Blue Screen - C00021a/0x80000007

Discussion in 'Software' started by bobspicks, Nov 20, 2006.

  1. bobspicks

    bobspicks Private E-2

    bjgarrick suggested I post this to address the WLP error before tackling the malware issue.

    I recently got hit with the Brave Sentry malware and ended up shutting down
    my PC by powering off. Now when I power up I get a blue screen with the
    following message:

    C00021a
    The Window Login Process system process terminated unexpectedly with a
    status of 0x80000007. The system has been shutdown.

    I tried restoring to Last Known Good Configuration and also running in Safe
    Mode, but each time I end up with the same error.

    What can I try next?

    Bob
     
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

  3. bobspicks

    bobspicks Private E-2

    Thanks for the advice. Would you recommend Repairing Windows XP in Eight Commands or XP's No-Reformat, Nondestructive Total-Rebuild Option. Both of them scare me silly, but I've got a friend who doesn't mind wrecking my PC.

    (Note: I already tried booting with Last Known Good Configuration.)

    My PC came with all of the software factory installed. The reinstallation CDs that came with the PC include:
    - Microsoft Windows XP Professional including Service Pack 1
    - Microsoft Office XP Version 2002 Service Pack 1
    - Dell Tools System Software (Antivirus, Support, Multimedia, Internet)
    - Dell Dimension Resource (Device drivers, Diagnostics & utilities and
    Computer documentation).

    Would I be correct in assuming that the CD I want is Microsoft Windows XP Professional including Service Pack 1?

    Thanks again.

    Bob
     
  4. bobspicks

    bobspicks Private E-2

    I followed the instructions found at Information Week to do a repair installation, which seemed to complete successfully. However, when done, it just kept rebooting after the Windows Start Up screen came up.

    Any suggestions?

    Bob
     
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Start smacking F8 and try to get into safe mode ....with networking if possible.
     
  6. bobspicks

    bobspicks Private E-2

    I did get into Safe Mode, not with networking... It still kept rebooting.

    I've got a stand-alone home PC, no firewall, currently disconnected from the Internet, Windows XP Professional OEM-installed,...

    Will networking help?

    Bob
     
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Can you do a system restore?
     
  8. bobspicks

    bobspicks Private E-2

    I can do a system restore... if I know how.

    Bob
     
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Start / programs / accessories / system tools / system restore .....pick one prior to the problems ...
     
  10. bobspicks

    bobspicks Private E-2

    This would probably work well if I could get my desktop up instead of it rebooting from the Windows Start Up screen.

    Bob
     
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Do it in safe mode .....:)
     
  12. bobspicks

    bobspicks Private E-2

    Unfortunately, I get the same results in Safe Mode - boot-up gets to the Windows Start Up screen and then automatically reboots. I can't get past this reboot.

    Bob
     
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

  14. bobspicks

    bobspicks Private E-2

    Thanks, TimW.

    I used this procedure as you prescribed on November 20. It may have fixed the blue screen, but now the PC just keeps rebooting from the Wiondows Start Up screen.

    I've tried rebooting into Safe Mode and performing the repair install again with same results - constant rebooting.

    Bob
     
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Get on your gloves, Nurse, it's time for surgery ..unplug the computer and
    disconnect everything but hard drive (got onboard video? if so hook it to that and remove vid card ) ..leave one stick of ram and reboot (after plugging the power back in!!!) ....see what it does ...report back ..you may need to swap the ram sticks and retry ....
     
  16. bobspicks

    bobspicks Private E-2

    Well, I finally got another disk with Windows 2000 and made it primary; the original disk was made secondary (F: drive). This allowed me to access the files on the original drive.

    Before doing anything, I ran Norton Antivirus and it found the Bloodhound virus that it quarantined. After running Live Update, I ran Norton again and it found another virus that it deleted. Just for the hell of it, I also ran Norton on the primary disk and it found the W32.Welchia.Worm that it couldn't delete, but I followed a procedure from PC Hell and did it manually - Norton trapped the same virus afterwards and deleted it. Obvioulsy, the Windows 2000 drive doesn't have the updates I did to the original drive.

    I copied my Favorites and My Documents folders from the original disk. While looking for other files I might want to save, I found BraveSentry folders in F:\Program Files and F:\Documents and Settings\\Start Menu\Programs. I deleted both folders and cleaned out the Recycle Bin.

