STOP: c000021a Fatal System Error

[McK1987]

Clients laptop is experiencing a BSOD shortly after the Windows XP logo loading screen.

BSOD Message: STOP: c000021a Fatal System Error

I am unable to boot into Safe Mode and also ERD Commander and Windows Repair disk didn't offer much in the way of a solution. The client said that an Anti Virus program popped up called 'AntiMalware Doctor' and then on reboot, he is receiving this message. It does appear to me that the winlogon.exe process ahs been comprised but I can't for the life of me manage to get by it. I have already tried the renaming to winlogon.old. I have conisdered removing the laptop and using as a external HD to do further repair...AV scan, etc?

I would like to avoid doing a nuke and pave so any suggestions/advice on this one guys?

 

[Martyn]

Can you get to F8 and use "last Known Configuration?"

 

[Xander]

Have you done any googling on the topic?

Edit: When posting, please tell us all the steps you've done. If what you've described is the extent of it, you don't deserve any help yet as you haven't done any of your own leg work.

 

[Martyn]

Have you done any googling on the topic?

Just about to post that link

 

[Elemdee]

When you CAN get in run rkill and then MBAM.

http://www.technibble.com/rkill-repair-tool-of-the-week/

 

[McK1987]

I feel as though I haven't been off Google all day! Usually such a great resource!

I have tried F8 key, one of the first things that I tried but nothing works in there. Safe Mode or LKGC.

I did also notice int he event viewer through ERD that McAfee was disabled shortly before this issue started and also I am unable to use Sys Restore so looks like this is a clever piece of Malware.

 

[McK1987]

When you CAN get in run rkill and then MBAM.

http://www.technibble.com/rkill-repair-tool-of-the-week/

Cheers!

That is my plan if I can just get in!!

 

[Xander]

I am unable to use Sys Restore so looks like this is a clever piece of Malware.

Not even from the recovery console?

 

[Pc Fixed Right]

have you copied the mini dump files onto a working machine and used whocrashed to analyze the crash? tested the ram?

 

[B Trevathan]

I think you have more problems than 'AntiMalware Doctor' it sounds pretty simple:

http://www.bleepingcomputer.com/virus-removal/remove-antimalware-doctor
http://www.2-spyware.com/remove-antimalware-doctor.html
http://www.malwarehelp.org/antimalware-doctor-removal-2010.html

I don't think it would block you from starting windows or using safe mode or last known good configuration.
To see what other malware was installed run a live CD like:

Avira Rescue CD or DR. Web live CD

 

[McK1987]

Hi Guys,

Thanks for all your advice.

I just decided to repair windows one more time and funnily enough, I've manged to get in now! So I'm currently running Hitman Pro, Super Antispyware etc to make sure laptop is clean before handing back to user as I noticed the antimalware doctor icon on desktop.