windows 2k3 server crashing- DUMP DATA

We have a 2k3 server that is crashing several times a week and rebooting itself. Here is dump debug data from the utility provided on this site:

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\xxxx\Desktop\Mini062308-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Mon Jun 23 09:33:44.437 2008 (GMT-7)
System Uptime: 1 days 12:09:39.064
Loading Kernel Symbols
.................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {6, d0000002, 0, f78610bf}

Unable to load image \SystemRoot\system32\DRIVERS\TM_CFW.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for TM_CFW.sys
*** ERROR: Module load completed but symbols could not be loaded for TM_CFW.sys
Unable to load image \SystemRoot\system32\DRIVERS\e1000325.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for e1000325.sys
*** ERROR: Module load completed but symbols could not be loaded for e1000325.sys
Probably caused by : TM_CFW.sys ( TM_CFW+3ba0 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000006, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f78610bf, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000006

CURRENT_IRQL: 2

FAULTING_IP:
NDIS!ethFilterDprIndicateReceivePacket+ee
f78610bf f6470605 test byte ptr [edi+6],5

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

TRAP_FRAME: 8089a144 -- (.trap 0xffffffff8089a144)
.trap 0xffffffff8089a144
ErrCode = 00000000
eax=88368efc ebx=88368e78 ecx=00000002 edx=8089a21c esi=88368eb0 edi=00000000
eip=f78610bf esp=8089a1b8 ebp=8089a1fc iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
NDIS!ethFilterDprIndicateReceivePacket+0xee:
f78610bf f6470605 test byte ptr [edi+6],5 ds:0023:00000006=??
.trap
Resetting default scope

LAST_CONTROL_TRANSFER: from f78610bf to 8088c963

STACK_TEXT:
8089a144 f78610bf badb0d00 8089a21c 7c1f2640 nt!KiTrap0E+0x2a7
8089a1fc ba368ba0 8a3e1a60 8089a21c 00000001 NDIS!ethFilterDprIndicateReceivePacket+0xee
WARNING: Stack unwind information not available. Following frames may be wrong.
8089a220 ba368d5d 88108088 8089a238 88e42b58 TM_CFW+0x3ba0
8089a23c ba370f9b 88e42b58 872cdcc4 87c86af8 TM_CFW+0x3d5d
8089a258 ba372754 88e42b58 872cdcc4 8a213640 TM_CFW+0xbf9b
8089a354 ba36781c 87c86af8 8a213640 8a51aec0 TM_CFW+0xd754
8089a3b4 f7861749 00000000 8a213640 8a0e600a TM_CFW+0x281c
8089a41c ba78659e 8a587130 8089a45c 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x246
8089a56c ba787471 012a4008 8089a59b 8a587130 e1000325+0x59e
8089a590 f7856466 002a4008 ffdffa40 8a2a4460 e1000325+0x1471
8089a5a8 808320f0 8a2a4460 8a2a444c 00000000 NDIS!ndisMDpcX+0x21
8089a600 8088de1f 00000000 0000000e 00000000 nt!KiRetireDpcList+0xca
8089a604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37


STACK_COMMAND: kb

FOLLOWUP_IP:
TM_CFW+3ba0
ba368ba0 ?? ???

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: TM_CFW+3ba0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: TM_CFW

IMAGE_NAME: TM_CFW.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 462887a5

