Member Avatar for 97320734

Hi to all (new poster speaking!),

I'm having trouble with a copy of WinXP on my laptop. For the past 48 hours my **AV has been finding that winlogon.exe has been infected by W32/PEPatch.N. This appears at start-up and whenever a document is loaded, but otherwise the laptop seemed to work as usual.

I tried searching for info on W32/PEPatch.N but couldn't find any info and **AV had no info either.

This morning when I clicked on 'Heal' within the **AV warning, the system threw up a BSOD saying:

STOP: c0000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of 0x0000034 (0x00000000 0x00000000).
The system has shut down.

I've tried restarting in Safe Mode but the same error appears and the loop continues. I'm thinking a repauir install of XP may be in order to fix a corrupted winlogon.exe.

Any ideas or suggestions would be greatly appreciated.

  • 5 Contributors
  • 10 Replies
  • 677 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by mcportal

Dani AI

Generated

A short, practical summary and recovery checklist for the C000021A / infected winlogon scenario discussed above.

Winlogon (and CSRSS) are core user‑mode processes: if they are removed or fail to start Windows raises a STOP 0xC000021A and halts. Some malware families (“Patched” / PEPatch variants) modify Windows components (winlogon, explorer, etc.) rather than just adding new files; if an AV “heals” by quarantining or deleting a patched system file the machine can become unbootable. This explains why saw an AV detection for W32/PEPatch.N and then a C000021A loop after using the AV heal action. (learn.microsoft.com)

If the goal is to restore a known-good winlogon.exe from your original XP media, the Recovery Console is the standard way to do it (you need the XP CD and the Administrator password). Common, minimal Recovery Console steps (replace D: with your CD/DVD drive letter) are:

map
cd \
cd windows\system32
ren winlogon.exe winlogon.old
expand D:\i386\WINLOGON.EX_ C:\WINDOWS\SYSTEM32\WINLOGON.EXE
# if Setup reports missing DLL functions, also expand MSGINA.DL_ and SHLWAPI.DL_ from the same i386 or ServicePackFiles\i386 location
exit

If your installation has Service Pack files in ServicePackFiles\i386 use those paths instead. The Microsoft article about restoring files from the CD shows this expand/copy workflow and the Recovery Console steps in detail. (ftp.zx.net.nz)

If Recovery Console won’t boot, or you cannot use your keyboard at the “Welcome to Setup” screen (as reported), try a PS/2 keyboard or enable “USB Legacy/Legacy USB Support” in BIOS, or build a bootable recovery/rescue USB from a different machine. Before reattaching the machine to the network, run an offline rescue scanner from a clean bootable ISO (Kaspersky/Bitdefender/AV vendor rescue media) to remove the rootkit component that patched system files; these tools operate outside Windows and are useful when AV in Windows caused the file removal. If the system was used for banking or the infection was extensive, imaging, full reinstall or reformat is the safest option after backing up data. (learn.microsoft.com)

Notes tied to the thread: ’s Last Known Good suggestion is a quick low-risk try but will not help if winlogon.exe was removed; ’s repair/Recovery suggestions are on the right track. If a restore/expand does not bring the system back, save user data from a rescue environment and plan a repair install or fresh install.

Recommended Answers

All 10 Replies

Member Avatar for dcc

Have you tried last known good configuration?

1. Start your computer.
2. When you see the "Please select the operating system to start"
message, press the F8 key.
3. When the Windows Advanced Options menu appears, use the l
ARROW keys to select Last Known Good Configuration (your most
recent settings that worked), and then press ENTER.

Member Avatar for 97320734

Had tried that. Bit the bullet and replaced winlogon.exe with a copy from the WinXP CD and problem solved. Thanks for the advice anyway.

Member Avatar for mcportal

Had tried that. Bit the bullet and replaced winlogon.exe with a copy from the WinXP CD and problem solved. Thanks for the advice anyway.

I know it's been awhilw, but how did you replace winlogon.exe? I am having the same problem. I can't get into anything just blue screen. Thanks for any help you can give.

Member Avatar for caperjack

I know it's been awhilw, but how did you replace winlogon.exe? I am having the same problem. I can't get into anything just blue screen. Thanks for any help you can give.

try this first ,boot the winxp cd and do a repair .at the prompt type in
chkdsk /f
http://support.microsoft.com/kb/315265.

if that doesn't help try a repair install ,

Member Avatar for sittas87

welcome mc
post the BSod code here

Member Avatar for mcportal

try this first ,boot the winxp cd and do a repair .at the prompt type in
chkdsk /f
http://support.microsoft.com/kb/315265.

if that doesn't help try a repair install ,

I am trying to do the repair (I could not run a chkdsk). However, when I get to "welcome to setup" and press continue on my keynoard, nothing happens. I am unable to get past this screen.

Member Avatar for caperjack

I am trying to do the repair (I could not run a chkdsk). However, when I get to "welcome to setup" and press continue on my keynoard, nothing happens. I am unable to get past this screen.

have no idea what to tell you as i have no way of know what you are doing wrong, as only you can see the screen in front of you !!
maybe , time to take it to a person you know who fixes computers
check this ,
http://support.microsoft.com/kb/314058

Member Avatar for mcportal

have no idea what to tell you as i have no way of know what you are doing wrong, as only you can see the screen in front of you !!
maybe , time to take it to a person you know who fixes computers
check this ,
http://support.microsoft.com/kb/314058

During step four of the directions you gave me to repair, one must click the Enter button to continue the Windows setup. However, my keyboard would go dead. It worked up to that point. I got by it anticipating the "Welcome to Setup" screen and immediately started tapping the Enter key in the screen before it.

But now I have another problem. I'm getting error message "SHRegGetValueW could not be located in the dynamic link library SHLWAPI.dll" Any ideas? Thanks for your help.

Member Avatar for sittas87

dude post the Blue screen code here if you want help, thats with the nulls that states for technical support

Member Avatar for mcportal

dude post the Blue screen code here if you want help, thats with the nulls that states for technical support

Blue screen is gone. I've done a repair per directions I received from caperjack. Thanks.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.