Can't access windows *Fixed*

[Khalil]

Yesterday and last night i recieved about 30 phone calls from friends and business colleagues.
They are all having the same exact problem.
Their systems are going on a reboot cycle. They can't get into windows, the machine attempts to go into windows, you get the splash screen then it reboots. Several brought me the machines and I tried to get in to no avail, I can't even get into safe mode.
Only 3 of them were machines I built the rest are Dells, HPs eMachines and other brands.
Anyone has any idea whats up with this and why this is happening?

[glc]

If they have XP SP2, get to the boot screen and choose disable restart on error and see what the bluescreen says.

[Khalil]

Originally Posted by glc If they have XP SP2, get to the boot screen and choose disable restart on error and see what the bluescreen says.

How do I disable restart on error? is that from the Bios? And yes I am sure they all have SP2

[Cricket]

Hit and hold the Windows key (between the Ctrl and Alt keys) and then hit the Pause/Break key. In the box that pops up click on the Advanced tab. Click the Settings button in the Startup and Recovery box. In the System Failure box, uncheck the option to Automatically Restart.

Cricket

[Khalil]

Ok I tried that but all I am getting is a message saying:
Scan Devices, Please Wait.....
30 minutes and still stuck at that message

[Cricket]

At what exact point are you getting that message? After you hit the Windows and Pause/Break keys? After the System Properties box pops up? When?

Can you access the System Properties box from Safe Mode?

Cricket

[Khalil]

I tried doing it when the Asus splash comes up, I tried when the system info screen comes up and I tried while windows XP splash screen is up non of them worked.
I cannot access safe mode at all.

[glc]

Cricket - he CAN'T get INTO Windows.

What I said is a selection on the boot screen - the one that has Safe Mode and all the other stuff. SP2 added that choice.

[Khalil]

Originally Posted by glc Cricket - he CAN'T get INTO Windows. What I said is a selection on the boot screen - the one that has Safe Mode and all the other stuff. SP2 added that choice.

Ok here is the full error message:
STOP c000021a {fatal system error}
The windows logon process system process terminated unexpectedly with status of
0xc0000034 (0x00000000 0x00000000)
The system has been shut down.
its the same message I am getting on all 4 machines.

[juppy]

Well, here's what Microsoft has to say about that error number.

http://support.microsoft.com/kb/317189

EDIT: Just out of curiosity, did you try booting from the XP cd and doing a Repair?

[Khalil]

Yes I saw that already thanks but that is for windows NT not windows XP professional with SP2.
Typical Microsoft BS. I know of over 50 people who have called me just in our area out here with this exact same problem.

I have tried all the options and found this article at the MS forums but nothing is working
http://msdn2.microsoft.com/en-us/library/ms797159.aspx

How can so many computers have the same problem at the same time?
Microsoft's telephone support is non existant.

[glc]

I would suspect they may all have been hit with a virus. Pull a drive and slave it into your bench and see what you can do with it.

[Khalil]

Originally Posted by glc I would suspect they may all have been hit with a virus. Pull a drive and slave it into your bench and see what you can do with it.

I am going to run clamwin on them as slaves and see what happens. That would be some wicked virus.

[Cricket]

Originally Posted by glc Cricket - he CAN'T get INTO Windows.

Oops...sorry about that. I wasn't completely awake when I read this thread...I basically only saw "disable restart on errors" and posted a response.

Cricket

[Khalil]

First machine had 119 viruses, several of them were worms. How da heck do these people get so many viruses?
I don't have the machines here at home i just brought the hard drives to scan, I will test them in the morning once I have removed all the viruses.

[kev7555]

Usually starts with one trojan, and then it connects to bring in more which connect to bring more, etc, etc...

It doesn't take long.

[Cricket]

What kind of security software are they using?

I remember someone doing an experiment a few years ago where they took a completely unprotected computer and surfed the net to see how long it would take before the computer got messed up. With a broadband connection I think it only took 7 minutes before the computer started to act strange and 15 minutes before it was almost unusable.

Cricket

[kev7555]

I did it last year, Cricket. It took about five minutes to get screwy and about 20 to become virtually useless.


-Kev

[Khalil]

Originally Posted by Cricket What kind of security software are they using? Cricket

The machine I got done scanning had Ca on it. the Ca quarantine folder was empty
Clamwin found all those viruses. I have had no virus issues since I started using clamwin on all my 30+ machines I own.
I found out about it around 18 months ago from the pcmech email newsletter we get.
It uses hardly any system resources and keeps my systems clean.

[kev7555]

Clamwin is only anti-virus software. Are you running anti-spyware scanners, spyware blocking programs? Firewall?

Are any of the 30+ machines you mentioned ones that are infected with this problem?



-Kev

[Khalil]

Originally Posted by kev7555 Clamwin is only anti-virus software. Are you running anti-spyware scanners, spyware blocking programs? Firewall? -Kev

I will run Microsoft Defender on them, I like it alot it works very well for me. None of my 30 machines are effect by this problem. Those are other people's computers.

[kev7555]

Yes, or AVG anti-spyware works well also.

-Kev

[Khalil]

Originally Posted by kev7555 Yes, or AVG anti-spyware works well also. -Kev

Don't you have to pay for that after the trial is up? Grats on 1000 posts btw

[kev7555]

Wow! I didn't even notice the posts counter... thanks!

Yeah I think AVG antispyware is still free after 30 days it just doesn't have all the features of the full version.

I'm still just testing it. I've never had any problems using the other programs in my sig.

[Khalil]

Originally Posted by kev7555 Wow! I didn't even notice the posts counter... thanks! Yeah I think AVG antispyware is still free after 30 days it just doesn't have all the features of the full version. I'm still just testing it. I've never had any problems using the other programs in my sig.

That is a lot of software running on your computer. Don't you lose performance running all that?

[kev7555]

A lot of software????

One AV program, one spyware blocking list and two or three scanners?

A HJT log on my computer looks like this:

Logfile of HijackThis v1.99.1
Scan saved at 10:19:41 AM, on 3/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Kev\Desktop\Security\HJT\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe


No, that is not a lot of software, none of it uses hardly any resources and I never have malware issues.

I run the same security package on all of my customer's computers.

-K

[Khalil]

I am surprised you did not have problems with Spybot.

[Cricket]

Originally Posted by kev7555 I did it last year, Cricket. It took about five minutes to get screwy and about 20 to become virtually useless.

I think I read it on another web site, not this one. I remember it being a security article and the page had red or brownish red boarders on the top and sides. But your experiment verifies just how dangerous it is to surf the net with an unprotected computer.

Cricket

[Khalil]

Ok folks I got it fixed and I am gonna share it with all of you.
I went back to the office and hooked that hard drive back in the machine but it woudln't finish booting, just like it was before.
I went into the system32 folder through the recovery console and found that winlogon.exe was missing. I used the recovery console to expand it from my windows XP professional CD.
Here is what I typed at the command prompt

expand d:\i386\winlogon.ex_ C:\windows\system32

woohoo the machine booted perfectly after that.
I did it again on 2 other machines that had windows xp home using an xp home CD and guess what!!! It worked with flying colors.
I hope this comes in handy to anyone who may have this problem.
Note: when I went back in the machine I actualy found that Ca was set up to remove and it had for some reason removed winlogon.exe which your machine cannot boot without it.

[kev7555]

Uh, isn't winlogon.exe related only to windows update?

I've deleted it from my HJT logs many times with no problems...


- K