System:

I am running Windows XP Home Edition SP2 on HP Pavilion Laptop computer.


Problem:

STOP: c000021a {Fatal System Error}
The windows Logon Process system process terminated unexpectedly with a status of 0xc0000142 (0x00000000 0x00000000).
The system has been shut down.

The 0xc0000142 exception code indicates a DLL failed to initialize. I have been unable to determine the offending DLL.

Only access to the system now is Recovery Console

Action Taken in Safe Mode:

Completed XP restore to recover two days earlier.
Ran AVG scan, items found and quarantined.
Adware also reported items and quarantined them.
Removed uninstalled patches KB893066, KB890923, KB890859 and KB893086.
Installed Ewido Found 6 Trojans and quarantined them.
Installed A2 Anti-Trojan and reported items.
Installed and ran Ccleaner.
Booted from XP CD and ran repair.
Safe Mode no longer available because setup reboot message.


Background:

I received a prompt for updating Adobe software on my laptop PC running XP. It seemed normal enough so I accepted the update. Soon my PC began behaving badly. It presented windows that appeared to be email scans by Symantec, however I did not recognize the email messages it scanned. I soon suspected a virus of some kind because I did not have control and it was working rapidly. I turned off my network link to avoid spyware sending data. I was able to get the PC under control. I rebooted the computer. I soon experienced the same condition.

Next, I used the XP restore to recover my system to two days earlier. Then next time I rebooted my system went into a continuous reboot process. I let it run for more than an hour until I found how to turn of reboot on system errors using the F8 function at boot up. I could then see the problem. I encountered the Blue Screen of Death BSOD with the following message:

STOP: c000021a {Fatal System Error}
The windows Logon Process system process terminated unexpectedly with a status of 0xc0000142 (0x00000000 0x00000000).
The system has been shut down.

At this point I could still access the system in safe mode and began running anti-virus software based on information from various forums. I already had AVG and Adaware running on my PC.

AVG reported items and quarantined them.
Adaware also reported items and quarantined them.
Win32.Trojan.StartPage File C:\System Volume Information\_restore{hex numbers}\RP307\A0028751.exe

I downloaded most recent security update file from AVG. Then ran another scan. I received a message that indicated software was damaged, need to reinstall. I downloaded new version 7.1 of AVG, but was not able to complete installation in safe mode. Some message about core7.

I searched for solutions on the internet and found a call indicating this problem could be a result of Microsoft patches which can be removed using the recovery console by booting with the XP CD. I followed instructions and uninstalled patches KB893066, KB890923, KB890859 and KB893086. Same error on BSOD after reboot.

I then found a call from security-forums web site that sounded just like my case. Reference: HJT – Log Road Rage at http://www.security-forums.com/viewtopic.p...1b62536002d7242

I was not familiar with HiJackThis so I did not install and run it.

I downloaded and installed Ewido 4.0.0.172c
Found 6 new Trojans and many spyware links so they were quarantined.

I downloaded and installed A2 Anti-Trojan.

I installed Ccleaner and ran as indicated. Then rebooted with hopes of solving the problem. I was disappointed when I still received BSOD.

Next, I found information from other services indicating repairing XP using the Installation disk would solve the problem because the 0xc000142 message suggested a mismatch or damaged dll files. The repair appeared to go smoothly until the required reboot. I received the message: Windows XP can not run setup in safe mode, system will reboot. I can no longer run in safe mode because of this setup reboot message, nor can I boot normally because the result is the same fatal error noted earlier. My only access to the system now appears to be using the recovery console.

I am in a mess, really stuck in a loop unless you can help. I am concerned about losing data or doing a full XP installation.

I hope you have some advice that will help recover my system.

Larry K

Wow! This is a doozy! Thanks for the detailed information - it makes troubleshooting this problem much easier.

STOP 0x21a: http://aumha.org/win5/kbestop.php#0x21a
STOP 0x142: http://aumha.org/win5/kbestop.php#0x142

OK, this is an issue where the one STOP error has probably caused the other (a dll failed to initialize, which caused security problems within the OS causing the crash).

Now, since there's malware involved in this your best bet at this point is probably a low-level format and reinstall of the OS. This will ensure that the system is cleaned of any viruses and will give you a brand spanking new OS to work with.

Or, you can try to fix it by using command line virus removal tools to see if you can get XP up and running - then attempt to repair the damage that has been done. This will take a lot of work and doesn't have any guaranty of success.

I appreciate your response. I am afraid rebuilding my system will be my final solution. However, I would still like try getting the system accessable to recover some data files. I have some digital camera photos I have not yet backed up that I would love to recover before re-installing.

I have a few questions to consider if you have any input.

- Is there a way to identify the specific DLL that fails during windows start-up? Windows appears to begin normally but after a minute of initialization I get the failure message.

- Is there anyway to expand the Recovery Console to access folders beyond the system folders?

- I read the idea of using Linux to access the files, bypassing Windows, is this a possibility?

- Can a laptop harddrive be removed and setup as a slave to another system?

- Do you have any information where to obtain a reliable command line anti-virus utility you referred to?

Thanks for your help with this problem. I realize these ideas are a stretch but may the will spark a miracle idea from you or someone else who reads this post.

