Please help with this dump

My Windows 2000 server has been rebooting everyday for the last couple
of weeks. The dump analysis is pasted below..


Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

************************************************** **********************
WARNING: Dump file has inconsistent set-bit count. Data may be
missing.
************************************************** **********************
Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Tue Apr 18 01:47:40.484 2006 (GMT-5)
System Uptime: 3 days 1:07:38.359
Loading Kernel Symbols
................................Page bb3c not present in the dump file.
Type ".hh dbgerr004" for details
.................................................. ...............
Loading unloaded module list
......
Loading User Symbols
.................................................. ...............
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 1, bfe25327}

*** ERROR: Module load completed but symbols could not be loaded for
b57w2k.sys
Probably caused by : hardware ( b57w2k+510e )

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
................................Page bb3c not present in the dump file.
Type ".hh dbgerr004" for details
.................................................. ...............
Loading unloaded module list
......
Loading User Symbols
.................................................. ...............
1: kd> .symfix
No downstream store given, using C:\Program Files\Debugging Tools for
Windows\sym
1: kd> .reload
Loading Kernel Symbols
................................Page bb3c not present in the dump file.
Type ".hh dbgerr004" for details
.................................................. ...............
Loading unloaded module list
......
Loading User Symbols
.................................................. ...............
1: kd> !analyze
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 1, bfe25327}

*** ERROR: Module load completed but symbols could not be loaded for
b57w2k.sys
Probably caused by : hardware ( b57w2k+510e )

Followup: MachineOwner
---------

1: kd> !analyze -v
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: bfe25327, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
NDIS!ndisMStartSendPackets+268
bfe25327 c60000 mov byte ptr [eax],0x0

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from bfd2510e to bfe25327

MISALIGNED_IP:
NDIS!ndisMStartSendPackets+268
bfe25327 c60000 mov byte ptr [eax],0x0

TRAP_FRAME: f5c2fb8c -- (.trap fffffffff5c2fb8c)
ErrCode = 00000002
eax=00000000 ebx=88eb3ea8 ecx=88e15202 edx=000005ea esi=88e411e0
edi=88eac2f0
eip=bfe25327 esp=f5c2fc00 ebp=f5c2fc48 iopl=0 nv up ei pl zr na
po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
NDIS!ndisMStartSendPackets+0x268:
bfe25327 c60000 mov byte ptr [eax],0x0
ds:0023:00000000=??
Resetting default scope

STACK_TEXT:
f5c2fc48 bfd2510e 88eac200 f5c2fdf8 00000003
NDIS!ndisMStartSendPackets+0x268
WARNING: Stack unwind information not available. Following frames may
be wrong.
f5c2ff98 bfd2f0ff 00000003 88ead110 88e98000 b57w2k+0x510e
00000000 00000000 00000000 00000000 00000000 b57w2k+0xf0ff


FOLLOWUP_IP:
b57w2k+510e
bfd2510e 33ff xor edi,edi

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: b57w2k+510e

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: .trap fffffffff5c2fb8c ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner
---------

Hi,

My best guess is that there is problem with b57w2k.sys which is Broadcom NIC
driver.

What you can do is try to update to newer driver (check Broadcom webpage).

I hope this helps.

