STOP: C000021a {Fatal System Error}

Hoping that amongst Igorian, eggplant, breezer, and Spark123, one of you might have come across this little problemette...

WNT4.0 Workstation + SP6a
In the middle of doing my accounts, whilst listening to Radio 4 "Listen Again" site, I clicked on the 'go backwards 15 minutes button and Windows completely locked up, presenting a grey screen.

Mouse cursor, but wouldn't move. No disk activity, no response to Pin on the LAN. I decided to reset and reboot. Then, after the three-dots-per-logical-disk checking operation I get the following error:

STOP: C000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly
with a status of 0x00000080 (0x00000000 0x00000000)
The system has been shut down.

No Safe Mode available in NT4 of course, so I booted to the Disaster Recovery partition that I had the foresight to install about 6 years ago, and ran every disk check I could find - no errors. RAM is also perfect. All my data (on different partitions to the NT system drive) is just fine and dandy, AFAIK.

All Registry hives seem to be readable and loadable, so I can't see what's preventing this from booting.

Trying a Windows repair installation, selecting registry checking and system file checking, and using my ERD floppy disk (which I had and was reasonably up to date), it claims to have made changes and requires a reboot (and restart setup), but nothing has changed - I still get the BSOD, so the repair operation seems to do nothing.

This is very frustrating. So much so that I've just been out to buy a new (2nd hand) cheap PC so that I get my invoicing done and carry on with life, but if I don't repair NT4 then I've got a few weeks ahead of me to recover all the applications that I know and love.

Any thoughts anyone?

What does the BSOD say?

Could be time for Ed the ex Windows NT device driver software developer to crack his knuckles, then again maybe not.

Eddie M said:

What does the BSOD say?

Click to expand...

[code:1]STOP: C000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly
with a status of 0x00000080 (0x00000000 0x00000000)
The system has been shut down. [/code:1]

Could be time for Ed the ex Windows NT device driver software developer to crack his knuckles, then again maybe not.

Click to expand...

OK - anything you can offer is likely to be gratefully received.

If it's a BSOD, there should be a screen full of info, modules, register values ie CS:EIP, EAX, EBX. do you know if the OS was set to perform a dump of the heap in the event of a BSOD?

Also, see here

Oh, and finally have you installed WinNT SRP which was to be SP7 but got pulled by MS?

There's an item here, which may be of some use. I'll post back if I find anything else.

Another.

Igorian said:

There's an item here, which may be of some use. I'll post back if I find anything else.

Click to expand...

Too late for once

The second one almost certainly refers to replacement GINA as I wrote a session management GINA for some previous clients.


No, not that one !!

, oh yeah, I didn't notice. Having re-read Softies thread, the first article seems relevant as it talks about the winlogon process.

Eddie M said:

If it's a BSOD, there should be a screen full of info, modules, register values ie CS:EIP, EAX, EBX.

Click to expand...

Yes, but this particular BSOD doesn't.

However, I did miss out the following, for which I apologise:

[code:1]Beginning dump of physical memory
Physical memory dump complete. Contact your system administrator or
technical support group.[/code:1]

do you know if the OS was set to perform a dump of the heap in the event of a BSOD?

Click to expand...

A particularly good question - I believed that it was, but the only .dmp file I can find is a user.dmp file dated Jun 2006.

Do you know how to turn on the dumping feature in the Registry?

Also, see here

Click to expand...

Hm. I had read that, and decided that it didn't help because I hadn't installed anything recently, and couldn't boot into a state wherein I could run Drwtsn32.exe.

BTW, one thing I tried is modifying the Current Control Set number to be one lower than I found it, in the hope that the fault was a Registry corruption and one that I could circumvent. This didn't make one blind bit of difference.

Eddie M said:

Oh, and finally have you installed WinNT SRP which was to be SP7 but got pulled by MS?

Click to expand...

No - but I don't know if I can install that without booting. Can I?

Something that bothers me is that there is no GinaDLL entry of any kind in the Winlogon Registry container.

Is this a coincidence? I don't have another NT4.0+SP6a machine to compare this to at the moment.

No you can't install SRP until you've got it booted into Win NT, I reckon the best course of action may well be to re-install NT without reformatting the disk, then repplying SP6a, perhaps SRP.

I think the alternatives may be unpalatable and expensive and possibly / probably not feasible.

BTW if the screen goes blue in Win NT the kernel is up and running, my guess is that the GINA, usually msgina.dll (have you checked?) is experiencing a problem (being a dll this is called by winlogon.exe and has the same process address space as the exe, hence why the exe dies)

The GINA dll is reponsible for the message box that prompts you to press Ctrl-Alt-Del (in the msgina) to logon, commonly know as the default SAS ( system alert sequence)

Tricky, assume you have a NTFS v5 partitions ?

Hm. It's emerging as near certainty that this is a winlogin.exe and/or gina.dll problem. The BSOD appears a fraction of a second after the tiniest of briefest of momentary glimpses of the Windows c-a-d logon screen (with the teal coloured background).

I've added ginadll:REG_SZ:msgina.dll to the Winlogon container, but the symptom remains. Can't help wondering if winlogon.exe is fully intact.

My NFTS partitions are v4, AFAIK.

You've reminded me to swap my removable backup hdd.

OK - here's the deal.

IT'S FIXED!

It seems that there's something wrong with the resident winlogon.exe - I replaced it with an earlier one, rebooted and hey presto!

I can't tell you how much of a relief this is, and I wouldn't have persisted without the suggestions from all you guys.

Next action is to create a new ERD, then get my new XP client working and make this machine a file server - I'll never use RealPlayer on it again.

Softus said:

Hm. It's emerging as near certainty that this is a winlogin.exe and/or gina.dll problem. The BSOD appears a fraction of a second after the tiniest of briefest of momentary glimpses of the Windows c-a-d logon screen (with the teal coloured background).

I've added ginadll:REG_SZ:msgina.dll to the Winlogon container, but the symptom remains. Can't help wondering if winlogon.exe is fully intact.

My NFTS partitions are v4, AFAIK.

Click to expand...

They'll be v5 changed from v4 in NT SP4. Doesn't really help though. Non destructive re-install, re-apply SP6a (no slipstream I'm afraid) maybe SRP. Probably easiest.