Topic: Hello All - and first post...hope its a good 'un

...well, hello - I discovered you lot through googling for some help/advice/valium for a "blue screen" problem.

Its a DELL (don't leave just yet!!) Inspiron 9300 - XP Pro, 2Gb RAM,- and has happily flashed/photoshopped/bryced & posers for about 2.5 years. Am normally not *too* bad at keeping updates etc, well - up to date...but Saturday night I got the dreaded "blue screen" as I shut down. The error message is a STOP: c000021A, etc - "Windows logon process failed...." Ive googled, and come up with a few thoughts - but like I said, I just make pictures really. Here's some info

It appears its a WINLOGON.exe fault, but Im told this could also be a virus (I run AVG daily) -
I recently unistalled several unused programs (and to make way for new ones) & ran a reg cleaner afterwards.
I went through my event viewer and found lots of pretty red crosses referring to "Security Centre 1800" and "Application Error 1000" - aha! (not)
Ive run RegCure, Registry Healer, PerfectDisk - makes no difference.
My programs run ok - so far.
I noticed previously that my laptop gets very hot where the screen meets the keyboard - a friend told me about DELL laptop batteries, but my serial wasnt included - so I make sure the fans are clear and try not to "stress it" with massive image renders etc....
Im blonde & dyslexic and stuck...

Any ideas? Advice? Valium?
Scotia

Id tell you the meaning of life, I discovered it some time ago but sadly forgot to write it down.

...oh, and when I ran AdAware's log I found this -


#:2 [winlogon.exe]
FilePath : \??\C:\WINDOWS\System32\
ThreadCreationTime : 04-03-2007 20:47:25
BasePriority : High

Which kinda looks like it cant find the path to WINLOGON? - of so, how do I "put it back"?
Thanks!

Id tell you the meaning of life, I discovered it some time ago but sadly forgot to write it down.

found this: http://support.microsoft.com/kb/156669

and this:

quote:

---

The STOP 0xC000021A error occurs when either Winlogon.exe or Csrss.exe fails. When the Windows NT kernel detects
that either of these processes has stopped, it stops the system and raises the STOP 0xC000021A error.

Most STOP 0xC000021A errors occur because Winlogon.exe fails, which typically occurs because of a faulty third-party
Graphical Identification and Authentication (GINA) DLL. The GINA is a replaceable DLL component that Winlogon.exe
loads. The GINA implements the authentication policy of the interactive logon model. The GINA performs all identification
and authentication user interactions.

It is very common for certain types of remote control software to replace the default Windows GINA DLL (Msgina.dll).
Therefore, a good first step is to examine the system to see if it has a third-party GINA DLL. To do this, locate the following
registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Value = GinaDLL REG_SZ

- If the Gina DLL value is present and is anything other than
Msgina.dll, this probably means that a third-party product has changed
this value.

- If this value is not present, the system uses Msgina.dll as the
default GINA DLL

---

Nature & Travel Photography
Visit the Sleeping Wolves

When you finish i strongly recommend you buy Norton Ghost.

(Edited by SleepingWolf on 03-05-2007 00:02)

Hey Sleeping Wolf - thanks for your reply - lol, yip - I found those too, I tried to find the reg key, but got as far as CURRENT VERSION then couldnt find the WINLOGON at all - (Ive probably messed something up whilst looking!) Again, even if I do find this GINADLL, Im still unsure as to how to correct it, or return it to its original value?


ok - I found the REGEDIT value for WINLOGON (I think) and it states "value not set" - for the "default value", I noticed further down the columns it only has REG_SZ until it reaches UIHost - where it has REG_EXPAND_SZ

Any further ideas? - Thanks!



Scotia

Id tell you the meaning of life, I discovered it some time ago but sadly forgot to write it down.

(Edited by scotia2k7 on 03-05-2007 00:24)

Your system sounds pretty badly compromised. If you can read your registry, you can obviously boot, so I would backup all my data files and do a clean install - format and reinstall os and all apps.

I would also ensure I Ghost the system - once ghosted you can restore a system in a few minutes (with the exception of any driver changes and new installs etc that were made after the ghost).

It doesn't sound like a virus or malware..more likely your registry cleaner and the uninstalls screwed up your registry.

Did you try everything in the KB article?

