Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


STOP 0xC000021A in winlogon.exe

  • Please log in to reply
No replies to this topic

#1 JW113


  • Members
  • 1 posts
  • Local time:02:23 PM

Posted 05 August 2010 - 02:48 AM

There is a forum post in the ...Removal Logs forum about this issue, where an XP PC dies with

STOP: 0xc000021a {Fatal System Error}
The windows Logon Process system process terminated unexpectedly with a status of 0xc0000005 (0x00000000 0x00000000)
The system has been shut down

and a later scan finds that /Windows/system32/winlogon.exe is infected with TR/Spy.507904.8.

The advice given was to boot from an XP CD, run Recovery Console, and replace winlogon.exe (and atapi.sys) with the versions from the CD. This solved the BSOD issue, but resulted in
an error "winlogon.exe encountered a problem and needs to close message"

Such an error seems a likely possibility, since the CD version may well not match the current installed version that's being replaced. I had the same STOP 0xC000021A issue very recently, which I eventually resolved by replacing winlogon.exe with the copy from /Windows/system32/dllcache, after running

FC /B winlogon.exe dllcache\winlogon.exe

to compare the two copies. (I had booted from a UBCD4Win CD rather than Recovery Console so I had the FC command available.)

Perhaps this will help someone else with this problem (it would have saved me much time!)

Edited by JW113, 05 August 2010 - 02:50 AM.

BC AdBot (Login to Remove)


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users