Stop: C000021a Windows Logon Process blue screen

Hi - recently my internet browsing seemed to be getting slow then IE started redirecting searches. Firefox is less affected and chrome seems to be immune.

I ran Malwarebytes Anti malware & SAS which found a couple of problems.

Then I noticed I had a few windows updates to install (since my computer had been getting slow and processes running at 100% CPU for a while I had changed the windows updates from fully automatic to manual setting)

As it was rebooting after a .NET framework update I think, I got a blue screen error with STOP: C000021a {Fatal System Error} The Windows Logon Process system process terminated unexpectedly with a status of 0xc0000005 (0x00000000, 0x00000000). The system has been shut down.

I tried to reboot using last known good config and safe mode - neither worked.
I eventually managed to get window to start using debugging mode (I don't even know what that is!) which is where I am now.

Hope somebady can help,

thanks!

 

try to turn your computer on normally. If it blue screens before the windows logo pops up, then chances are it is a north bridge problem. ( Ram, CPU, or Video) if it blue screens after the windows logo, then usually it's south bridge (drivers, etc..) hope this helps

 

Thanks -

trying to start normally got as far as the welcome screen before the error.

I tried "Last known good config" which got as far as the big windows logo on the black screen.

Then the usual process of trying debugging mode which usually locks up on the "windows is starting up" screen, so I have to turn it off and restart which runs though a chkdsk before windows eventually starts.

I found the following in the drwtsn32 log:

So I guess the question is what does debugging mode do differently that enables it to boot up when the other modes can't?

If like you suggest that the drivers are the issue, how can i find which ones are causing the problem & how do I got about repairing them?

cheers!

 

Probably what I would do first is slave the hard drive to another pc. then go into the system32 files and manually remove the video adaptor driver. If that doesn't work then you can try reformatting.

 

Hi - ok this is a laptop, and I don't have another PC so I'm not sure about putting the hard drive into another one.

How do you know it's the video driver that's causing the problems? - is there another way to remove it?

I'd rather not reformat the drive unless it's absolutely necesary.

 

because your blue screen is happening before your pc boots up.(north bridge)...that can only mean 3 things. RAM, CPU, or Video. And since you can only boot into debugging mode, your video is shot. To remove it, you have to access your win32 files.

 

That's a bit confusing, as before you said that if I see the windows logo then it was the south bridge - I usually see both windows logos every time I boot up no matter what mode I try.

When it does boot up using debugging mode, the video is fine - everything works as it should except for the issues in the 1st post.

Anyway today for the 1st time I got some indication of the problem - AVG resident shield gave the following error:

I guess I can assume that the winlogon.exe file is infected and could be causing the boot problems, (and possibly the internet problems too)

So my question now is, what is the best way to replace it?

a search located the following copies on my computer :

Code:

WINLOGON.EX_	C:\i386 				225KB 	04/08/2004 05:00
winlogon.exe	C:\WINDOWS\system32			496KB	14/04/2008 01:12
winlogon.exe	C:\WINDOWS\$NtServicePackUninstall$	491KB	04/08/2004 05:00
winlogon.exe	C:\WINDOWS\ServicePackFiles\i386	496KB	14/04/2008 01:12

or should I take a copy from another clean computer?

 

if you have a recovery disk, you could boot to that and try to run a repair.

 

OK - I was able to transfer a copy of winlogon.exe from a clean computer running the same version of Windows & service pack number which seems to have done the trick.

I can now boot windows normally - no need to remove video adaptor drivers and no need to reformat.

I guess there still is an issue with malware / virus but at least no I can run through the removal procedures advised here without to go through chkdsk / debugging mode each time I have to reboot.

I am still interested to know how debugging mode was able to boot the pc successfully while normal mode gave the bsod error - if anybody knows the answer?