FAILURE_BUCKET_ID: 0xD1_TM_CFW+3ba0

BUCKET_ID: 0xD1_TM_CFW+3ba0

Followup: MachineOwner
---------

eax=ffdff13c ebx=d0000002 ecx=00000001 edx=00000000 esi=ffdff120 edi=00000006
eip=8088c963 esp=8089a12c ebp=8089a144 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x2a7:
8088c963 833da0628a8000 cmp dword ptr [nt!KiFreezeFlag (808a62a0)],0 ds:0023:808a62a0=????????
ChildEBP RetAddr Args to Child
8089a144 f78610bf badb0d00 8089a21c 7c1f2640 nt!KiTrap0E+0x2a7 (FPO: [0,0] TrapFrame @ 8089a144)
8089a1fc ba368ba0 8a3e1a60 8089a21c 00000001 NDIS!ethFilterDprIndicateReceivePacket+0xee (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
8089a220 ba368d5d 88108088 8089a238 88e42b58 TM_CFW+0x3ba0
8089a23c ba370f9b 88e42b58 872cdcc4 87c86af8 TM_CFW+0x3d5d
8089a258 ba372754 88e42b58 872cdcc4 8a213640 TM_CFW+0xbf9b
8089a354 ba36781c 87c86af8 8a213640 8a51aec0 TM_CFW+0xd754
8089a3b4 f7861749 00000000 8a213640 8a0e600a TM_CFW+0x281c
8089a41c ba78659e 8a587130 8089a45c 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x246 (FPO: [Non-Fpo])
8089a56c ba787471 012a4008 8089a59b 8a587130 e1000325+0x59e
8089a590 f7856466 002a4008 ffdffa40 8a2a4460 e1000325+0x1471
8089a5a8 808320f0 8a2a4460 8a2a444c 00000000 NDIS!ndisMDpcX+0x21 (FPO: [Non-Fpo])
8089a600 8088de1f 00000000 0000000e 00000000 nt!KiRetireDpcList+0xca (FPO: [Non-Fpo])
8089a604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37 (FPO: [0,0,0])
start end module name
80800000 80a56000 nt ntkrpamp.exe Mon Mar 05 04:16:25 2007 (45EC0A19)
80a56000 80a82000 hal halmacpi.dll Fri Feb 16 21:48:26 2007 (45D6972A)
b51d3000 b5216000 TmXPFlt TmXPFlt.sys Fri May 02 01:21:46 2008 (481ACF1A)
b5216000 b5331d00 VSApiNt VSApiNt.sys Fri May 02 01:17:09 2008 (481ACE05)
b5332000 b5352280 tmcomm tmcomm.sys Mon Dec 24 01:36:35 2007 (476F7DA3)
b6843000 b686e000 RDPWD RDPWD.SYS Fri Feb 16 21:44:38 2007 (45D69646)
b6cef000 b6d4c000 srv srv.sys Fri Feb 16 22:27:20 2007 (45D6A048)
b6d9c000 b6dec000 HTTP HTTP.sys Fri Feb 16 22:28:12 2007 (45D6A07C)
b726b000 b7276000 TDTCP TDTCP.SYS Fri Feb 16 21:44:32 2007 (45D69640)
b729b000 b72a8000 TmPreFlt TmPreFlt.sys Fri May 02 01:21:46 2008 (481ACF1A)
b73bb000 b73c5000 Dxapi Dxapi.sys Tue Mar 25 00:06:01 2003 (3E7FFFD9)
b7dab000 b7dc0000 Cdfs Cdfs.SYS Fri Feb 16 22:27:08 2007 (45D6A03C)
b8508000 b8512000 dump_diskdump dump_diskdump.sys Thu Oct 04 05:35:17 2007 (4704DE05)
b9b98000 b9ba9000 Fips Fips.SYS Fri Feb 16 22:26:33 2007 (45D6A019)
b9ba9000 b9c1f000 mrxsmb mrxsmb.sys Fri Feb 16 22:28:15 2007 (45D6A07F)
b9c47000 b9c77000 rdbss rdbss.sys Fri Feb 16 22:27:37 2007 (45D6A059)
b9c77000 b9c88a00 tmtdi tmtdi.sys Thu Aug 30 23:02:48 2007 (46D7AF08)
b9c89000 b9cb3000 afd afd.sys Fri Feb 16 22:28:16 2007 (45D6A080)
b9cb3000 b9ce4000 netbt netbt.sys Fri Feb 16 22:28:57 2007 (45D6A0A9)
b9ce4000 b9d0e000 ipnat ipnat.sys Fri Feb 16 21:59:08 2007 (45D699AC)
b9d0e000 b9d9e000 tcpip tcpip.sys Tue Oct 30 10:34:10 2007 (47276B12)
b9d9e000 b9db7000 ipsec ipsec.sys Fri Feb 16 22:29:28 2007 (45D6A0C8)
b9dcf000 b9dd6000 dxgthk dxgthk.sys Tue Mar 25 00:05:52 2003 (3E7FFFD0)
b9dd7000 b9dde1c0 dump_cercsr6 dump_cercsr6.sys Thu Nov 06 11:50:22 2003 (3FAAA5FE)
b9f3f000 b9f4c000 wanarp wanarp.sys Fri Feb 16 21:59:17 2007 (45D699B5)
b9f4f000 b9f5c000 netbios netbios.sys Fri Feb 16 21:58:29 2007 (45D69985)
b9f5f000 b9f6d000 msgpc msgpc.sys Fri Feb 16 21:58:37 2007 (45D6998D)
b9f6f000 b9f7c000 Npfs Npfs.SYS Fri Feb 16 21:50:36 2007 (45D697AC)
b9f7f000 b9f8a000 Msfs Msfs.SYS Fri Feb 16 21:50:33 2007 (45D697A9)
b9f8f000 b9f9b000 vga vga.sys Fri Feb 16 22:10:30 2007 (45D69C56)
ba25f000 ba268000 kbdhid kbdhid.sys Fri Feb 16 22:05:42 2007 (45D69B36)
ba26f000 ba27d000 HIDCLASS HIDCLASS.SYS Tue Mar 25 00:10:17 2003 (3E8000D9)
ba2f7000 ba30c000 usbhub usbhub.sys Fri Feb 16 22:13:05 2007 (45D69CF1)
ba365000 ba528000 TM_CFW TM_CFW.sys Fri Apr 20 02:28:05 2007 (462887A5)
ba528000 ba587000 update update.sys Mon Oct 15 03:56:18 2007 (47134752)
ba587000 ba5be000 rdpdr rdpdr.sys Fri Feb 16 21:51:00 2007 (45D697C4)
ba5be000 ba5d0000 raspptp raspptp.sys Fri Feb 16 22:29:20 2007 (45D6A0C0)
ba5d0000 ba5e9000 ndiswan ndiswan.sys Fri Feb 16 22:29:22 2007 (45D6A0C2)
ba5e9000 ba5fd000 rasl2tp rasl2tp.sys Fri Feb 16 22:29:02 2007 (45D6A0AE)
ba5fd000 ba624000 ks ks.sys Fri Feb 16 22:30:40 2007 (45D6A110)
ba624000 ba638000 redbook redbook.sys Fri Feb 16 22:07:26 2007 (45D69B9E)
ba638000 ba64d000 cdrom cdrom.sys Fri Feb 16 22:07:48 2007 (45D69BB4)
ba64d000 ba662000 serial serial.sys Fri Feb 16 22:06:46 2007 (45D69B76)
ba662000 ba67e000 VIDEOPRT VIDEOPRT.SYS Fri Feb 16 22:10:30 2007 (45D69C56)
ba67e000 ba75c000 ati2mtag ati2mtag.sys Thu Nov 11 19:02:01 2004 (419427A9)
ba75c000 ba786000 USBPORT USBPORT.SYS Fri Feb 16 22:12:59 2007 (45D69CEB)
ba786000 ba7a4c00 e1000325 e1000325.sys Mon Aug 02 23:17:29 2004 (410F2DF9)
ba8f9000 ba902000 hidusb hidusb.sys Tue Mar 25 00:10:17 2003 (3E8000D9)
ba9c9000 ba9d1000 audstub audstub.sys Tue Mar 25 00:09:12 2003 (3E800098)
ba9d1000 ba9d7b80 usbehci usbehci.sys Fri Feb 16 22:12:56 2007 (45D69CE8)
ba9d9000 ba9de180 usbuhci usbuhci.sys Fri Feb 16 22:13:02 2007 (45D69CEE)
bae3c000 bae45000 mssmbios mssmbios.sys Fri Feb 16 21:59:12 2007 (45D699B0)
bae4c000 bae56000 mouclass mouclass.sys Tue Mar 25 00:03:09 2003 (3E7FFF2D)
bae5c000 bae67000 kbdclass kbdclass.sys Fri Feb 16 22:05:39 2007 (45D69B33)
bae6c000 bae7b000 termdd termdd.sys Fri Feb 16 21:44:32 2007 (45D69640)
bae7c000 bae87000 TDI TDI.SYS Fri Feb 16 22:01:19 2007 (45D69A2F)
