XP Reboots on login - BSOD?

Hi guys,

We have just updated the applications on a pilot site of 7 workstations. None of the updates were Windows XP updates, all for apps which run on the workstations.

2 of these workstations are now re-booting when you type in your username and password. When you click OK, the screen goes black and re-boots. Because of GPO settings, the auto reboot is enabled and despite trying to alter the registry after the workstations are booted up and have had the policies applied, it still just goes to a balck screen and begins to re-boot, so am unable to get to the BSOD.

I have installed the debugging tools, however I'm unsure of how to narrow down which driver is causing this to happen.

Is anyone able to assist from the information below?

Regards
James


Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Mini080207-07.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Thu Aug 2 15:06:05.846 2007 (GMT+1)
System Uptime: 0 days 0:47:46.406
Loading Kernel Symbols
.....................................................................................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8062bfbf, aa59a99c, 0}

Probably caused by : ntkrnlpa.exe ( nt!HvpGetCellMapped+5f )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8062bfbf, The address that the exception occurred at
Arg3: aa59a99c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8062bfbf 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: aa59a99c -- (.trap 0xffffffffaa59a99c)
.trap 0xffffffffaa59a99c
ErrCode = 00000000
eax=00001200 ebx=00001200 ecx=823c61e0 edx=00000003 esi=e1018270 edi=00000065
eip=8062bfbf esp=aa59aa10 ebp=aa59aa58 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8062bfbf 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001204=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 7

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: services.exe

LAST_CONTROL_TRANSFER: from 806249c0 to 8062bfbf

STACK_TEXT:
aa59aa58 806249c0 e1018270 00720065 e1018270 nt!HvpGetCellMapped+0x5f
aa59aa74 8062d81c e1018270 d3d9f51c e1018270 nt!CmpMarkValueDataDirty+0x44
aa59aa90 8062dac1 e1018270 002c1ae8 e13f2844 nt!CmpMarkKeyValuesDirty+0xcc
aa59aaac 8062db5e e1018270 002c1ae8 d3c82aec nt!CmpFreeKeyValues+0x17
aa59aae8 8062e39c e1018270 0005ced0 da11ded4 nt!CmpSyncKeyValues+0x26
aa59ab2c 8062e50f e120f000 00000400 00000001 nt!CmpCopySyncTree2+0x1f4
aa59ab5c 8061afbf e1018270 000001b8 e1018270 nt!CmpCopySyncTree+0x4f
aa59accc 80616c10 00010002 aa59ad64 aa59ace8 nt!CmpSaveBootControlSet+0x2a7
aa59acdc 8053c808 00000004 aa59ad64 804fd9b5 nt!NtInitializeRegistry+0x5e
aa59acdc 804fd9b5 00000004 aa59ad64 804fd9b5 nt!KiFastCallEntry+0xf8
aa59ad58 8053c808 00000004 00fdf8b4 7c90eb94 nt!ZwInitializeRegistry+0x11
aa59ad58 7c90eb94 00000004 00fdf8b4 7c90eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00fdf8b4 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+5f
8062bfbf 8b4304 mov eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+5f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

