Home

Download

Order

Support

?

All worked well till the Monday when he saw how his computer reboots every time when the Windows started. The computer passed the first boot phase when the "Windows XP" message is displayed on the black background. But when the computer tried to go to the graphic mode it is immediately rebooted.

I pressed F8 during boot and tried "Last known good configuration".

No luck.

Safe mode do not work too.

After that I choose the option to stop on errors to avoid auto restart and I can see the message typical BSOD message.

STOP: c000021a {Fatal System Error} The windows Logon Process system process terminated unexpectedly with a status of 0xc0000142 (0x00000000 0x00000000). The system has been shut down.

I made the search in the Windows XP DDK headers.

Wow!

Now I found the source of the problem. Winlogon.exe could not start because it could not load the one or more linked DLLs. These may be if the DLLs were recently changed. I created the list of the DLLs linked to the Winlogon.exe. It was the large list. I made the new installation of the Windows XP to the same disk to the Windows.0 folder to get access to the hard drive. Another way is using Windows PE CD (Bart PE or WindowsLive).

After that I checked the sizes and versions of the DLLs from my computer. I found that 3 difference:

1. Gdi32.dll
2. Msvcrt.dll
3. Comctl32.dll

I replaced these DLLs in the Windows\System32 folder and reboot.

Windows started successfully!

I thought that my friend installed some software that can changed the DLLs. However he didn't remember this fact.

But today I saw the same error on the computer in our local network. No software has been installed. Only Windows updates.

Now I found only 2 changed files:

1. Gdi32.dll
2. Msvcrt.dll

Anyway if you need a way to fix it without reinstalling Windows us this article.

Suggest you to use RegRun Platinum Edition to be sure that your rootkit's clear!

Good luck!

Would you like to add your opinion?