bae8c000 bae9b000 raspppoe raspppoe.sys Fri Feb 16 21:59:23 2007 (45D699BB)
bae9c000 baea5000 ndistapi ndistapi.sys Fri Feb 16 21:59:19 2007 (45D699B7)
baeac000 baeb6000 serenum serenum.sys Fri Feb 16 22:06:44 2007 (45D69B74)
baecc000 baed5000 watchdog watchdog.sys Fri Feb 16 22:11:45 2007 (45D69CA1)
bf800000 bf9cf000 win32k win32k.sys Thu Mar 01 06:59:28 2007 (45E6EA50)
bf9cf000 bf9e6000 dxg dxg.sys Fri Feb 16 22:14:39 2007 (45D69D4F)
bf9e6000 bfa20000 ati2dvag ati2dvag.dll Thu Nov 11 19:02:23 2004 (419427BF)
bfa20000 bfa5d000 ati2cqag ati2cqag.dll Thu Nov 11 18:22:24 2004 (41941E60)
bfa5d000 bfc90320 ati3duag ati3duag.dll Thu Nov 11 18:43:23 2004 (4194234B)
bfc91000 bfcfb000 ativvaxx ativvaxx.dll Thu Nov 11 18:38:17 2004 (41942219)
bffa0000 bffea000 ATMFD ATMFD.DLL Sat Feb 17 05:59:31 2007 (45D70A43)
f7204000 f7217000 CLASSPNP CLASSPNP.SYS Fri Feb 16 22:28:16 2007 (45D6A080)
f7217000 f7228aa0 AACMgt AACMgt.sys Sun Oct 09 16:26:28 2005 (4349A724)
f7229000 f723a500 afamgt afamgt.sys Mon Apr 04 16:44:24 2005 (4251D158)
f723b000 f725a000 SCSIPORT SCSIPORT.SYS Fri Feb 16 22:28:41 2007 (45D6A099)
f725a000 f7277000 atapi atapi.sys Fri Feb 16 22:07:34 2007 (45D69BA6)
f7277000 f72a8000 Adptdsm Adptdsm.sys Fri Oct 14 19:09:52 2005 (435064F0)
f72a8000 f72d2000 volsnap volsnap.sys Mon Feb 12 05:16:07 2007 (45D06897)
f72d2000 f72fe000 dmio dmio.sys Fri Feb 16 22:10:44 2007 (45D69C64)
f72fe000 f7325000 ftdisk ftdisk.sys Mon Feb 12 05:15:47 2007 (45D06883)
f7325000 f733c000 mpio mpio.sys Wed Mar 30 02:01:19 2005 (424A6ADF)
f733c000 f7352000 pci pci.sys Fri Feb 16 21:59:03 2007 (45D699A7)
f7352000 f7386000 ACPI ACPI.sys Fri Feb 16 21:58:47 2007 (45D69997)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 00:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Fri Feb 16 21:58:57 2007 (45D699A1)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Fri Feb 16 22:07:32 2007 (45D69BA4)
f74b7000 f74c7000 MountMgr MountMgr.sys Fri Feb 16 22:05:35 2007 (45D69B2F)
f74c7000 f74d2000 PartMgr PartMgr.sys Mon Feb 12 05:59:28 2007 (45D072C0)
f74d7000 f74e7000 disk disk.sys Fri Feb 16 22:07:51 2007 (45D69BB7)
f74e7000 f74f3000 Dfs Dfs.sys Fri Feb 16 21:51:17 2007 (45D697D5)
f74f7000 f7500000 mpspfltr mpspfltr.sys Wed Mar 30 02:01:18 2005 (424A6ADE)
f7507000 f7511000 crcdisk crcdisk.sys Fri Feb 16 22:09:50 2007 (45D69C2E)
f7557000 f7566000 intelppm intelppm.sys Fri Feb 16 21:48:30 2007 (45D6972E)
f75d7000 f75e5000 NDProxy NDProxy.SYS Fri Feb 16 21:59:21 2007 (45D699B9)
f75e7000 f75f0000 raspti raspti.sys Fri Feb 16 21:59:23 2007 (45D699BB)
f76b7000 f76c2000 ptilink ptilink.sys Fri Feb 16 22:06:38 2007 (45D69B6E)
f76e2000 f7707000 fltmgr fltmgr.sys Fri Feb 16 21:51:08 2007 (45D697CC)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 00:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 00:07:58 2003 (3E80004E)