--
Mike
Microsoft MVP - Windows Security

<(E-Mail Removed)> wrote in message
news:(E-Mail Removed) oups.com...
> My Windows 2000 server has been rebooting everyday for the last couple
> of weeks. The dump analysis is pasted below..
>
>
> Microsoft (R) Windows Debugger Version 6.4.0007.2
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> ************************************************** **********************
> WARNING: Dump file has inconsistent set-bit count. Data may be
> missing.
> ************************************************** **********************
> Symbol search path is:
> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
> compatible
> Product: Server, suite: TerminalServer SingleUserTS
> Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
> Debug session time: Tue Apr 18 01:47:40.484 2006 (GMT-5)
> System Uptime: 3 days 1:07:38.359
> Loading Kernel Symbols
> ...............................Page bb3c not present in the dump file.
> Type ".hh dbgerr004" for details
> .................................................. ..............
> Loading unloaded module list
> .....
> Loading User Symbols
> .................................................. ..............
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck D1, {0, 2, 1, bfe25327}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> b57w2k.sys
> Probably caused by : hardware ( b57w2k+510e )
>
> Followup: MachineOwner
> ---------
>
> 1: kd> .reload
> Loading Kernel Symbols
> ...............................Page bb3c not present in the dump file.
> Type ".hh dbgerr004" for details
> .................................................. ..............
> Loading unloaded module list
> .....
> Loading User Symbols
> .................................................. ..............
> 1: kd> .symfix
> No downstream store given, using C:\Program Files\Debugging Tools for
> Windows\sym
> 1: kd> .reload
> Loading Kernel Symbols
> ...............................Page bb3c not present in the dump file.
> Type ".hh dbgerr004" for details
> .................................................. ..............
> Loading unloaded module list
> .....
> Loading User Symbols
> .................................................. ..............
> 1: kd> !analyze
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck D1, {0, 2, 1, bfe25327}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> b57w2k.sys
> Probably caused by : hardware ( b57w2k+510e )
>
> Followup: MachineOwner
> ---------
>
> 1: kd> !analyze -v
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
> An attempt was made to access a pageable (or completely invalid)
> address at an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If kernel debugger is available get stack backtrace.
> Arguments:
> Arg1: 00000000, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, value 0 = read operation, 1 = write operation
> Arg4: bfe25327, address which referenced memory
>
> Debugging Details:
> ------------------
>
>
> WRITE_ADDRESS: 00000000
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> NDIS!ndisMStartSendPackets+268
> bfe25327 c60000 mov byte ptr [eax],0x0
>
> DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
>
> BUGCHECK_STR: 0xD1
>
> LAST_CONTROL_TRANSFER: from bfd2510e to bfe25327
>
> MISALIGNED_IP:
> NDIS!ndisMStartSendPackets+268
> bfe25327 c60000 mov byte ptr [eax],0x0
>
> TRAP_FRAME: f5c2fb8c -- (.trap fffffffff5c2fb8c)
> ErrCode = 00000002
> eax=00000000 ebx=88eb3ea8 ecx=88e15202 edx=000005ea esi=88e411e0
> edi=88eac2f0
> eip=bfe25327 esp=f5c2fc00 ebp=f5c2fc48 iopl=0 nv up ei pl zr na
> po nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010246
> NDIS!ndisMStartSendPackets+0x268:
> bfe25327 c60000 mov byte ptr [eax],0x0
> ds:0023:00000000=??
> Resetting default scope
>
> STACK_TEXT:
> f5c2fc48 bfd2510e 88eac200 f5c2fdf8 00000003
> NDIS!ndisMStartSendPackets+0x268
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> f5c2ff98 bfd2f0ff 00000003 88ead110 88e98000 b57w2k+0x510e
> 00000000 00000000 00000000 00000000 00000000 b57w2k+0xf0ff
>
>
> FOLLOWUP_IP:
> b57w2k+510e
> bfd2510e 33ff xor edi,edi
>
> SYMBOL_STACK_INDEX: 1
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: b57w2k+510e
>
> IMAGE_NAME: hardware
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 0
>
> STACK_COMMAND: .trap fffffffff5c2fb8c ; kb
>
> MODULE_NAME: hardware
>
> FAILURE_BUCKET_ID: IP_MISALIGNED
>
> BUCKET_ID: IP_MISALIGNED
>
> Followup: MachineOwner
> ---------
>

"(E-Mail Removed)" wrote:

