winlogon.exe - Application Error

[perplexed]

Six year old Athlon system - originally XP Home upgraded to Professional (six
years ago), Norton antivirus updated regularly and scans run daily; no major
problems or issues until a restart performed Friday evening (3rd) which now
(as have subsequent starts) give the following dialog after successful POST
and the initial windows logo appears:

winlogon.exe - Application Error
The instruction at "0x77edd65" referenced memory at "0x77e8dd65". The
required data was not placed into memory because of an i/o error status of
"0xc000009c".

I've tried booting from the OEM recovery disk, but apparently the drivers
aren't loaded in time for this to happen!

I can't determine, having read various forums, whether this indicates the
presence of malware or an issue with the hard-drive. Any help much
appreciated.

 

[Alias]

Six year old Athlon system - originally XP Home upgraded to Professional (six
years ago), Norton antivirus updated regularly and scans run daily; no major
problems or issues until a restart performed Friday evening (3rd) which now
(as have subsequent starts) give the following dialog after successful POST
and the initial windows logo appears:

winlogon.exe - Application Error
The instruction at "0x77edd65" referenced memory at "0x77e8dd65". The
required data was not placed into memory because of an i/o error status of
"0xc000009c".

I've tried booting from the OEM recovery disk, but apparently the drivers
aren't loaded in time for this to happen!

I can't determine, having read various forums, whether this indicates the
presence of malware or an issue with the hard-drive. Any help much
appreciated.

I would run a check on the hard drive. If you've been using the same
hard drive for six years, there's a good chance it's ready for pasture.

Alias

 

[Thee Chicago Wolf]

Six year old Athlon system - originally XP Home upgraded to Professional (six

years ago), Norton antivirus updated regularly and scans run daily; no major
problems or issues until a restart performed Friday evening (3rd) which now
(as have subsequent starts) give the following dialog after successful POST
and the initial windows logo appears:

winlogon.exe - Application Error
The instruction at "0x77edd65" referenced memory at "0x77e8dd65". The
required data was not placed into memory because of an i/o error status of
"0xc000009c".

I've tried booting from the OEM recovery disk, but apparently the drivers
aren't loaded in time for this to happen!

I can't determine, having read various forums, whether this indicates the
presence of malware or an issue with the hard-drive. Any help much
appreciated.

There's been some changes to the winlogon.exe since SP2 was originally
released and the current version dates from June 2007. I remember in
an earlier incarnation there being a memory leak being addressed and
the current on from http://support.microsoft.com/kb/938375 addresses
some console session issues. Not totally related to you but I'd try
seeing if the updated version from the above KB link helps you.
Otherwise, wait until XP SP3 is released some time in Feb. (this is
the speculative release month, mind you) and hopefully you issue will
be addressed.

You can get the patch free by clicking the link above and then
clicking the link with 6294451 in it. This takes you to a request page
where you enter your product (Windows XP SP2), select the platform
(32-bit), choose English and the language, and then a valid e-mail
address. Then click Submit Request and in a few hours Microsoft sends
you an e-mail link to the file that is password protected but they
include the password in the e-mail. Good luck.

- Thee Chicago Wolf

 

[John B9]

The status code and when it happened is indicative of the computer being
unable to 'page in' the code in order to run. The computer crashed when it
tried to read the code from the disk and it couldn't. Check your event log
for Event ID 9's,11's or 51's all of which mean your disk needs attention.
I end up replacing at least 1 hard drive in my house about every 18 months.

1: kd> !error 0xc000009c
Error code: (NTSTATUS) 0xc000009c (3221225628) - STATUS_DEVICE_DATA_ERROR

0xC000009C, or STATUS_DEVICE_DATA_ERROR, indicates bad blocks (sectors) on
the hard disk.

Since we likely have the same version of files on our computers thanks to
windows update, I took a look at the instruction on my computer and it
crashed when it was simply trying to execute a simple instruction thus
showing that it didn't crash do to a software problem.

0:000> u 0x77e8dd65
rpcrt4!RpcServerUseProtseqEpW:
77e8dd65 8bff mov edi,edi

Recovery in this case is going to be painful since you can't get into your
system. You'll likely need to get a new drive. Then use recovery CD's to
reinstall. The good news is that you can put this drive as a second drive
temporarily to get data off of it in case your backup isn't up to date.

John

 

[perplexed]

Many thanks to 'Three Chicago Wolf' and 'John B9' for constructive analysis
of my little dilema.

I also did a bit more searching and found an MS Windows2003 technical
document (apologies, I've not got access to the actual link at this time to
quote it) - Chapter 10 - Troubleshooting Stop Errors". So, "... x77
indicates that a page of kernel data requested from the paging file could not
be found or read into memory. This stop can also indicate hardware or
possible virus infection." However, as my error is qualified by the
'xc000009c' code, which "generally indicates bad blocks (sectors) on the hard
disk" - it is looking like a failing drive - as Alias said all along. And,
as has been pointed out, I've done well for it to last six years!
Now the fun begins, resurrecting it as adivised.

 

[linuxuser]

[Though this thread is ancient it is a main google hit for this issue, so I
post a solution below.]

winlogon.exe - Application Error
The instruction at "0x77edd65" referenced memory at "0x77e8dd65". The
required data was not placed into memory because of an i/o error status of
"0xc000009c". ....
I can't determine, having read various forums, whether this indicates the
presence of malware or an issue with the hard-drive. Any help much
appreciated.

I just had the same problem after installing XP SP3, also with a very old
HD. The solution for me was to boot into the recovery console and run:

chkdsk /p /r

It took over an hour (for a ~20GB laptop disk) but did move whatever
winlogon.exe wanted onto good sectors and the machine works fine now.
(Though I should change HD ASAP.)