f7717000 f771e000 PCIIde PCIIde.sys Tue Mar 25 00:04:46 2003 (3E7FFF8E)
f771f000 f7726000 intelide intelide.sys Fri Feb 16 22:07:32 2007 (45D69BA4)
f7727000 f772e000 dmload dmload.sys Tue Mar 25 00:08:08 2003 (3E800058)
f772f000 f77361c0 cercsr6 cercsr6.sys Thu Nov 06 11:50:22 2003 (3FAAA5FE)
f776f000 f7776000 Null Null.SYS Tue Mar 25 00:03:05 2003 (3E7FFF29)
f7777000 f777e000 Beep Beep.SYS Tue Mar 25 00:03:04 2003 (3E7FFF28)
f777f000 f7787000 mnmdd mnmdd.SYS Tue Mar 25 00:07:53 2003 (3E800049)
f7787000 f778d300 HIDPARSE HIDPARSE.SYS Fri Feb 16 22:12:35 2007 (45D69CD3)
f7797000 f779f000 rasacd rasacd.sys Tue Mar 25 00:11:50 2003 (3E800136)
f779f000 f77a7000 RDPCDD RDPCDD.sys Tue Mar 25 00:03:05 2003 (3E7FFF29)
f77b7000 f77bed80 usbccgp usbccgp.sys Fri Feb 16 22:13:08 2007 (45D69CF4)
f77cf000 f77d7000 mouhid mouhid.sys Tue Mar 25 00:03:12 2003 (3E7FFF30)
f7817000 f781f000 Fs_Rec Fs_Rec.SYS Tue Mar 25 00:08:36 2003 (3E800074)
f7832000 f7871000 NDIS NDIS.sys Fri Feb 16 22:28:49 2007 (45D6A0A1)
f7871000 f7897000 KSecDD KSecDD.sys Fri Feb 16 21:46:32 2007 (45D696B8)
f7968000 f7987000 Mup Mup.sys Fri Feb 16 22:27:41 2007 (45D6A05D)
f79f1000 f79f2280 swenum swenum.sys Fri Feb 16 22:05:56 2007 (45D69B44)
f79fd000 f79fe580 USBD USBD.SYS Tue Mar 25 00:10:39 2003 (3E8000EF)
f7b4a000 f7bdf000 Ntfs Ntfs.sys Fri Feb 16 22:27:23 2007 (45D6A04B)

Unloaded modules:
b6bb6000 b6bd7000 tmcomm.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b7127000 b7243000 VSApiNt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b70e4000 b7127000 TmXPFlt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b9f2f000 b9f3d000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b9f9f000 b9fa8000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b9e14000 b9e27000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7807000 f780f000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
b9faf000 b9fb9000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
b9fbf000 b9fca000 Fdc.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

It looks l ike the driver TM_CFW.sys is the cullprit....am I reading this minidump correctly? Ive looked at the previous 4 MiniDumps in windbg and they all have TM_CFW.sys in the faulting bucket.

This is a trend micro driver, any suggestions in resolving this issue other than contacting trend micro (if this is in fact the problem)

Thanks in advance for your help!

 

Do the below and if it does not resolve it then Un-install all Trend Virus and firewall!
http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1036319&id=EN-1036319

The above may be causing the below and may fix all. If not reinstall the Broadcom NIC!
http://bink.nu/forums/p/7228/10447.aspx

Mike