> My Windows 2000 server has been rebooting everyday for the last couple
> of weeks. The dump analysis is pasted below..
>
>
> Microsoft (R) Windows Debugger Version 6.4.0007.2
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> ************************************************** **********************
> WARNING: Dump file has inconsistent set-bit count. Data may be
> missing.
> ************************************************** **********************
> Symbol search path is:
> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
> compatible
> Product: Server, suite: TerminalServer SingleUserTS
> Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
> Debug session time: Tue Apr 18 01:47:40.484 2006 (GMT-5)
> System Uptime: 3 days 1:07:38.359
> Loading Kernel Symbols
> ................................Page bb3c not present in the dump file.
> Type ".hh dbgerr004" for details
> .................................................. ...............
> Loading unloaded module list
> ......
> Loading User Symbols
> .................................................. ...............
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck D1, {0, 2, 1, bfe25327}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> b57w2k.sys
> Probably caused by : hardware ( b57w2k+510e )
>
> Followup: MachineOwner
> ---------
>
> 1: kd> .reload
> Loading Kernel Symbols
> ................................Page bb3c not present in the dump file.
> Type ".hh dbgerr004" for details
> .................................................. ...............
> Loading unloaded module list
> ......
> Loading User Symbols
> .................................................. ...............
> 1: kd> .symfix
> No downstream store given, using C:\Program Files\Debugging Tools for
> Windows\sym
> 1: kd> .reload
> Loading Kernel Symbols
> ................................Page bb3c not present in the dump file.
> Type ".hh dbgerr004" for details
> .................................................. ...............
> Loading unloaded module list
> ......
> Loading User Symbols
> .................................................. ...............
> 1: kd> !analyze
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck D1, {0, 2, 1, bfe25327}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> b57w2k.sys
> Probably caused by : hardware ( b57w2k+510e )
>
> Followup: MachineOwner
> ---------
>
> 1: kd> !analyze -v
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
> An attempt was made to access a pageable (or completely invalid)
> address at an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If kernel debugger is available get stack backtrace.
> Arguments:
> Arg1: 00000000, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, value 0 = read operation, 1 = write operation
> Arg4: bfe25327, address which referenced memory
>
> Debugging Details:
> ------------------
>
>
> WRITE_ADDRESS: 00000000
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> NDIS!ndisMStartSendPackets+268
> bfe25327 c60000 mov byte ptr [eax],0x0
>
> DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
>
> BUGCHECK_STR: 0xD1
>
> LAST_CONTROL_TRANSFER: from bfd2510e to bfe25327
>
> MISALIGNED_IP:
> NDIS!ndisMStartSendPackets+268
> bfe25327 c60000 mov byte ptr [eax],0x0
>
> TRAP_FRAME: f5c2fb8c -- (.trap fffffffff5c2fb8c)
> ErrCode = 00000002
> eax=00000000 ebx=88eb3ea8 ecx=88e15202 edx=000005ea esi=88e411e0
> edi=88eac2f0
> eip=bfe25327 esp=f5c2fc00 ebp=f5c2fc48 iopl=0 nv up ei pl zr na
> po nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010246
> NDIS!ndisMStartSendPackets+0x268:
> bfe25327 c60000 mov byte ptr [eax],0x0
> ds:0023:00000000=??
> Resetting default scope
>
> STACK_TEXT:
> f5c2fc48 bfd2510e 88eac200 f5c2fdf8 00000003
> NDIS!ndisMStartSendPackets+0x268
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> f5c2ff98 bfd2f0ff 00000003 88ead110 88e98000 b57w2k+0x510e
> 00000000 00000000 00000000 00000000 00000000 b57w2k+0xf0ff
>
>
> FOLLOWUP_IP:
> b57w2k+510e
> bfd2510e 33ff xor edi,edi
>
> SYMBOL_STACK_INDEX: 1
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: b57w2k+510e
>
> IMAGE_NAME: hardware
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 0
>
> STACK_COMMAND: .trap fffffffff5c2fb8c ; kb
>
> MODULE_NAME: hardware
>
> FAILURE_BUCKET_ID: IP_MISALIGNED
>
> BUCKET_ID: IP_MISALIGNED
>
> Followup: MachineOwner
> ---------
>
>

hellifiknow,but the same thing has been happening to me. the only way i
could get back into windows was to defrag the drive. good luck.

kooop

"(E-Mail Removed)" wrote:

