# [SOLVED] 'Stop: c000021a {Fatal System Error} - Status 0xc0000022'; on Startup



## Buckeye80 (Sep 24, 2010)

Yesterday, our computer around 6PM got a fake antivirus virus that popped up and installed automatically. I went and removed it off my computer. That one was called "Malware Doctor". Later, about 2 hours later, I got another one that popped up on my task bar called "Antivirus 2010". That one didnt install and I removed it. Today i started up our computer, and I got Antivirus 2010 again. I exited out of it, and removed it. Then I could not access the internet via Google Chrome, so i tried AOL. AOL worked, but it was freezing as always. I decided to restart my modem and my computer. 

When I turned it on, It would go past the XP screen and continuously reboot. I then hit F8 many times, and got the menu(not sure what its called) and make it so it would not auto-reboot on system failure. I then got this error on a blue screen when i booted and had it set to not auto-reboot:

Quote:
c000021a {Fatal System Error}
The Windows logon process system process terminated unexpectedly with a status o
f 0xc0000022 (0x00000000, 0x0000000)
The system has been shut down. 
I do not have a XP installation disc, or any other windows recovery discs. Booting into safe mode doesnt work, or the other start options. I am using Ubuntu 10.04 LTS to access the internet. How may I go about fixing this?


----------



## OldGrayGary (Jun 29, 2006)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Hi Buckeye80

Here's a blurb from aumha.org, Jim Eshelman's "Windows Support Center" website:

Stop 0xc000021a:


> This occurs when Windows switches into kernel mode and a user-mode subsystem, such as Winlogon or the Client Server Runtime Subsystem (CSRSS), is compromised. Security can no longer be guaranteed. Because Win XP can’t run without Winlogon or CSRSS, this is one of the few situations where the failure of a user-mode service can cause the system to stop responding. This Stop message also can occur as a result of malware infestation or when the computer is restarted after a system administrator has modified permissions so that the SYSTEM account no longer has adequate permissions to access system files and folders.


For your system, it's Winlogon that can't clear the hurdle.
__________

Usually, clearing this up would take two steps:
1) Clean-booting with a CD/DVD-based operating system and performing malware removal.
2) Performing a Repair installation of Windows XP (& afterwards updating Windows and antimalware software).
__________

Why not use the AVG bootable CD to clean up the malware. It boots a lean Linux & allows AVG to update it definitions. You can then scan your partitions for malware & delete what you can. http://www.avg.com/us-en/avg-rescue-cd 

If your make/model came with an operating system disk, you might be able to order one from their support website. The price is usually reasonable -- sometimes as low as $20. If you can acquire a Windows-XP operating system disk that exactly matches the version of the current installation, you can perform a Repair install. With a repair install, you usually don't have to reinstall all your programs, and your personal data usually isn't lost. Full details on the Repair install process are available on the WindowsReInstall website -- http://www.windowsreinstall.com

If your model came with just a Recovery Disk, you can probably order a replacement (at the same price as just mentioned above). Once you have your new Recovery Disk in hand, you probably still won't have the option to Repair install, and may have very few options - or none at all -- but at least you can get Windows installed and working again. Many Recovery Disks only offer to completely erase the system partition and reinstall the factory-original hard disk image (all personal data and programs added since the PC was purchased disappears -- all of that must be restored from backups -- if you have any). Recovery Disks tend to stay available for purchase for a long time from the major vendors.

You can make backups of your data (once they are cleaned of the malware), by either using a bootable CD/DVD & copying the data to removable media, or by connecting the hard drive to another computer (either internally or externally - and making sure NOT to boot from the drive while connected to the helper PC --- and copying the data to removable media.

It is sometimes possible to Repair a Windows installation using an XP CD from another computer, so long as that computer is running the same version of XP (for example, "Home" or "Professional"). But to keep the original XP license can require a phone call to MIcrosoft, so that the original key can be used, or so that an alternate key can be acquired so that Windows XP can be re-activated.
_____________
_____________

Best of luck
. . . Gary


You could simply clean and clean and clean with a few bootable disks [like the AVG CD, then perhaps a UBCDforWin disk, and run a few scans usings several of the different anti-malware tools included on the CD (or DVD)] --- and hope that Windows could safely boot after all that cleaning -- before moving to the reinstall route.


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*



OldGrayGary said:


> Hi Buckeye80
> 
> Here's a blurb from aumha.org, Jim Eshelman's "Windows Support Center" website:
> 
> ...


Thanks for all your time and help! I installed the AVG Rescue CD on a 1GB Flash Drive. I downloaded the USB named ZIP file on the AVG site(3rd one on the list) onto the root of my flash drive. I then used a neighbors computer to run "makeboot.bat", and it installed the stuff onto the USB drive. It did say access denied to one thing when it was installing - It was something like "avg update files or something". It then said AVG Rescue CD complete, press any key to exit. I then went on my PC and hit F2 on startup to edit the BIOS. I made it so it would boot the USB drive. When i restarted my computer i got the error during the boot of the USB..."Missing Operating System".

I don't know why it keeps saying that, is there any way to get the rescue CD to work?