Nature & Travel Photography
Visit the Sleeping Wolves

quote:

---

scotia2k7 said:

but got as far as CURRENT VERSION then couldnt find the WINLOGON at all

---

make sure you are looking at Windows NT and not Windows

if you still can't find it, go the top menu of Regedit and use Edit Find and look for Winlogon.
It has to be there.

Nature & Travel Photography
Visit the Sleeping Wolves

Grr - its hellish to hear its "badly compromised" - since I only run my graphic programs, ie, deepnet (browser only I dont do P2P) - I didnt get a restore disk when I bought my system from DELL, but that should be easy to get from them, since I have all my purchse info, and my software is all legit - Its cr*p to think that a registry cleaner can muck things up - Ive always used the same one previously, with no issues - until the blue screen death when I bought RegCure (which doesnt actually correct everything it says on the box) -

I uninstalled some older versions of Flash/Fireworks/Dreamweaver via control panel add&remove.
Nope - Ive not tried everything in the KB, since some of it sounds too scary for a "late night effort" - Id never sleep! lol, Im not sure how to ghost my system, but I can read up on it (god loves a trier!) -

Its just odd that everything "seems" to be working fine, until I shutdown, then the system errors, and hangs - then I have to hold down the on/off to get it to shutdown.
Interestingly - the laptop hasnt been getting as hot today - ?...every cloud!

Scotia

Id tell you the meaning of life, I discovered it some time ago but sadly forgot to write it down.

Greets, and welcome to the Asylum!

One question - have you tried a Cleanboot yet, and then powered down the Lappie?

I would be interested if the error occurs then.

Simply go to Run, type in msconfig, then check user defined boot - and remove the checks by Sys.ini, Win.ini, and System Startup Elements. Then click on the Services tab, and put a check on All microsoft services unseeable (sorry, I am using a german version of MS, so I am not sure what they are called exactly), then deactivate all the rest.

Then accept and do a new start.

See if that returns the error.

WebShaman | The keenest sorrow (and greatest truth) is to recognize ourselves as the sole cause of all our adversities.
- Sophocles

Two things you might try:

1) Run the protected system files checker. I use the command "SFC /purgecache /scannow" with the Windows OS installation CD in the drive. This should at least discount the possibility of a corrupted/unofficial system file.

2) Try switching off "Serial Number Generation" or "Ser# Generation" in your BIOS. I have had similar BSoD on shutdown problems with HP laptops and towers. Specifically, if I have a network card installed (3Com 10/100, for instance) and this option is enabled in the BIOS, the machine blue-screens on shutdown.

Just a stab in the dark...

Hey folks - thank you to White Hawk and Webshaman too - I really appreciate the time you give yer newbies! - ok, I went through regedit with a fine toothcomb, and googled "for hours" lol, after all that I got angry with it - told it Id sell it on eBay for a fiver, and ran my main RegHealer, Defragger and so far, so good - fingers crossed - its been fine since - however, Im not convinced its going to stay that way - but at least Ive backed everything up and phoned Dell for a recovery/re-install disc -
AND I have all this brilliant advice and suggestions for future use! - (also - I Dysoned the fans, checked the battery connections)
maybe it was a combination of things - ???

Im really going to enjoy the diversity and friendliness of this forum - and hopefully I can give a fair bit back -

Thanks again for now - Im off to see who I can help out!

Scotia

Id tell you the meaning of life, I discovered it some time ago but sadly forgot to write it down.

quote:

---

after all that I got angry with it - told it Id sell it on eBay for a fiver

---

I always find that threatening my computer seems to sort things out. In fact at work, most problems my coworkers have with their computers magically fix themselves as soon as they call me. The going theory is that the computers know I'm not going to be gentle with them if I have to come over.

S'funny, but I take the opposite approach. Honestly! Sweet talk your machine, man; you'll get much better mileage.

Once in a while if the PC just refuses to comply, give it a thump - maybe two - and wait a moment to let it cool down and think about its behaviour before powering it up again. Percussive maintenance should only be administered sparingly of course, and as a last resort, but many a technician would swear by it.



Addendum: Just remembered - BSoD on shutdown was with any D-Link wireless adapter; PCMCIA/PCI on HP laptop/PC. It was very specific and never happened with 3Com cards. Apologies for the inaccurate information in the above post.

(Edited by White Hawk on 03-05-2007 23:58)