I need some help analyzing this Minidump from Windows 2000 Server SP4. Below is the out put from analyze. I could no info for RSAFAL.sys, Does anyone know what this driver is? Also can you point me to some good resources/books to learn how to use WinDbg?
1: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000196, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8046dfe6, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExAllocatePoolWithTag+4a6
8046dfe6 895104 mov [ecx+0x4],edx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
LAST_CONTROL_TRANSFER: from eb061c51 to 8046dfe6
TRAP_FRAME: a90bd514 -- (.trap ffffffffa90bd514)
ErrCode = 00000002
eax=85d98008 ebx=00000010 ecx=00000192 edx=80479260 esi=85d98000 edi=804791c0
eip=8046dfe6 esp=a90bd588 ebp=a90bd5ac iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExAllocatePoolWithTag+0x4a6:
8046dfe6 895104 mov [ecx+0x4],edx ds:0023:00000196=????????
Resetting default scope
STACK_TEXT:
a90bd5ac eb061c51 00000000 00000000 2070754d nt!ExAllocatePoolWithTag+0x4a6
WARNING: Stack unwind information not available. Following frames may be wrong.
a90bd5f0 bfe5210c 89029a60 00000108 84664588 RSAFAL+0x1c51
a90bd67c bfe51f1d 89029a60 846644d0 85d5c448 Mup!DnrNameResolve+0x62a
a90bd734 8041eec9 846644d0 85d5c448 85d5c458 Mup!DnrNameResolve+0x43b
a90bd748 804c4318 80486b20 804c3860 a90bda44 nt!IopfCallDriver+0x35
a90bd8d0 804535cc 846644d0 00000000 a90bd988 nt!IopParseDevice+0xab8
a90bd948 804da392 00000000 86bb6500 00000240 nt!ObpLookupObjectName+0x504
a90bda58 804a4425 00000000 00000000 888f5400 nt!ObOpenObjectByName+0xc8
a90bdb34 804a3fca a90bdc28 00100002 a90bdbf0 nt!IopCreateFile+0x407
a90bdb7c 804b2631 a90bdc28 00100002 a90bdbf0 nt!IoCreateFile+0x36
a90bdc2c 804ae456 a90bdd24 87a25688 875c26c8 nt!IopOpenLinkOrRenameTarget+0xe5
a90bdd48 80468309 00000448 0012bfb8 030e3490 nt!NtSetInformationFile+0x860
a90bdd48 77f82934 00000448 0012bfb8 030e3490 nt!KiSystemService+0xc9
0012c504 00000000 00000000 00000000 00000000 0x77f82934
FOLLOWUP_IP:
RSAFAL+1c51
eb061c51 8bd0 mov edx,eax
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: RSAFAL+1c51
MODULE_NAME: RSAFAL
IMAGE_NAME: RSAFAL.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 40d174bc
STACK_COMMAND: .trap ffffffffa90bd514 ; kb
FAILURE_BUCKET_ID: 0xC5_2_RSAFAL+1c51
BUCKET_ID: 0xC5_2_RSAFAL+1c51
Followup: MachineOwner
---------
hardware
prices 