Followup: MachineOwner
---------

eax=00001200 ebx=00001200 ecx=823c61e0 edx=00000003 esi=e1018270 edi=00000065
eip=8062bfbf esp=aa59aa10 ebp=aa59aa58 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8062bfbf 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001204=????????
ChildEBP RetAddr Args to Child
aa59aa58 806249c0 e1018270 00720065 e1018270 nt!HvpGetCellMapped+0x5f (FPO: [Non-Fpo])
aa59aa74 8062d81c e1018270 d3d9f51c e1018270 nt!CmpMarkValueDataDirty+0x44 (FPO: [Non-Fpo])
aa59aa90 8062dac1 e1018270 002c1ae8 e13f2844 nt!CmpMarkKeyValuesDirty+0xcc (FPO: [Non-Fpo])
aa59aaac 8062db5e e1018270 002c1ae8 d3c82aec nt!CmpFreeKeyValues+0x17 (FPO: [Non-Fpo])
aa59aae8 8062e39c e1018270 0005ced0 da11ded4 nt!CmpSyncKeyValues+0x26 (FPO: [Non-Fpo])
aa59ab2c 8062e50f e120f000 00000400 00000001 nt!CmpCopySyncTree2+0x1f4 (FPO: [Non-Fpo])
aa59ab5c 8061afbf e1018270 000001b8 e1018270 nt!CmpCopySyncTree+0x4f (FPO: [Non-Fpo])
aa59accc 80616c10 00010002 aa59ad64 aa59ace8 nt!CmpSaveBootControlSet+0x2a7 (FPO: [Non-Fpo])
aa59acdc 8053c808 00000004 aa59ad64 804fd9b5 nt!NtInitializeRegistry+0x5e (FPO: [Non-Fpo])
aa59acdc 804fd9b5 00000004 aa59ad64 804fd9b5 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ aa59ace8)
aa59ad58 8053c808 00000004 00fdf8b4 7c90eb94 nt!ZwInitializeRegistry+0x11 (FPO: [1,0,0])
aa59ad58 7c90eb94 00000004 00fdf8b4 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ aa59ad64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00fdf8b4 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name
804d7000 806cd280 nt ntkrnlpa.exe Wed Mar 02 00:34:37 2005 (42250A1D)
806ce000 806ee380 hal halaacpi.dll Wed Aug 04 06:59:05 2004 (41107B29)
aa36a000 aa386880 naiavf5x naiavf5x.sys Fri Mar 10 01:28:29 2006 (4410D63D)
aa3b3000 aa3b5100 EntDrv51 EntDrv51.sys Mon Aug 08 19:27:07 2005 (42F7A3FB)
aa76f000 aa7c0400 srv srv.sys Fri Apr 21 07:12:25 2006 (444877C9)
aabf5000 aabf8280 ndisuio ndisuio.sys Wed Aug 04 07:03:10 2004 (41107C1E)
aad11000 aad28480 dump_atapi dump_atapi.sys Wed Aug 04 06:59:41 2004 (41107B4D)
aad29000 aad3f540 slabser slabser.sys Tue Mar 07 18:45:48 2006 (440DD4DC)
aad68000 aadd6a00 mrxsmb mrxsmb.sys Fri May 05 10:41:42 2006 (445B1DD6)
aadd7000 aae01a00 rdbss rdbss.sys Fri May 05 10:47:55 2006 (445B1F4B)
aae02000 aae23d00 afd afd.sys Wed Aug 04 07:14:13 2004 (41107EB5)
aae24000 aae4bc00 netbt netbt.sys Wed Aug 04 07:14:36 2004 (41107ECC)
aae4c000 aae6cf00 ipnat ipnat.sys Wed Aug 04 07:04:48 2004 (41107C80)
aae6d000 aaec4d80 tcpip tcpip.sys Thu Apr 20 12:51:47 2006 (444775D3)
aaec5000 aaed7400 ipsec ipsec.sys Wed Aug 04 07:14:27 2004 (41107EC3)
bf800000 bf9c1180 win32k win32k.sys Thu Oct 06 01:05:44 2005 (43446A58)
bf9c2000 bf9d3580 dxg dxg.sys Wed Aug 04 07:00:51 2004 (41107B93)
