Tech Off Thread

2 posts

Forum Read Only

This forum has been made read only by the site admins. No new threads or comments can be added.

XP BSOD Problem at login

Back to Forum: Tech Off
  • User profile image
    DCMonkey

    I have an XP machine that has been stable for a couple of years. A week or two ago there was a power outage, and now when you boot up and login, it BSODs immediately after logging in. If you let it BSOD, restart, and shutdown instead of attempting to login again, then startup and login, 9 times out of 10 (of course it had to not do this that 1 time) it will login fine and there will be no stability issues from there on.

    I guess what I'm trying to figure out is whether this is a hardware problem or a driver/registry corruption problem. The WinDbg analysis below makes it sound like a registry corruption involving the Last Known Good ControlSet stuff

    Anyone have any ideas before I pave this system?

    Crash Dump Analysis:


    kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8056e2a2, The address that the exception occurred at
    Arg3: f05d799c, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    nt!HvpGetCellMapped+5f
    8056e2a2 8b4304          mov     eax,dword ptr [ebx+4]

    TRAP_FRAME:  f05d799c -- (.trap fffffffff05d799c)
    ErrCode = 00000000
    eax=00001300 ebx=00001300 ecx=823c3740 edx=00000003 esi=e1035b60 edi=0000006f
    eip=8056e2a2 esp=f05d7a10 ebp=f05d7a58 iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    nt!HvpGetCellMapped+0x5f:
    8056e2a2 8b4304          mov     eax,dword ptr [ebx+4] ds:0023:00001304=????????
    Resetting default scope

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  services.exe

    LAST_CONTROL_TRANSFER:  from 8051d6a7 to 8053331e

    STACK_TEXT: 
    f05d7564 8051d6a7 0000008e c0000005 8056e2a2 nt!KeBugCheckEx+0x1b
    f05d792c 804df235 f05d7948 00000000 f05d799c nt!KiDispatchException+0x3b1
    f05d7994 804df1e6 f05d7a58 8056e2a2 badb0d00 nt!CommonDispatchException+0x4d
    f05d799c 8056e2a2 badb0d00 00000003 00000000 nt!KiExceptionExit+0x18a
    f05d7a58 805d4957 e1035b60 0073006f e1035b60 nt!HvpGetCellMapped+0x5f
    f05d7a74 805d4614 e1035b60 e125997c e1035b60 nt!CmpMarkValueDataDirty+0x44
    f05d7a90 805d4647 e1035b60 004b0a50 e14c4ccc nt!CmpMarkKeyValuesDirty+0xcc
    f05d7aac 805d43cd e1035b60 004b0a50 e14efa54 nt!CmpFreeKeyValues+0x17
    f05d7ae8 805d4517 e1035b60 000c2a00 e1101a04 nt!CmpSyncKeyValues+0x26
    f05d7b2c 805d41c5 e4b91000 00000400 00000003 nt!CmpCopySyncTree2+0x1f4
    f05d7b5c 805d4f21 e1035b60 000001b8 e1035b60 nt!CmpCopySyncTree+0x4f
    f05d7ccc 8059f86d 00010003 f05d7d64 f05d7ce8 nt!CmpSaveBootControlSet+0x2a7
    f05d7cdc 804de7ec 00000005 f05d7d64 804dcdfd nt!NtInitializeRegistry+0x5e
    f05d7cdc 804dcdfd 00000005 f05d7d64 804dcdfd nt!KiFastCallEntry+0xf8
    f05d7d58 804de7ec 00000005 00e4f8b4 7c90eb94 nt!ZwInitializeRegistry+0x11
    f05d7d58 7c90eb94 00000005 00e4f8b4 7c90eb94 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00e4f8b4 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!HvpGetCellMapped+5f
    8056e2a2 8b4304          mov     eax,dword ptr [ebx+4]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!HvpGetCellMapped+5f

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  42250ff9

    FAILURE_BUCKET_ID:  0x8E_nt!HvpGetCellMapped+5f

    BUCKET_ID:  0x8E_nt!HvpGetCellMapped+5f

    Followup: MachineOwner
    ---------


  • User profile image
    phreaks

    From a glance looks like some registry issue?

Conversation locked

This conversation has been locked by the site admins. No new comments can be made.