Member Avatar for drjaz

Ok, here we go…
I am working on a friends system with some virus and adware issues. I resolved all but one, so I proceeded to update him to sp2 and yep you guessed it, the dreaded C000021a {Fatal System Error} message appeared. The windows logon process system process terminated unexpectedly with a status of 0x80000004 (0x00000000 0x00000000). The system has been shut down.

I’ve tried a repair installation and that doesn’t work.
I’ve tried to get into the console and the Administrator Password (which I know is correct) doesn’t work I also used a 3rd party program to change the PW and it still didn’t work. (Locks me out after 3 attempts.)
I created a boot ISO CD to get into the NTFS partition and I can manually edit the registry, I just don’t know what lines are what. (I’ve become GUI’ized).

Now I could recover the system, but that would be too easy. I have the ability to put this hard disk in another system and fix it, if I knew what to fix. Help.
I really would like to fix this one, so I’m calling on all the gurus for advice.

Help out the old timer,
Thanx,
Dano

  • 3 Contributors
  • 4 Replies
  • 131 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by stevic55

Dani AI

Generated

A short, practical checklist to use when C000021A appears and the problem disk can be mounted on another machine. Useful context from this thread: correctly warned that offline password editors and blunt repairs can make recovery harder, and reported the machine was recoverable after digging into the OEM-preinstalled setup. Below are diagnosis and safe-repair steps that were not covered in the replies.

C000021A means a critical user-mode subsystem terminated (the logon subsystem or a client-server runtime). Typical root causes are mismatched or replaced system files after an update, tampered/third-party authentication hooks, or registry/service corruption — often triggered or exposed by updates or prior malware cleanup.

  • Make a full image of the drive before any changes.
  • Run up-to-date offline anti-malware and rootkit scans against the mounted volume.
  • Load the offline registry hives from the mounted Windows folder (use regedit, File -> Load Hive) and inspect the Winlogon area at HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon for unexpected values (for example the Shell or Userinit entries and any third-party DLL names).
  • Inspect Windows\System32 for logon-related executables whose timestamps or digital signatures differ from a known-good XP SP2 set. Tools that report signatures and file version info are useful here.
  • Review HKLM\SYSTEM\CurrentControlSet\Services for newly added services set to auto-start before logon.

If you find mismatched or tampered files, restore clean copies from original XP SP2 media or a verified image; avoid ad-hoc password editors that write the security database. Try Last Known Good where appropriate. If the above fails or the installation is heavily compromised, image the drive and perform a clean reinstall so the machine is stable.

These steps prioritize containment and forensics first, then selective repair. They reduce the chance of making the security and authentication store worse while you try to bring the machine back.

Recommended Answers

All 4 Replies

Member Avatar for antioed

This computer is not a member of a domain...correct? What utility did you use to reset the admin password? Those utilities tend to blow up the Security Accounts Manager (SAM) file since this is where those password hashes get written when you use a change password utility...this would cause Winlogon to fail and Windows will barf up the message you've got. One easy way to fix it would be to restore back to a working install and fix the password FIRST...then once you've verified you have a valid admin account to use move on to fixing the other problems.

If you want to try to recover what you've got there I would:

- Mount the drive secondary as you said.
- copy sam and system.bak from the c:\windows\repair folder to c:\windows\system32\config
- Reboot and if admin password fails run change password utility again and pray that this time it doesn't blow up the SAM.
- You may have to reinstall some devices.
- If it doesn't work after that then I would stop pissing in the wind and grab the data before I reinstalled OS or possibly recover as you mentioned...I'd say that even if you do manage to get logged in it's only a matter of time before your friend will be running into trouble again with that installation.

Member Avatar for drjaz

Thanks Anointed.
I pretty much prayed that I'd stop pissing in the wind, and then recovered the system.

What I did learn in the process is that the almighty eMachines uses Sysprep and that is what caused the password issue.

I don't even know why I tried an online chat with those guys; guess I just like pain.

I'm sure I'll be using your advice in the future.

Dano

Member Avatar for drjaz

Thanks antioed
I pretty much prayed that I'd stop pissing in the wind, and then recovered the system.

What I did learn in the process is that the almighty eMachines uses Sysprep and that is what caused the password issue.

I don't even know why I tried an online chat with those guys; guess I just like pain.

I'm sure I'll be using your advice in the future.

Dano

Member Avatar for stevic55

i am setting up my dsl internt connection om my computer i put in my isp's installation disk in my cdrom and got fatal error please help

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.