crash dump

my server crashed last night...looks to be a driver. Can we tell from this what driver it was?


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [\\wcgoktula191\c$\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

************************************************************
WARNING: Dump file has been truncated. Data may be missing.
************************************************************
Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Wed Aug 2 23:34:35.581 2006 (GMT-5)
System Uptime: 4 days 6:51:24.703
Loading Kernel Symbols
...........................................................................................................
Loading User Symbols

Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1c6b6ca, 2, 0, 80413a46}

Probably caused by : srv.sys ( srv!SrvFsdRestartWriteAndX+344 )

Followup: MachineOwner
---------

3: kd> .reload
Loading Kernel Symbols
...........................................................................................................
Loading User Symbols

Loading unloaded module list
.......
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 01c6b6ca, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80413a46, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 01c6b6ca

CURRENT_IRQL: 2

FAULTING_IP:
nt!CcGetVacbMiss+208
80413a46 8b4914 mov ecx,dword ptr [ecx+14h]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: bcfd36d4 -- (.trap ffffffffbcfd36d4)
ErrCode = 00000000
eax=86c52228 ebx=86c52228 ecx=01c6b6b6 edx=80470142 esi=89080ba8 edi=87ee7a28
eip=80413a46 esp=bcfd3748 ebp=bcfd381c iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!CcGetVacbMiss+0x208:
80413a46 8b4914 mov ecx,dword ptr [ecx+14h] ds:0023:01c6b6ca=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 80413a46 to 8046b1ac

STACK_TEXT:
bcfd36d4 80413a46 8904f400 870e9d28 00000000 nt!KiTrap0E+0x210
bcfd381c 804137b5 87ee7a28 00000000 00000000 nt!CcGetVacbMiss+0x208
bcfd384c 80412af1 87ee7a01 00000000 00000000 nt!CcGetVirtualAddress+0x9b
bcfd38e4 bfda1a2d 87923a68 bcfd3bfc 0000f000 nt!CcPrepareMdlWrite+0xbd
bcfd3c68 bfd9f34a 87b36ea8 8832d060 8899f020 Ntfs!NtfsCommonWrite+0x244b
bcfd3cd0 8041eec9 8899f020 8832d060 8832d060 Ntfs!NtfsFsdWrite+0xee
bcfd3ce4 be9cdd8c 84317690 881b64e0 8832cf30 nt!IopfCallDriver+0x35
bcfd3d14 be9c77f9 881b64c0 8832cf30 00000000 srv!SrvFsdRestartWriteAndX+0x344
bcfd3d68 be99a7ae 8832cf30 be99acde 8832cf38 srv!SrvSmbWriteAndX+0x553
bcfd3d70 be99acde 8832cf38 88460860 bcfd3da8 srv!SrvProcessSmb+0x46
bcfd3d84 be9ae94d 00000000 00000000 00000000 srv!SrvRestartReceive+0xa2
bcfd3da8 804578ca 88460800 00000000 00000000 srv!WorkerThread+0x129
bcfd3ddc 8046c966 be9ae824 88460860 00000000 nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
srv!SrvFsdRestartWriteAndX+344
be9cdd8c e901020000 jmp srv!SrvFsdRestartWriteAndX+0x54a (be9cdf92)

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: srv!SrvFsdRestartWriteAndX+344

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: srv

IMAGE_NAME: srv.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42773202

FAILURE_BUCKET_ID: 0xA_srv!SrvFsdRestartWriteAndX+344

BUCKET_ID: 0xA_srv!SrvFsdRestartWriteAndX+344

Followup: MachineOwner
---------

 

Check this page:

http://support.microsoft.com/kb/167362/