Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

unable to boot due to c000021a error


  • This topic is locked This topic is locked
36 replies to this topic

#1 lanya13

lanya13

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:58 AM

Posted 28 January 2011 - 05:00 PM

Hi,

I am hoping that I am posting in the correct forum since I am new. I have a Dell Inspiron 6400 laptop with Windows XP MCE os that I was trying clear out for a friend. He had a lot of malware that was affecting his system and kept producing BSODs. I used Spybot Search and Destroy to root out and remove as much of the harmful bugs on his system. However upon reboot, I got a BSOD with the following message:

STOP: c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of 0xc0000005 (0x00000000 0x00000000)
The system has been shut down.


When attempting to access the system through any of the safe mode options, the same error is obtained.

Unfortunately no reinstall cd came with the laptop so I am unable to boot and repair through this method. We would like to fix this problem without losing the files stored on the system if possible.

Please help! Thanks much!

BC AdBot (Login to Remove)

 


#2 lanya13

lanya13
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:58 AM

Posted 28 January 2011 - 09:32 PM

Hi again,

After going through the forum for possible suggestions I came across one solution as in the link below which was used to solve a problem almost similar to mine.

My link

The only difference is that the XP Pro disc that I have is an OEM. I am not certain if this will affect the disc-building process.

Advice and assistance will be greatly appreciated.

Thanks!

#3 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:11:58 PM

Posted 29 January 2011 - 08:39 AM

Hello and :welcome: to the BC forums.

Please sit tight and be patient.

I have requested that an experienced helper who specialises in un-bootable computers respond to your topic.

Thank you.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#4 lanya13

lanya13
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:58 AM

Posted 29 January 2011 - 09:00 AM

Thanks much!

#5 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,112 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:58 PM

Posted 30 January 2011 - 03:25 AM

Hello, the steps in the topic you linked to will usually not work (or are a lot harder) with an OEM disk.

Try this please. You will need a USB drive.

Download GETxPUD.exe to the desktop of your clean computer
  • Run GETxPUD.exe
  • A new folder will appear on the desktop.
  • Open the GETxPUD folder and click on the get&burn.bat
  • The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
  • Click on Start and follow the prompts to burn the image to a CD.
  • Next download driver.sh to your USB drive
  • Remove the USB & CD and insert it in the sick computer
  • Boot the Sick computer with the CD you just burned
  • The computer must be set to boot from the CD
  • Gently tap F12 and choose to boot from the CD
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh -f
  • Press Enter
    When asked to provide a filename, type the following and press enter (repeat the process for both files):
    explorer.exe
    winlogon.exe
  • After it has finished a report will be located on your USB drive named filefind.txt
  • Remove the USB drive and insert it back in your working computer and navigate to filefind.txt

    Please note - all text entries are case sensitive
Copy and paste the filefind.txt for my review

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#6 lanya13

lanya13
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:58 AM

Posted 30 January 2011 - 03:53 PM

Hi,

Thanks for the response. I am in the process of trying to burn the iso image. However, my cd drive is not being detected at the moment. So I am attempting to resolve this asap.

Will update you as soon as I can.


Thanks again!

#7 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,112 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:58 PM

Posted 30 January 2011 - 04:05 PM

Okay, if it doesn't work, we can try the same with an usb drive.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#8 lanya13

lanya13
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:58 AM

Posted 30 January 2011 - 04:24 PM

What do I need to do with respect to the usb drive? I really do not forsee my drive problem being fixed any time soon.

#9 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,112 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:58 PM

Posted 30 January 2011 - 04:59 PM

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer
  • Insert your USB drive
  • Press Start > My Computer > right click your USB drive > choose Format > Quick format
  • Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  • Press Run then OK
  • Select the DiskImage option then click the browse button located on the right side of the textbox field.
  • Browse to and select the xpud-0.9.2.iso file you downloaded
  • Verify the correct drive letter is selected for your USB device then click OK
  • It will install a little bootable OS on your USB device
  • Once the files have been written to the device you will be prompted to reboot ~ do not reboot and instead just Exit the UNetbootin interface
  • After it has completed do not choose to reboot the clean computer simply close the installer
  • Next download http://noahdfear.net/downloads/driver.sh to your USB

Now follow my last set of instructions to boot from the USB and run the file find script.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#10 lanya13

lanya13
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:58 AM

Posted 30 January 2011 - 06:19 PM

Hi Elise,

This is the contents of the filefind.txt. Hopefully I ran the process correctly :huh:



Search results for winlogon.exe

325fd6d25fc1d77c363e87b445c8b023 /mnt/sda4/minint/system32/winlogon.exe
497.0K Aug 15 2005

01c3346c241652f43aed8e2149881bfe /mnt/sda2/i386/winlogon.exe
490.5K Aug 10 2004

00a2b7c023215130a6a2e430f41fa488 /mnt/sda2/WINDOWS/system32/winlogon.exe
496.0K Apr 14 2008

ed0ef0a136dec83df69f04118870003e /mnt/sda2/WINDOWS/ServicePackFiles/i386/winlogon.exe
496.0K Apr 14 2008

01c3346c241652f43aed8e2149881bfe /mnt/sda2/WINDOWS/$NtServicePackUninstall$/winlogon.exe
490.5K Aug 10 2004



Thanks!

Lanya

#11 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:11:58 PM

Posted 30 January 2011 - 06:33 PM

When asked to provide a filename, type the following and press enter (repeat the process for both files):
explorer.exe
winlogon.exe

lanya

Please repeat for the file explorer.exe also, as Elise asked in her instructions.

Thank you.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#12 lanya13

lanya13
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:58 AM

Posted 30 January 2011 - 08:35 PM

Hi,

When I first ran the test for both explorer.exe and winlogon.exe, the result log obtained was exactly as pasted in my previous post.

I ran the test again for explorer.exe as AustrAlien instructed. The results log obtained was:


Search results for explorer.exe



I am not certain if I did something wrong despite following the instructions exactly as directed.


Lanya

#13 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,112 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:58 PM

Posted 31 January 2011 - 03:30 AM

Hi Lanya, no problem, I have the file location now, so please do the following:

Boot from xPUD.
Click the File tab in the left panel.
Doubleclick mnt
Navigate to /mnt/sda2/WINDOWS/ServicePackFiles/i386/winlogon.exe <-- right click this file and select "copy"
Now navigate to /mnt/sda2/windows/system32, right click in an open space in this folder and select "paste". When asked to overwrite, click Yes.

Navigate to /mnt/sda2/WINDOWS/ServicePackFiles/i386/explorer.exe <-- right click this file and select "copy"
Now navigate to /mnt/sda2/windows, right click in an open space in this folder and select "paste". When asked to overwrite, click Yes.

After you successfully copy over both files, restart your computer and let me know if you can boot successfully in Windows.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#14 lanya13

lanya13
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:58 AM

Posted 31 January 2011 - 05:37 AM

Hi Elise,

Yes I am able to restart the computer normally! Thanks much!! :thumbsup:


Lanya

#15 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,112 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:58 PM

Posted 31 January 2011 - 06:25 AM

I'm glad to hear that. Please let me know if you need any more help making sure your computer is clean.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users