Fatal System error after installing patches

[David Sherman]

Error message:


"STOP: c000021a {Fatal System Error}
The WIndows Logon Process system process terminated unexpectedly with
a status of 0xc0000018 (0x00000000 0x00000000).
The system has been shutdown."

The following links can't correct it:


"0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED"
http://aumha.org/win5/kbestop.php#0x21a

http://support.microsoft.com/default.aspx?scid=kb;en-us;156669


What casued it:
Installing the last five patches from Microsoft. On reboot, I get the
error message.
1. I can't boot in normal mode
2. I can't boot in safe mode

Questions : Can i use NTFS4DOS and uninstall the KB that were
installed?
The KB's were 883939,896422,883939,896358,890046,893066.
901214,898461,898461,903235,893086,896428 and 890859.

It has been a while so I installed the patches on these machine or
should I use the recovery console.

thanks

 

[Michael T]

The STOP 0xC000021A error occurs when either Winlogon.exe or Csrss.exe
fails. When the Windows NT kernel detects that either of these processes
has stopped, it stops the system and raises the STOP 0xC000021A error.


To troubleshoot this problem, you must determine which of these processes
failed and why.


To determine which process failed, register Dr. Watson as the default system
debugger (if it is not already the default debugger). Dr. Watson for
Windows NT logs diagnostic information about process failures to a log file
(Drwtsn32.log). Also, you can configure this program to produce memory dump
files of failed processes that you can analyze in a debugger to determine
why a process fails.


To set up Dr. Watson to trap user-mode program errors, follow these steps:


1. At a command prompt, type "<System Root>\System32\Drwtsn32.exe -I"
(without the quotation marks), and then press ENTER. This command
configures Dr. Watson as the default system debugger.


2. At a command prompt, type "<System Root>\System32\Drwtsn32.exe" (without
the quotation marks), and then select the following options:
"Append to existing log file"
"Create crash dump"
"Visual Notification"


3. After the computer restarts from the STOP 0xC000021A error, run Dr.
Watson (Drwtsn32.exe).


4. View the Dr. Watson log to determine what user mode process may be
causing the problem.


5. If the Dr. Watson log does not contain enough information to determine
the cause of the problem, analyze the User.dmp file to determine the cause
of the STOP 0xC000021A error.


If Dr. Watson did not create a User.dmp file for either Winlogon.exe or
Csrss.exe, you may have to use a different tool to generate a memory dump
file of the process that fails.


For additional information, click the article number below to view the
article in the Microsoft Knowledge Base:
241215 How to Use the Userdump.exe Tool to Create a Dump File
http://support.microsoft.com/?id=241215


NOTE: Follow the instructions in the Knowledge Base article to troubleshoot
"a process that shuts down with an exception". While you follow these
instructions, monitor the following processes to troubleshoot the STOP
0xC000021A error:
- Winlogon.exe
- Csrss.exe


NOTE: Most STOP 0xC000021A errors occur because Winlogon.exe fails, which
typically occurs because of a faulty third-party Graphical Identification
and Authentication (GINA) DLL. The GINA is a replaceable DLL component that
Winlogon.exe loads. The GINA implements the authentication policy of the
interactive logon model. The GINA performs all identification and
authentication user interactions.


It is very common for certain types of remote control software to replace
the default Windows GINA DLL (Msgina.dll). Therefore, a good first step is
to examine the system to see if it has a third-party GINA DLL. To do this,
locate the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Mi­crosoft\Windows
NT\CurrentVersion\Winlogon
Value = GinaDLL REG_SZ


- If the Gina DLL value is present and is anything other than Msgina.dll,
this probably means that a third-party product has changed this value.


- If this value is not present, the system uses Msgina.dll as the default
GINA DLL.


--

Michael

 

[Michael T]

Not sure my previous post is all that applicable to Windows XP (as opposed
to WinNT).

So I would suggest this web page instead.
http://support.microsoft.com/?kbid=318666&sd=RMVP

 

[Michael T]

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prmd_stp_fvlq.asp

 

[David Sherman]

Your answer and Microsoft presumes that a user can "get to Dr.
Watson". Since I can't get there, the choices that I have since (1)
safe mode and (2) last known configuration don't work is to reformat
the hard drive or try a repair. Either option is a no go uless I do
only one patch at a time to determine with patch fails. Also ERD 2005
was of no help since thiere vare no dump reports to look at.

Dr. Watson assumes that the user is boted into Windows since Dr.
Watson doesn't run in Dos.

 

[David Sherman]

Machine is question is a test machine that tests Windows XP.. XP and
all it is patches have been installed about every 2 months so every
thing was fine 2 months ago.

 

[David Sherman]

http://support.microsoft.com/default.aspx?scid=kb;en-us;902093

According this KB, I have attached the windowsupdatelog for this
machine. I don't see where Windows had an error.

thanks

 

[David Sherman]

http://support.microsoft.com/default.aspx?scid=kb;en-us;902093

According this KB, I can't see where Windows failed. I would attach it
but it is too large to send.

I can't see where any entry had a fatal error.

 

[Guest]

Howdy:

Found the following.. suggest you give it a try..

The newest Critical Patches can be the reason for the error, please
uninstall KB893066, KB890923, KB890859 and KB893086

----------------------------------------
Please follow the procedure suggested by microsoft to solve BSOD
problem from the latest windows update.

1. Insert the Windows XP startup disk in your floppy disk drive or
insert
the Windows XP CD in the CD drive or in the DVD drive, and then restart
your computer.

Note When you receive the following message, press a key to start your

computer from the Windows XP CD:
Press any key to boot from CD

Note Your computer must be configured to start from the CD drive or the
DVD drive.
For more information about how to configure your computer to start from
the CD drive or the DVD drive, see the documentation that came with your
computer or contact the computer manufacturer.

2. When you receive the Welcome to Setup message, press R to start the
Recovery Console.
Note Multiple options will appear on the screen.

3. Select the Windows XP installation in question.
Note You must select a number before you press ENTER, or the computer
will restart. Typically, only the 1:
C:\Windows selection is available.

4. If you are prompted to type an administrator password, do so. If you
do not know the administrator password, press ENTER. (Typically, the
password is blank.)

Note You will not be able to continue if you do not have the
administrator password.

5. At the command prompt, type cd $ntuninstallKB.........HERE THE
NUMBER OF THE PATCH.....$\spuninst, and then press ENTER.

Note After you complete this step, you cannot stop the removal
process.

6. At the command prompt, type batch spuninst.txt, and then press
ENTER.

7. After the Ptach is removed, type exit, and then press ENTER oo
Uninstall the Next

please uninstall
KB893066
KB890923

KB890859
KB893086