blue screen with an event error

[Guest]

lately i keep getting a blue screen with the following message

STOP: c000021a Fatal System Error
Windows Logon Process System process terminated unexpectedly with a status
of 0xc000005 (0x00000000 0x00000000) system has been shut down

Nothing is logged in the even mamager under system but under applications
the following error is listed

Application Error
Category (100)
Event ID: 1000
Faulting application , version 0.0.0.0, faulting module k4jsle171h.dll,
version 0.0.0.0, fault address 0x0001393c.

i read somewhere that the stop error was coming from my DCOMs so those are
now off and the blue screen stopped coming for a few days but now it's back.
i can't figure out the application error because it's not telling me what
application it is. please help!!!!!

 

[Will Denny]

Hi

Please try the following link to Jim Eshelman's web site - left hand
column(21A):

http://aumha.org/win5/kbestop.htm

 

[David Candy]

What makes you think the two errors are related. Is the time the same? Your app error looks like a virus. See if the file (virus?) is mentioned under here (type regedit in Start Run)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Especially ensure that there is no value named GinaDLL. If there is post back the data for that named value.

Also see
http://66.102.7.104/search?q=cache:...s+Logon+Process"+XP+&hl=en&start=3&lr=lang_en

If you haven't installed SP1 or SP2 see

http://66.102.7.104/search?q=cache:...s+Logon+Process"+XP+&hl=en&start=1&lr=lang_en

Bug Check 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED
The STATUS_SYSTEM_PROCESS_TERMINATED bug check has a value of 0xC000021A. This means that an error has occurred in a crucial user-mode subsystem.
Parameters
This bug check will display a descriptive text message.
Cause
This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Runtime Subsystem (CSRSS), has been fatally compromised and security can no longer be guaranteed. In response, the operating system switches to kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is one of the few cases where the failure of a user-mode service can shut down the system.
Mismatched system files can also cause this error. This can occur if you have restored your hard disk from a backup. Some backup programs might skip restoring system files that they determine are in use.
Resolving the Problem
Running the kernel debugger is not useful in this situation because the actual error occurred in a user-mode process.
Resolving an error in a user-mode device driver, system service, or third-party application: Because bug check 0xC000021A occurs in a user-mode process, the most common culprits are third-party applications. If the error occurred after the installation of a new or updated device driver, system service, or third-party application, the new software should be removed or disabled. Contact the manufacturer of the software about a possible update.
If the error occurs during system startup, restart your computer, and press F8 at the character-based menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time. If this does not resolve the error, try manually removing the offending software. If the system partition is formatted with file allocation table (FAT), use an MS-DOS startup disk to gain access to the computer’s hard disk. If the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty software. If the faulty software is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file. If a newly installed piece if hardware is suspected, remove it to see if this resolves the issue.
Try running the Emergency Recovery Disk (ERD) and allow the system to repair any errors that it detects. Resolving a mismatched system file problem: If you have recently restored your hard disk from a backup, check if there is an updated version of the Backup/Restore program available from the manufacturer. Make sure the latest Windows Service Pack is installed.

 

[Ron Martell]

lately i keep getting a blue screen with the following message

STOP: c000021a Fatal System Error
Windows Logon Process System process terminated unexpectedly with a status
of 0xc000005 (0x00000000 0x00000000) system has been shut down

Nothing is logged in the even mamager under system but under applications
the following error is listed

Application Error
Category (100)
Event ID: 1000
Faulting application , version 0.0.0.0, faulting module k4jsle171h.dll,
version 0.0.0.0, fault address 0x0001393c.

i read somewhere that the stop error was coming from my DCOMs so those are
now off and the blue screen stopped coming for a few days but now it's back.
i can't figure out the application error because it's not telling me what
application it is. please help!!!!!

A Google search of both web sites and newsgroups fails to turn up a
single reference (other than your posting) to any file named
k4jsle171h.dll

That immediately leads to the suspicion that your computer has been
infested by a virus or spyware product of some sort.

Make certain your antivirus software is completely up to date with the
virus definitions not more than a week old and do a complete virus
scan of your hard drive. Then get a "second opinion by doing a free
on-line virus scan at one of the following sites:
http://housecall.trendmicro.com
http://www.pandasoftware.com/activescan/
http://www.ravantivirus.com/scan/


To check for possible spyware use MVP Jim Eshelman's free online
spyware check at http://aumha.org/a/noads.htm and then use his Spyware
Quick Fix procedure at http://www.aumha.org/a/quickfix.htm to clean it
up.

Good luck



Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

In memory of a dear friend Alex Nichol MVP
http://aumha.org/alex.htm

 

[Guest]

ok i went to winlogon but wasn't sure what to look for (i am not
knowledgeable in the regedit at all) but the ginadll file wan't in there.

i haven't installed anything recently that i am aware of. am running
windows XP and i have already updated the explorer service pack to deal with
this as well. my computer updated on it's own and installed SP2 so maybe that
is causing some issues but i didn't even know it was on there until i started
having problems and looking to see if it needed to be updated.