bf9d4000 bf9e2000 ialmrnt5 ialmrnt5.dll Mon Apr 25 18:48:27 2005 (426D2D6B)
bf9e2000 bfa04000 ialmdnt5 ialmdnt5.dll Mon Apr 25 18:48:21 2005 (426D2D65)
bfa04000 bfa34300 ialmdev5 ialmdev5.DLL Mon Apr 25 18:48:10 2005 (426D2D5A)
bfa35000 bfb12000 ialmdd5 ialmdd5.DLL Mon Apr 25 18:55:31 2005 (426D2F13)
f7ea6000 f7ea8f80 mouhid mouhid.sys Fri Aug 17 21:47:57 2001 (3B7D82FD)
f7eae000 f7eb1a00 kbdhid kbdhid.sys Wed Aug 04 06:58:33 2004 (41107B09)
f7eb6000 f7eb8580 hidusb hidusb.sys Fri Aug 17 22:02:16 2001 (3B7D8658)
f7ec6000 f7ef9200 update update.sys Wed Aug 04 06:58:32 2004 (41107B08)
f7efa000 f7f2a100 rdpdr rdpdr.sys Wed Aug 04 07:01:10 2004 (41107BA6)
f7f2b000 f7f3be00 psched psched.sys Wed Aug 04 07:04:16 2004 (41107C60)
f7f3c000 f7f52680 ndiswan ndiswan.sys Wed Aug 04 07:14:30 2004 (41107EC6)
f7f53000 f7f66900 parport parport.sys Wed Aug 04 06:59:04 2004 (41107B28)
f7f67000 f7f89680 ks ks.sys Wed Aug 04 07:15:20 2004 (41107EF8)
f7f8a000 f7fab700 portcls portcls.sys Tue Mar 16 18:58:17 2004 (40574E49)
f7fac000 f8041800 smwdm smwdm.sys Fri Apr 09 17:41:29 2004 (4076D239)
f8042000 f8064e80 USBPORT USBPORT.SYS Wed Aug 04 07:08:34 2004 (41107D62)
f8065000 f8085500 b57xp32 b57xp32.sys Wed Apr 06 00:38:30 2005 (42532176)
f8086000 f8099780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 07:07:04 2004 (41107D08)
f809a000 f81732a0 ialmnt5 ialmnt5.sys Mon Apr 25 18:56:17 2005 (426D2F41)
f8188000 f818a280 rasacd rasacd.sys Fri Aug 17 21:55:39 2001 (3B7D84CB)
f81cd000 f81e7580 Mup Mup.sys Wed Aug 04 07:15:20 2004 (41107EF8)
f81e8000 f8214a80 NDIS NDIS.sys Wed Aug 04 07:14:27 2004 (41107EC3)
f8215000 f82a1480 Ntfs Ntfs.sys Wed Aug 04 07:15:06 2004 (41107EEA)
f82a2000 f82b8780 KSecDD KSecDD.sys Wed Aug 04 06:59:45 2004 (41107B51)
f82b9000 f82d7780 fltmgr fltmgr.sys Wed Aug 04 07:01:17 2004 (41107BAD)
f82d8000 f82ef480 atapi atapi.sys Wed Aug 04 06:59:41 2004 (41107B4D)
f82f0000 f8315700 dmio dmio.sys Wed Aug 04 07:07:13 2004 (41107D11)
f8316000 f8334880 ftdisk ftdisk.sys Fri Aug 17 21:52:41 2001 (3B7D8419)
f8335000 f8345a80 pci pci.sys Wed Aug 04 07:07:45 2004 (41107D31)
f8346000 f8373d80 ACPI ACPI.sys Wed Aug 04 07:07:35 2004 (41107D27)
f8475000 f847dc00 isapnp isapnp.sys Fri Aug 17 21:58:01 2001 (3B7D8559)
f8485000 f848f500 MountMgr MountMgr.sys Wed Aug 04 06:58:29 2004 (41107B05)
f8495000 f84a1c80 VolSnap VolSnap.sys Wed Aug 04 07:00:14 2004 (41107B6E)
f84a5000 f84ade00 disk disk.sys Wed Aug 04 06:59:53 2004 (41107B59)
f84b5000 f84c1200 CLASSPNP CLASSPNP.SYS Wed Aug 04 07:14:26 2004 (41107EC2)
f84e5000 f84edd00 intelppm intelppm.sys Wed Aug 04 06:59:19 2004 (41107B37)
f84f5000 f8503b80 drmk drmk.sys Wed Aug 04 07:07:54 2004 (41107D3A)
f8505000 f8514d80 serial serial.sys Wed Aug 04 07:15:51 2004 (41107F17)
f8515000 f8521180 cdrom cdrom.sys Wed Aug 04 06:59:52 2004 (41107B58)
f8525000 f8533080 redbook redbook.sys Wed Aug 04 06:59:34 2004 (41107B46)
f8535000 f8541880 rasl2tp rasl2tp.sys Wed Aug 04 07:14:21 2004 (41107EBD)
f8545000 f854f200 raspppoe raspppoe.sys Wed Aug 04 07:05:06 2004 (41107C92)
f8555000 f8560d00 raspptp raspptp.sys Wed Aug 04 07:14:26 2004 (41107EC2)
f8565000 f856d900 msgpc msgpc.sys Wed Aug 04 07:04:11 2004 (41107C5B)
f8575000 f857ef00 termdd termdd.sys Wed Aug 04 06:58:52 2004 (41107B1C)
f8595000 f859e480 NDProxy NDProxy.SYS Fri Aug 17 21:55:30 2001 (3B7D84C2)
f85b5000 f85c3100 usbhub usbhub.sys Wed Aug 04 07:08:40 2004 (41107D68)
f85e5000 f85f3460 mvstdi5x mvstdi5x.sys Wed Feb 02 19:16:00 2005 (420126F0)
f85f5000 f85fd700 netbios netbios.sys Wed Aug 04 07:03:19 2004 (41107C27)
f8625000 f862d880 Fips Fips.SYS Sat Aug 18 02:31:49 2001 (3B7DC585)
f8645000 f864dd80 HIDCLASS HIDCLASS.SYS Wed Aug 04 07:08:18 2004 (41107D52)
f8655000 f865d700 wanarp wanarp.sys Wed Aug 04 07:04:57 2004 (41107C89)
f8665000 f8673fa0 slabbus slabbus.sys Tue Mar 07 18:45:04 2006 (440DD4B0)
f8675000 f8684900 Cdfs Cdfs.SYS Wed Aug 04 07:14:09 2004 (41107EB1)
f86f5000 f86fb200 PCIIDEX PCIIDEX.SYS Wed Aug 04 06:59:40 2004 (41107B4C)
f86fd000 f8701900 PartMgr PartMgr.sys Sat Aug 18 02:32:23 2001 (3B7DC5A7)
f8715000 f871a000 usbuhci usbuhci.sys Wed Aug 04 07:08:34 2004 (41107D62)
f871d000 f8723800 usbehci usbehci.sys Wed Aug 04 07:08:34 2004 (41107D62)
f8735000 f8736000 fdc fdc.sys unavailable (00000000)
f876d000 f8771880 TDI TDI.SYS Wed Aug 04 07:07:47 2004 (41107D33)
f877d000 f8781580 ptilink ptilink.sys Fri Aug 17 21:49:53 2001 (3B7D8371)
f878d000 f8791080 raspti raspti.sys Fri Aug 17 21:55:32 2001 (3B7D84C4)
f8795000 f879b000 kbdclass kbdclass.sys Wed Aug 04 06:58:32 2004 (41107B08)
f879d000 f87a2a00 mouclass mouclass.sys Wed Aug 04 06:58:32 2004 (41107B08)
f87ad000 f87b12c0 omci omci.sys Fri Feb 13 16:45:58 2004 (402CFF46)
f87d5000 f87db180 HIDPARSE HIDPARSE.SYS Wed Aug 04 07:08:15 2004 (41107D4F)
f87dd000 f87e2200 vga vga.sys Wed Aug 04 07:07:06 2004 (41107D0A)
f87ed000 f87f1a80 Msfs Msfs.SYS Wed Aug 04 07:00:37 2004 (41107B85)
f87fd000 f8804880 Npfs Npfs.SYS Wed Aug 04 07:00:38 2004 (41107B86)
f8815000 f881c000 CITMDRV CITMDRV.SYS Mon Sep 19 12:28:37 2005 (432EA0E5)
f8825000 f882cb80 usbccgp usbccgp.sys Wed Aug 04 07:08:45 2004 (41107D6D)
f8835000 f883b500 usbprint usbprint.sys Wed Aug 04 07:01:23 2004 (41107BB3)
f8855000 f8859500 watchdog watchdog.sys Wed Aug 04 07:07:32 2004 (41107D24)
f8885000 f8888000 BOOTVID BOOTVID.dll Fri Aug 17 21:49:09 2001 (3B7D8345)
f8919000 f891cc80 serenum serenum.sys Wed Aug 04 06:59:06 2004 (41107B2A)
f8921000 f8923580 ndistapi ndistapi.sys Fri Aug 17 21:55:29 2001 (3B7D84C1)
f8945000 f8948c80 mssmbios mssmbios.sys Wed Aug 04 07:07:47 2004 (41107D33)
f8965000 f8967900 Dxapi Dxapi.sys Fri Aug 17 21:53:19 2001 (3B7D843F)
f8975000 f8976b80 kdcom kdcom.dll Fri Aug 17 21:49:10 2001 (3B7D8346)
f8977000 f8978100 WMILIB WMILIB.SYS Fri Aug 17 22:07:23 2001 (3B7D878B)
f8979000 f897a580 intelide intelide.sys Wed Aug 04 06:59:40 2004 (41107B4C)
f897b000 f897c700 dmload dmload.sys Fri Aug 17 21:58:15 2001 (3B7D8567)
f8983000 f8984120 aeaudio aeaudio.sys Mon Apr 01 15:39:14 2002 (3CA87112)
f8987000 f8988580 Eqnmirdd Eqnmirdd.sys Fri Jan 24 23:53:01 2003 (3E31D1DD)
f898d000 f898e100 swenum swenum.sys Wed Aug 04 06:58:41 2004 (41107B11)
f8993000 f8994280 USBD USBD.SYS Fri Aug 17 22:02:58 2001 (3B7D8682)
f8997000 f8998f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 21:49:37 2001 (3B7D8361)
f899b000 f899c080 Beep Beep.SYS Fri Aug 17 21:47:33 2001 (3B7D82E5)
f899f000 f89a0080 mnmdd mnmdd.SYS Fri Aug 17 21:57:28 2001 (3B7D8538)
f89a3000 f89a4080 RDPCDD RDPCDD.sys Fri Aug 17 21:46:56 2001 (3B7D82C0)
f89ab000 f89ac420 slabwh slabwh.sys Tue Mar 07 18:45:00 2006 (440DD4AC)
f89af000 f89b0520 slabcm slabcm.sys Tue Mar 07 18:45:45 2006 (440DD4D9)
f89b3000 f89b4460 KeyEx2 KeyEx2.SYS Tue Feb 18 10:32:49 2003 (3E520BD1)
f89b9000 f89ba100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 22:07:23 2001 (3B7D878B)
f8a1f000 f8a20a60 uphcleanhlp uphcleanhlp.sys Fri Mar 05 05:43:35 2004 (40481387)
f8a3d000 f8a3dd00 pciide pciide.sys Fri Aug 17 21:51:49 2001 (3B7D83E5)
f8abb000 f8abc000 MouEx2 MouEx2.SYS Fri Apr 02 11:50:03 2004 (406D455B)
f8ae8000 f8ae8d00 dxgthk dxgthk.sys Fri Aug 17 21:53:12 2001 (3B7D8438)
f8b09000 f8b09c00 audstub audstub.sys Fri Aug 17 21:59:40 2001 (3B7D85BC)
f8b9f000 f8b9fb80 Null Null.SYS Fri Aug 17 21:47:39 2001 (3B7D82EB)
f8bc4000 f8bc4ba0 TGrab TGrab.SYS Tue Oct 29 02:27:01 1996 (32756B75)

Unloaded modules:
f8615000 f8620000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8605000 f860e000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8190000 f8194000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f85d5000 f85e2000 i8042prt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f87c5000 f87ca000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8194000 f8197000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

That crash was caused by registry corruption. Follow the links in the last post of this thread for a possible solution.

 

Is there anyway to tell which hive is corrupt?

It might help us narrow down the root cause of the corruption, and as we have approx 10000 workstations to initially rollout these updates to, I'd rather have an idea of what has caused this so as we can try and identify potential problems with the upgrade package.

Thanks for your help!
James