Server2003 blue screen at login DUMP FILE

I'm working on a 2003 server Dell Poweredge 2600 and just recently it would blue screen when using remote desktop. I try to logon locally with two different usernames (both with admin permissions) and I get the same result.

Here is the dump file I processed through Windbg (latest version) on my XP laptop using the dump files from the server. Any suggestions would be greatly appreciated.


Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [Mini011606-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 MP (2 procs) Free x86 compatible
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_gdr.050225-1827
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Mon Jan 16 11:47:52.397 2006 (GMT-5)
System Uptime: 8 days 16:45:43.187
Loading Kernel Symbols
...............................................................................................
Loading User Symbols
Loading unloaded module list
..
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80598a58, f41bd96c, 0}

Probably caused by : ntkrnlmp.exe ( nt!HvpGetCellMapped+7f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80598a58, The address that the exception occurred at
Arg3: f41bd96c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!HvpGetCellMapped+7f
80598a58 8b4604 mov eax,[esi+0x4]

TRAP_FRAME: f41bd96c -- (.trap fffffffff41bd96c)
ErrCode = 00000000
eax=00000003 ebx=e101b8f8 ecx=e1020000 edx=862fbb20 esi=00000e00 edi=00000000
eip=80598a58 esp=f41bd9e0 ebp=f41bda38 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!HvpGetCellMapped+0x7f:
80598a58 8b4604 mov eax,[esi+0x4] ds:0023:00000e04=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8059b1ad to 80598a58

STACK_TEXT:
f41bda38 8059b1ad e101b8f8 006e0061 e101b8f8 nt!HvpGetCellMapped+0x7f
f41bda48 8059b11d e101b8f8 006e0061 e101b8f8 nt!HvpGetHCell+0xd
f41bda60 8059ad96 e101b8f8 006e0061 e101b8f8 nt!HvMarkCellDirty+0x2d
f41bda7c 80619e5a e101b8f8 cef7ee3c e101b8f8 nt!CmpMarkValueDataDirty+0xf0
f41bda98 8061a135 e101b8f8 001cb2a0 cef8bc5c nt!CmpMarkKeyValuesDirty+0xca
f41bdab4 8061a1e4 e101b8f8 001cb2a0 cef8c2a4 nt!CmpFreeKeyValues+0x15
f41bdaf0 8061aa48 e101b8f8 000a3150 cee64154 nt!CmpSyncKeyValues+0x24
f41bdb34 8061ac4d e19d9000 00000400 00000003 nt!CmpCopySyncTree2+0x1f8
f41bdb64 8061668f e101b8f8 000001b8 e101b8f8 nt!CmpCopySyncTree+0x4d
f41bdccc 806122ec 00000000 f41bdd64 f41bdce8 nt!CmpSaveBootControlSet+0x21f
f41bdcdc 804dfd24 00000004 805aeed0 e1736cf0 nt!NtInitializeRegistry+0x5c
f41bdcdc 804eb181 00000004 805aeed0 e1736cf0 nt!KiSystemService+0xd0
f41bdd58 804dfd24 00000004 00000000 00000000 nt!ZwInitializeRegistry+0x11
f41bdd58 7ffe0304 00000004 00000000 00000000 nt!KiSystemService+0xd0
0081f92c 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+7f
80598a58 8b4604 mov eax,[esi+0x4]

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!HvpGetCellMapped+7f

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42226ccd

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+7f

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+7f

Followup: MachineOwner
---------

 

Hi,

It is software Hive Corruption.

Suggestion

1. XP and Windows 2003 registry editor has an inbuilt feature to repair corruption of Hives.
2. We loaded the HIVE in Windows 2003 machine but it was not able to detect corruption
3. We loaded the same in XP machine and XP was able to detect and correct software hive corruption
4. We compacted Software and System Hive using chkreg.exe
5. Using new repaired Hives we were able to complete OS repair.
6. After OS repair, everything was working fine.