> My Windows 2000 server has been rebooting everyday for the last couple
> of weeks. The dump analysis is pasted below..
>
>
> Microsoft (R) Windows Debugger Version 6.4.0007.2
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> ************************************************** **********************
> WARNING: Dump file has inconsistent set-bit count. Data may be
> missing.
> ************************************************** **********************
> Symbol search path is:
> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
> compatible
> Product: Server, suite: TerminalServer SingleUserTS
> Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
> Debug session time: Tue Apr 18 01:47:40.484 2006 (GMT-5)
> System Uptime: 3 days 1:07:38.359
> Loading Kernel Symbols
> ................................Page bb3c not present in the dump file.
> Type ".hh dbgerr004" for details
> .................................................. ...............
> Loading unloaded module list
> ......
> Loading User Symbols
> .................................................. ...............
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck D1, {0, 2, 1, bfe25327}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> b57w2k.sys
> Probably caused by : hardware ( b57w2k+510e )
>
> Followup: MachineOwner
> ---------
>
> 1: kd> .reload
> Loading Kernel Symbols
> ................................Page bb3c not present in the dump file.
> Type ".hh dbgerr004" for details
> .................................................. ...............
> Loading unloaded module list
> ......
> Loading User Symbols
> .................................................. ...............
> 1: kd> .symfix
> No downstream store given, using C:\Program Files\Debugging Tools for
> Windows\sym
> 1: kd> .reload
> Loading Kernel Symbols
> ................................Page bb3c not present in the dump file.
> Type ".hh dbgerr004" for details
> .................................................. ...............
> Loading unloaded module list
> ......
> Loading User Symbols
> .................................................. ...............
> 1: kd> !analyze
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck D1, {0, 2, 1, bfe25327}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> b57w2k.sys
> Probably caused by : hardware ( b57w2k+510e )
>
> Followup: MachineOwner
> ---------
>
> 1: kd> !analyze -v
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
> An attempt was made to access a pageable (or completely invalid)
> address at an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If kernel debugger is available get stack backtrace.
> Arguments:
> Arg1: 00000000, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, value 0 = read operation, 1 = write operation
> Arg4: bfe25327, address which referenced memory
>
> Debugging Details:
> ------------------
>
>
> WRITE_ADDRESS: 00000000
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> NDIS!ndisMStartSendPackets+268
> bfe25327 c60000 mov byte ptr [eax],0x0
>
> DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
>
> BUGCHECK_STR: 0xD1
>
> LAST_CONTROL_TRANSFER: from bfd2510e to bfe25327
>
> MISALIGNED_IP:
> NDIS!ndisMStartSendPackets+268
> bfe25327 c60000 mov byte ptr [eax],0x0
>
> TRAP_FRAME: f5c2fb8c -- (.trap fffffffff5c2fb8c)
> ErrCode = 00000002
> eax=00000000 ebx=88eb3ea8 ecx=88e15202 edx=000005ea esi=88e411e0
> edi=88eac2f0
> eip=bfe25327 esp=f5c2fc00 ebp=f5c2fc48 iopl=0 nv up ei pl zr na
> po nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010246
> NDIS!ndisMStartSendPackets+0x268:
> bfe25327 c60000 mov byte ptr [eax],0x0
> ds:0023:00000000=??
> Resetting default scope
>
> STACK_TEXT:
> f5c2fc48 bfd2510e 88eac200 f5c2fdf8 00000003
> NDIS!ndisMStartSendPackets+0x268
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> f5c2ff98 bfd2f0ff 00000003 88ead110 88e98000 b57w2k+0x510e
> 00000000 00000000 00000000 00000000 00000000 b57w2k+0xf0ff
>
>
> FOLLOWUP_IP:
> b57w2k+510e
> bfd2510e 33ff xor edi,edi
>
> SYMBOL_STACK_INDEX: 1
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: b57w2k+510e
>
> IMAGE_NAME: hardware
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 0
>
> STACK_COMMAND: .trap fffffffff5c2fb8c ; kb
>
> MODULE_NAME: hardware
>
> FAILURE_BUCKET_ID: IP_MISALIGNED
>
> BUCKET_ID: IP_MISALIGNED
>
> Followup: MachineOwner
> ---------
>
>