    Noting the date when the BraveSentry folders were created, I checked for other files created that day. In chronological order:

    - Class3SoftwarePublishers[1].crl in F:\Documents and Settings\\Local Settings\Temporary Internet Files
    - test[1].htm in F:\Documents and Settings\\Local Settings\Temporary Internet Files
    - 1.dlb and 2.dlb in F:\Documents and Settings\\Local Settings\Temp
    - dlh9jkdq1.exe in F:\WINDOWS\SYSTEM32 [Trojan.VXGame/32.Process]
    - dlh9jkdq2.exe in F:\WINDOWS\SYSTEM32 [Trojan.VXGame/32.Process]
    - xpudpate.exe in F:\WINDOWS [Trojan.VXGame/32.Process]

    - maxd641.exe in F:\WINDOWS\SYSTEM32 [Worm.Microsotl.35]
    - maxdd1.game in F:\Documents and Settings\\Local Settings\Temp [Worm.Microsotl.35]
    - 9 .exe and .game files were quarantined by Norton

    - install.dat in F:\Documents and Settings\\Application Data
    - desktop.html in F:\WINDOWS

    - 4 .exe and .game file were quarantined by Norton
    - vx2.game and vx3.game in F:\Documents and Settings\\Local Settings\Temp [Malware?]
    - 8 .exe and .game files were quarantined by Norton
    - rpcc.dll in F:\WINDOWS\SYSTEM32 [Trojan RPCC Payload]
    - count[1].htm in F:\Documents and Settings\\Local Settings\Temporary Internet Files

    - 2236[1].htm in F:\Documents and Settings\\Local Settings\Temporary Internet Files
    - peaddrdd.exe in F:\Documents and Settings\\Local Settings\Temp
    - mtgrmr.dll in F:\WINDOWS\SYSTEM32
    - fwvlknkf.exe in F:\Documents and Settings\\Local Settings\Temp
    - krab03[1].exe in F:\Documents and Settings\\Local Settings\Temporary Internet Files
    - runfile[1].exe in F:\Documents and Settings\\Local Settings\Temporary Internet Files
    - load[1].php in F:\Documents and Settings\\Local Settings\Temporary Internet Files
    - kr_done1 in F:\WINDOWS\SYSTEM32

    - BraveSentry shortcut in F:\Documents and Settings\\Desktop

    - h91746.exe in F:\Documents and Settings\\Local Settings\Temp [Trojan.Downloader-H91.Process]

    Today I ran CHKDSK on the F: drive (had to reboot to get exclusive access). I noticed that it said it made corrections, but did not mention any filenames before continuing with the reboot.

    Sorry for the long posting. I hope it provides some information that will help restore my PC. I plan to next try rebooting the original disk to see if it will come up to the desktop this time. Hopefully, none of the noted malware will prevent this.

    Bob
     
  17. bobspicks

    bobspicks Private E-2

    I hooked the original disk as primary and it still reboots when the Windows Starting Up screen is displayed. What normally happens in the background while this screen is up? The answer may help me determine what is causing it to reboot.

    Bob
     
  18. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Unless you completely cleaned the hard drive...all that malware is screwing your system ...
     
  19. bobspicks

    bobspicks Private E-2

    By "completely clean", do you mean wipe out everything and reinstall or clean out the malware? Can the removal tools mentioned at this forum be used to clean malware on a secondary disk?

    Bob
     
  20. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes ...the malware ..and yes ..the tools will work on the secondary drive ...
     
  21. bobspicks

    bobspicks Private E-2

    I read the Read & Run Me First posting and most of the activities seem like they would only work on the primary drive. Would you tell me which removal tools I can run that would work on the secondary drive.

    Thanks.

    Bob
     
  22. bobspicks

    bobspicks Private E-2

    I reinstalled Windows XP last night (with no reformat) and was finally able to get to the desktop. However, that's when wierd things started happening. I reinstalled Norton Anti-Virus and ran a LiveUpdate, but was later warned about an internal error. I uninstalled Norton and installed it again. Now when clicking on the icon, Norton briefly comes up and then disappears. I tried uninstalling it again using Add/Remove, but the control panel disappears when I click on Norton. Similar things happen with HijackThis (Windows Explorer closes when I click on the folder) and even Internet Explorer (either fails to come up or closes on its own).

    All of my old files are still accessible, but under the old profile (a new one was created when I reinstalled Windows). All of the old program files are in the Program Files folder, but seemingly useless. Could it be that the registry settings were not changed when I reinstalled Windows? But how does that explain the Add/Remove control panel closing.

    Do you have any suggestions?

    Bob

    PS. The Windows XP drive is primary and the Windows 2000 drive is connected to power, but not cabled.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds