F)
eb6b0000 eb6b6a20 EFS Thu Jan 16 08:46:55 2003 (3E25BAAF)
eb6e0000 eb6e4a60 flpydisk Thu Jan 16 08:42:52 2003 (3E25B9BC)
eb6f0000 eb6f6c40 cdrom Thu Jan 16 08:43:04 2003 (3E25B9C8)
eb700000 eb705fa0 HIDCLASS Thu Jan 16 08:45:26 2003 (3E25BA56)
eb708000 eb70d900 HIDPARSE Wed Apr 09 05:34:46 2003 (3E930836)
eb718000 eb71d400 mouclass Fri Feb 21 05:37:45 2003 (3E550459)
eb728000 eb72d240 Msfs Wed Oct 27 12:21:32 1999 (3816377C)
eb730000 eb7348c0 TDTCP Sat Mar 22 09:43:08 2003 (3E7B876C)
eb758000 eb75c400 ptilink Thu Jan 16 08:47:15 2003 (3E25BAC3)
eb768000 eb76c0e0 raspti Sat Oct 09 09:45:10 1999 (37FE57D6)
eb7b0000 eb7b7d00 wanarp Sat Aug 17 00:25:01 2002 (3D5CEF1D)
eb7c0000 eb7c5ec0 kbdclass Fri Feb 21 05:37:30 2003 (3E55044A)
eb7d0000 eb7d6100 parport Thu Jan 16 08:47:13 2003 (3E25BAC1)
eb7e8000 eb7eff40 uhcd Thu Jan 16 08:45:50 2003 (3E25BA6E)
eb7f8000 eb7ff000 fdc unavailable (FFFFFFFE)
eb800000 eb804fc0 USBD Thu Jan 23 06:05:33 2003 (3E2ECF5D)
eb810000 eb812a20 BOOTVID Thu Nov 04 14:24:33 1999 (3820E051)
eb814000 eb816d00 PartMgr Thu Jan 16 08:43:07 2003 (3E25B9CB)
eb818000 eb81b100 IdeBusDr Wed Oct 02 06:34:09 2002 (3D99EAA1)
eb88c000 eb88e2e0 ndistapi Thu Jan 16 08:54:15 2003 (3E25BC67)
eb89c000 eb89fe60 TDI Thu Jan 16 08:56:26 2003 (3E25BCEA)
eb8ac000 eb8af800 s32ait Fri Feb 24 08:09:10 2006 (43FE0856)
eb8b4000 eb8b69a0 TAPE Thu Jan 16 08:43:11 2003 (3E25B9CF)
eb8d4000 eb8d7640 serenum Thu Jan 16 08:47:01 2003 (3E25BAB5)
eb8dc000 eb8de540 gameenum Thu Jan 16 08:45:32 2003 (3E25BA5C)
eb900000 eb901100 intelide Thu Feb 20 06:19:09 2003 (3E53BC8D)
eb902000 eb903d20 Diskperf Thu Feb 13 10:34:38 2003 (3E4ABDEE)
eb904000 eb906000 dmload unavailable (FFFFFFFE)
eb914000 eb915ca0 Fs_Rec Thu Jan 16 08:53:30 2003 (3E25BC3A)
eb91c000 eb91de40 rasacd Sun Sep 26 06:41:23 1999 (37ED1753)
eb956000 eb958000 ParVdm unavailable (FFFFFFFE)
eb9c8000 eb9c8b00 pciide Thu Jan 16 08:43:03 2003 (3E25B9C7)
eb9c9000 eb9c9f80 WMILIB Sun Sep 26 06:36:47 1999 (37ED163F)
eb9cf000 eb9cfa40 audstub Sun Sep 26 06:35:33 1999 (37ED15F5)
eb9e7000 eb9e8000 swenum Thu Dec 05 06:10:07 2002 (3DEE36EF)
eb9f0000 eb9f0a00 msmpu401 Sun Sep 26 06:35:15 1999 (37ED15E3)
eba00000 eba01000 Null unavailable (FFFFFFFE)
eba02000 eba02ee0 Beep Thu Oct 21 11:18:59 1999 (380E3FD3)
eba08000 eba08f80 mnmdd Sun Sep 26 06:37:40 1999 (37ED1674)

Unloaded modules:
bb7c9000 bb7ee000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb7c9000 bb7ee000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb92e000 bb953000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bbdb3000 bbdd8000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc6f8000 bc71d000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc917000 bc924000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eb5f0000 eb5fe000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc807000 bc80b000 hidusb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eb560000 eb569000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eb888000 eb88c000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eb6f8000 eb6fd000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
eb8fc000 eb8ff000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
eb4b0000 eb4bc000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {c00172fc, 2, 0, 8044074e}

Probably caused by : memory_corruption ( nt!MiDeleteValidAddress+24 )

Followup: MachineOwner
---------

Finished dump check
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

I use 'analyze -v' to get more info here, can anyone give me some suggestion
what's wrong with my server please?



kd> !analyze -v
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at
an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c00172fc, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8044074e, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: c00172fc Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiDeleteValidAddress+24
8044074e 8b0b mov ecx,dword ptr [ebx]

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

BUGCHECK_STR: 0xA

PROCESS_NAME: ibserver.exe

TRAP_FRAME: bc3b0af4 -- (.trap ffffffffbc3b0af4)
ErrCode = 00000000
eax=00000001 ebx=c00172fc ecx=00000041 edx=820d6000 esi=000007b2
edi=814aea30
eip=8044074e esp=bc3b0b68 ebp=bc3b0b7c iopl=0 nv up ei pl zr na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
nt!MiDeleteValidAddress+0x24:
8044074e 8b0b mov ecx,dword ptr [ebx]
ds:0023:c00172fc=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8044074e to 80467df7

STACK_TEXT:
bc3b0af4 8044074e 8043ea88 80481de0 000011f5 nt!KiTrap0E+0x20b
bc3b0b7c 804406e1 05cbf201 814ae960 bc3b0c50 nt!MiDeleteValidAddress+0x24
bc3b0b9c 8043f7a3 814ae960 00000000 812fa020
nt!MiDeleteAddressesInWorkingSet+0x
79
bc3b0c50 804e3bdf 812fa020 00000080 80064c04
nt!MmCleanProcessAddressSpace+0x209

bc3b0d00 804e367c 00000080 fd1b3808 8042f6e0 nt!PspExitThread+0x4e1
bc3b0d0c 8042f6e0 fd1b3808 bc3b0d48 bc3b0d3c nt!PsExitSpecialApc+0x1a
bc3b0d4c 8046507d 00000001 00000000 bc3b0d64 nt!KiDeliverApc+0x16e
bc3b0d4c 77f884ff 00000001 00000000 bc3b0d64 nt!KiServiceExit+0x58
WARNING: Frame IP not in any known module. Following frames may be wrong.
0149f958 00000000 00000000 00000000 00000000 0x77f884ff


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiDeleteValidAddress+24
8044074e 8b0b mov ecx,dword ptr [ebx]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 44925809

SYMBOL_NAME: nt!MiDeleteValidAddress+24

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiDeleteValidAddress+24

BUCKET_ID: 0xA_nt!MiDeleteValidAddress+24

Followup: MachineOwner
---------

kd>