Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

XP Continues to reboot error c000021a


  • Please log in to reply
5 replies to this topic

#1 jasncondit

jasncondit

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 18 October 2010 - 08:33 PM

Hi,
My computer recently kept rebooting. When I disabled the reboot and got the BSOD it said it was a C000021a Fatal error at logon f 0xc0000034. I've read most of the solutions on here and have done the XP repair as if it were upgrading. I've done fixboot, chkdsk /P , chkdsk /R, but I haven't done Fixmbr. The reason is it says that my drive has a non-conforming name or something like that. My drives for the single HD that I split into two is F: and G: I had a C: drive go bad and then added the operating system on to my current one so I could rescue C: and could never switch it back to C: Will fixmbr ruin my HD for good? Also, I don't think it is the hard drive. It is a ATA but I tried a SATA drive that has XP on it and it comes up with the same error. I also have 4 GB of memory on a Gigabyte board that holds a Quad Core Pentium. Also, safe mode doesn't work it still reboots. When I did the pretend upgrade repair with the boot disk of XP it did let me get to the desk top before freezing with no icons and no task bar at all at the bottom. Now it won't even get back to that.

Any suggestions?

Jason

BC AdBot (Login to Remove)

 


#2 jasncondit

jasncondit
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 18 October 2010 - 10:03 PM

No one knows how to fix this one? 47 views and no one? Help please :thumbsup: :flowers:

#3 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:08:31 PM

Posted 18 October 2010 - 10:11 PM

http://support.microsoft.com/kb/156669
Try this M/soft item - If you do not understand it , please post back -

Thank You -

#4 jasncondit

jasncondit
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 18 October 2010 - 10:24 PM

http://support.microsoft.com/kb/156669
Try this M/soft item - If you do not understand it , please post back -

Thank You -



It talks about a prompt but I can't get to a prompt unless I'm running repair on the XP CD at boot? Will it work there? Is there an easier way to restore the winlogon? Also if it were my hard drive why is it that another hard drive although a Sata one, has the same issue? I tried swapping out memory as I have extra and nothing worked?

#5 nicknc

nicknc

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:31 AM

Posted 19 October 2010 - 06:37 PM

Long-time reader of this forum, first-time poster...

I'll give you some info that might help.

I've had quite a few PCs come through my office the past few weeks with this EXACT BSOD. I bet when you try to boot to safe mode, you hit a 0x7B, right?

Two weeks ago when the PCs started coming in with this, it was an Alureon variant infection at c:\windows\system32\drivers\dmio.sys in addition to the usual userinit hijack in the registry and some bogus dll's. I also saw it with the mbr variant of Alureon. I was able to clean by mounting externally in another PC, running MS Security Essentials scan on it, and then booting to recovery console and running fixmbr on the mbr variant (MSSE was unable to clean the hard drive with the mbr infection-- it made sure to notify me over and over though...very annoying!)

Unfortunately, this week the two PCs I've had come in with it-- I can't pin down the location of infection. fixmbr doesn't work, I've replaced a good deal of the drivers at c:\windows\system32\drivers with known clean ones. All I have is that ONLY Avast and Emsisoft (as horrible as it is...) detected ANYthing other than a java exploit. Both flagged a bunch of .tmp files at c:\windows\temp as being infected with the "Enistery" virus.

I uploaded those files to Virustotal, where SuperAntiSpyware, Avast, and Emsisoft remain the only ones that find anything malicious in them. I'd be tempted to say false positive, but... google "Enistery" and you'll see the only references to this malware have popped up in the last week. It looks to me like a new rootkit variant-- I'd guess TDSS/Alureon at this point, as that's what it's been in the past, but yall's guess is a good as mine.

Ironically, as I walked through my college today, I saw several of the kiosk PCs

All said and done, my advice would be to:

1. Access your hard drive from a PE environment (ie Linux DVD) OR mount in an external enclosure
2. Make a careful limited backup (no sense in dragging any infection with you)
3. Write zeros to the drive (if you want to be extra careful)
4. Format the drive and reinstall

Nevertheless, make sure to give other folks on here a chance to weigh in. Perhaps there's another solution out there. The quickest resolution would be to reinstall (I spent >6 hours cleaning this $#@%! rootkit each time, as it's always changing).

#6 nicknc

nicknc

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:31 AM

Posted 19 October 2010 - 06:40 PM

By the way, I'm currently working on a PC that's got this issue, so if I pick something up, I'll post back. Client wants me to try and clean for now.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users