Bluescreen of death - windows login process how to fix?

[joydivision]

I get the blue screen of death a on a clients computer after the XP flash screen.

So far I have done a RAM test - fine, done a very quick SMART test - fine, ran chkdsk/r did some repairs, did fixboot and also used Windows Boot CD to do a registery restore and still no different.

I will do a proper hard drive scan but what else have I missed before doing the dreaded N&P?

[NYJimbo]

A BSOD hex code would be kinda nice right about now..... :rolleyes:

[joydivision]

Will post it after the HD has finished scanning.

[iisjman07]

Considering the lack of information a lot of things could potentially fix this issue; it may be worth copying a known good winlogon.exe incase the original is corrupt/infected with malware

[joydivision]

Indeed the only working XP computer I have is SP3 though, this is SP2 is there any differences?

I suppose I could some how get it of a CAB file os an SP2 CD.

My client tells me the computer was running perfectly until this happened which is why I am suspecting hardware or some very nasty and well hidden rootkit.

I have repaired many computers and this is the first time I have come across an error with winlogin.exe must be pretty lucky.

[iisjman07]

Use an MD5 Calculator to see if there are any differences between the files.

[joydivision]

got a code if helps 0xc0000005 the rest is all 0s.

There is a white line across the very top of the screen so I am now going to boot my Ubuntu CD into it see if it is a video card fault causing it to crash.

[joydivision]

Posting this message on the very laptop and it works fine. No video problms apart from that white line. I will try the above suggestions thanks :)

[JD1248]

Just came across the same stop code twice last week. Both times I had to replace atapi.sys in sys32/drivers. Yours may not be the same, but I would take a close look at that folder.

[iisjman07]

atapi.sys

This is related to a recent rootkit going around. Some antivirus vendors delete it but none seem to be able to disinfect it, leaving it in its uninfected state. There's more info here: http://remove-malware.com/malware/malware-warnings/nasty-new-rootkit-patches-atapi-sys/

[Platte Computer Repair]

I had that BSOD happen to me at work today. Well a BDOD, don't remember the exact error message but turned out to be bad memory. Used memtest to find that out. Might help?

[joydivision]

Already done memtest and it came back fine but only ran it for an hour. I might actually swap the RAM to see if it makes a difference.

I managed to do a repair installation (which keeps the registry settings in tact) and I know the registery its now using has worked as its from a recent backup. Now I can get into the login screen but I Just get the BSOD death again the second I login in.

It won't boot into save mode at all, it just gets stuck, before it was BSODing.

I am now running a virus scan via an Antivirus CD one hour into it and it hasn't found a single virus :(

I am starting to think the line across the screen is related and the video chip is faulty.

[joydivision]

Having no luck at all even after the replacing the system files which are causing the BSOD :(

Is it time to cheat and do a full backup then format it? Tried swapping the RAM out with a known good (the very RAM from my own laptop) and made no difference.

There are a few faults such as the trackpad is not working and there is a white line in the top of the screen so I it might be time it was thrown out anyway.

[B Trevathan]

Did you try to boot the computer to the "Last know good configuration"?


May have been a windows update did you check if any files had changed recently before you did the repair installation.


What does the stop error say is it like:

Stop: c000021a {Fatal System Error} The Windows Logon Process System
process terminated unexpectedly with a status of 0xc0000005 (0x0000000
0x00000000).

[computerdoc]

Status System Process Terminated (stop code 0Xc000021A)

This error indicates a problem with either Winlogon.exe or the Client Server Runtime Subsystem (CSRSS). It can also be caused if a user with administrator privileges has modified the permissions of certain system files such that Windows cannot read them. To fix the problem, you'll have to install a second copy of Windows Vista, and then repair the file permissions from there.

From http://www.techmetica.com/howto/descriptions-and-fixes-of-blue-screen-of-death-bsod-crash-errors/