Thanks,
Larry

hi,

i think you probably have a lot more than one specific file failed/corrupted/etc,

when in the recovery console, there are two commands to try, i think, from memory (mine!) they are fixmbr, and fixboot, tho i could be wrong, type help and you should get full list of commands. anyway, try those and reboot. hopefully you will be able to at least get into safemode now. if so, start, run, and type sfc /scannow and put your xp cd in the cd drive. if ok so far, windows should replace any damaged/corrupt windows files on your system.

i am not sure about how much access to folders you have in recovery console, but if it is to access your file system for making backup, you could try 'gparted' or the 'ubcd' (available at 'sourceforge.net' - there are many other utilities maybe others could recommend to you.

you can buy an enclosure for a laptop harddrive to run it from a usb port, but i believe they are quite expensive!

i dont know off-hand about a good command line av, maybe someone more enlightened here could offer a suggestion.

good luck.

I'd suggest that your priority now is Data Recovery. The most sure way to recover data (if possible) is to move the drive to another computer (and not boot from it). The reason for this is to prevent disk accesses and disk writes that could overwrite your data.

Your options are then to use a Live Linux distro, BartPE, or a DOS boot disk with an NTFS to DOS reader on it. Since I'm an old DOS commando, I prefer the last way. All are freely available with a google search (sorry, I don't have the time right now to research the links!).

To answer your questions:
- Yes, there is a way to pinpoint the dll - but it's very likely that it's not the only problem. So you'll spend hours and hours researching and replacing - only to hit another problem.
- I don't use the Recovery Console myself (my backup/image regimen makes it unnecessary) so I've only got very basic knowledge about it.
- The Linux trick (the Live distro mentioned above) is a good tool - but as I mentioned above, I prefer to "do it my way!".
- Yes, you can remove the drive and set it up another way (as rubiconeye has mentioned)
- I'd suggest a google for command line antivirus ( http://www.google.com/search?hl=en&q=c...+line+antivirus ). I'm not familiar with the specific products - but all of the companies mentioned on the first page seem to be reliable (I don't have any knowledge of theVexira Antivirus for NT/2000/XP command-line that's mentioned about half way down the first page) As I mentioned above, when my system gets to this point I just restore my images and I'm good to go.

UPDATE:

Thanks for all of your ideas and suggestions so far. I have some good news to report although life isn't perfect yet. I have been working on data recovery. I am currently saving data files to another hard drive.

I searched the internet for an adaptor so I could hook my laptop hard drive to my tower. I was fairly certain the directory structure was still in place although windows xp was trashed. I found a site that sells a "Laptop IDE Hard Drive Adaptor" for about $10. It is a simple plug adapter with a pig tail for power. I checked a local PC store they sell one for $17+. Since I was anxious to try it out and considering shipping with time delays I picked it up local. This is a bargain because the local Best Buy wanted about $100 to do the data recovery for me.

I removed my HD from my laptop. Changed the HD jumper from cable select to slave and began copying files. So far I have recovered many files. Once I have the files secured I will attempt a few suggestions you have give to prove whether the BSOD Fatal Error is can be resolved. After a few tests I plan to reformat my drive, reinstall XP, and reload software and files, and learn how to do an image backup of my system. It will be probably be the first of the week before I can reinstall since I will be out a couple days.

Once again thanks for them time you put in to help me, I hope this will give someone else with this problem some hope.

Hummmm no need to take out your HDD Stop: C000021a Fatal System Error Status 0xc0000142 = broke and don't waste too much time trying to fix it, You need a networked computer or a friends computer with a shared folder you can network to. Then all you need to do to get your data back is Download Ubuntu from here burn this image to disk insert it into your laptop and boot from it.

Im assuming network is already configured for these following steps!!
Put Ubuntu in the corrupt computer and boot.

Step 1: Mount a NTFS partition
To open up a terminal (DOS prompt for you windows users) Press ALT + F2 and type xterm.
In that window type these commands.

sudo mkdir /media/windows
sudo mount /dev/hda1 /media/windows/ -t ntfs -o nls=utf8,umask=0222
Windows Partition is now mounted read only.

Step 2: Create and Open up your networked shared folder
Goto the computer your backing up onto and make a folder called MY-BACKUP and share it.
Go back to Ubuntu (192.168.1.30 is an example insert the correct IP address)

Press ALT + F2 (to run application)
Type smb://192.168.1.30/MY-BACKUP

Now you can navigate your way to the windows partition using the "file browser" and drag and drop your valuable data to your networked shared folder.

Now format your HDD!!

Hope this has been of some help to someone. Any questions?? Message me!

Nice Post NeoNapster, this is a great "HowTo" for data recovery using a Live Linux distro! I presume that the IP address your mention is the address of the networked computer that you will copy the files to - am I correct?

Here's a link for Ubuntu: http://ubuntu-releases.cs.umn.edu//6.06/ For this type of use you'll want the Desktop CD (includes the Live distro).

How to find the IP address of a Windows XP system.

Go to Start...Run...and type in "cmd.exe" (without the quotes) and press Enter.

In the black window that opens - type "ipconfig" (without the quotes) and press Enter.

The IP address will be displayed along with the Subnet Mask and Default Gateway.

FWIW - if the Linux trick works, it's unlikely that you have a hardware problem (since the Linux was using the same hardware without problems) - so then it's easy to format, reinstall, update and you'll have a brand spanking new copy of your OS!