ran debugging tool and got the following
Microsoft (R) Windows Debugger Version 6.8.0004.0 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\lee\Desktop\dump\Mini071508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*DownstreamStore*
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Tue Jul 15 01:58:57.828 2008 (GMT+1)
System Uptime: 0 days 0:00:33.390
Loading Kernel Symbols
...............................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D0, {91da7008, 2, 0, 80542d86}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+277 )
Followup: Pool_corruption
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_MMPOOL (d0)
Arguments:
Arg1: 91da7008, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80542d86, address which referenced memory
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool. You can also set
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\ProtectNonPagedPool
to a DWORD 1 value and reboot. Then the system will unmap freed nonpaged pool,
preventing drivers (although not DMA-hardware) from corrupting the pool.
Debugging Details:
------------------
READ_ADDRESS: 91da7008
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiFreePoolPages+424
80542d86 8b4608 mov eax,dword ptr [esi+8]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD0
PROCESS_NAME: csrss.exe
LAST_CONTROL_TRANSFER: from 8054397d to 80542d86
STACK_TEXT:
ba2c19b0 8054397d 87f5d000 8055a6c0 88018200 nt!MiFreePoolPages+0x424
ba2c19fc 80543e6f 880183c8 00000000 88018208 nt!ExDeferredFreePool+0x277
ba2c1a3c 804ee1d8 88018208 89b39318 88018218 nt!ExFreePoolWithTag+0x489
ba2c1a58 80577444 88018208 89d068e8 89b6a9d4 nt!IopFreeIrp+0xf2
ba2c1b3c 805b365e 89d06900 00000000 89b6a930 nt!IopParseDevice+0xae0
ba2c1bc4 805afb3f 00000000 ba2c1c04 00000040 nt!ObpLookupObjectName+0x56a
ba2c1c18 8056a133 00000000 00000000 00000001 nt!ObOpenObjectByName+0xeb
ba2c1c94 8056aaaa 0069f518 80100080 0069f4b8 nt!IopCreateFile+0x407
ba2c1cf0 8056d17c 0069f518 80100080 0069f4b8 nt!IoCreateFile+0x8e
ba2c1d30 8053c808 0069f518 80100080 0069f4b8 nt!NtCreateFile+0x30
ba2c1d30 7c90eb94 0069f518 80100080 0069f4b8 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0069f510 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+277
8054397d 85ff test edi,edi
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExDeferredFreePool+277
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: 0xD0_nt!ExDeferredFreePool+277
BUCKET_ID: 0xD0_nt!ExDeferredFreePool+277
Followup: Pool_corruption
---------