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*



Buckeye80 said:


> Thanks for all your time and help! I installed the AVG Rescue CD on a 1GB Flash Drive. I downloaded the USB named ZIP file on the AVG site(3rd one on the list) onto the root of my flash drive. I then used a neighbors computer to run "makeboot.bat", and it installed the stuff onto the USB drive. It did say access denied to one thing when it was installing - It was something like "avg update files or something". It then said AVG Rescue CD complete, press any key to exit. I then went on my PC and hit F2 on startup to edit the BIOS. I made it so it would boot the USB drive. When i restarted my computer i got the error during the boot of the USB..."Missing Operating System".
> 
> I don't know why it keeps saying that, is there any way to get the rescue CD to work?


Just to help you guys out to help me...I went to a friends and installed a .iso of Windows Recovery Console. So now, if there is anything that Windows Recovery Console can do to help, we now have that option.


----------



## OldGrayGary (Jun 29, 2006)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Hi again

If your computer has a CD drive, it's generally much easier to download the .iso file, and use a CD/DVD recording program to burn it as a bootable image to a CD. In Nero, it's in the Advanced section, "Burn Image to Disk". (I would imagine the Linux recording tools can manage to burn an image too). Then set the Bios of the infected computer to boot from CD first, and the system should boot directly into the AVG Rescue CD environment. If you have a wired ethernet connection to the Internet available, AVG can find that connection automatically & download the latest updates. You then go through the menus and choose to scan.

The AVG Rescue CD is mainly a virus-removal tool. I suggested it's use as a first step to take before using a Windows CD to perform a repair install. 

The "operating system not found" message suggests that something when wrong when you were creating the AVG bootable USB drive.
_______________

Why not try again, this time with a bootable AVG Rescue CD -- as booted from it in its bootable CD form (rather than from a USB flash drive). Let it clean what malware it finds, and then start working on the repair of Windows.

For a first try, see if you can boot into Safe Mode with Command Prompt. [You might need to set your bios to boot from the hard drive first.] ... You mentioned that you couldn't boot into Safe Mode earlier - but perhaps the more limited Safe Mode with Command Prompt might succeed. You will probably have to be pretty lucky for this to work, but it can't hurt to try. If you can boot to the Safe Mode command prompt, try starting a System Restore from there --- making sure to choose a restore point from BEFORE the appearance of the rogue antivirus attacks. To start System Restore from a command prompt, type *C:\windows\system32\restore\rstrui.exe* and then press the Enter key.
_______________

If Safe Mode / Safe Mode with Command Prompt / and System Restore all fail to work, your easiest course for a repair would seem to be to acquire a Windows-XP installation CD to run a repair from. A Recovery Disk is another option, but you'd have to try and save your personal data from the hard drive beforehand.

I'll hope for the best -
. . . Gary


P.S. .... you'd asked about using the Recovery Console. While it is handy for many repairs, I can't see a way of using it in this case -- at least not yet. Here's a link, though, to a fairly thorough description of it's tools: http://support.microsoft.com/default.aspx?scid=kb;EN-US;314058


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Thanks for your help again!

I found that Ubuntu 10.04 LTS has a program built in called Brasero Burner. I was able to burn the AVG Rescue CD to that very easily. I then booted the AVG CD. I set it up to scan all partitions. 

Here is what i found:

/mnt/sda2/documents and settings/end_user/application data/Mozilla/Firefox/Profiles/g0iym0if.default/cookies.sqlite:/2o7.net.a68612e

Found Tracking Cookie

/mnt/sda2/documents and settings/end_user/application data/Mozilla/Firefox/Profiles/g0iym0if.default/cookies.sqlite 

Found Tracking Cookie

I then went to the results, and deleted those 2 cookies.

I tried then to reboot and I still got my same original error.

I don't know if there is anything else I can do with the AVG Rescue CD. Thanks for your help.


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Sorry to be so edgy, but I need this computer to search for a job and for my kids school work. Any help, ASAP would be much appreciated.


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Will someone PLEASE take a look at this. This is the third day I haven't gotten use my computer and its CRUCIAL that i get it back.


----------



## spunk.funk (May 13, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Boot to the Recovery Console and type *chkdsk /P* and hit enter. the Check Disk Utility will try and fix any file errors.


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*



spunk.funk said:


> Boot to the Recovery Console and type *chkdsk /P* and hit enter. the Check Disk Utility will try and fix any file errors.


THANK YOU SOOOO MUCH FOR HELPING ME! Trying that now.


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Recovery had me choose the C Drive to enter the command to, which is the drive Windows is on. Here are the results:



> Volume Created 8/14/03 02:46a
> Volume Serial Number is 0046-3c07
> 
> CHKDSK is checking the volume
> ...


I tried to then reboot on XP and got the same error.


----------



## OldGrayGary (Jun 29, 2006)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Hi again

*Safe Mode with Command Prompt - System Restore*
Since your last efforts, do you still get the same STOP error, even when your Safe Mode menu choice is "Safe Mode with Command Prompt"?

If you can now successfully boot to the Safe Mode command prompt, try starting System Restore from the command line - by typing in the command *C:\windows\system32\restore\rstrui.exe* and then pressing Enter. Remember to use a restore point from well-before the rogue antivirus attacks.
_____

*XP Repair Reinstallation using CD / Recovery Disk*
If, instead, you now still get the same STOP error: I think it's time to find either a Windows XP CD to repair with, or to acquire a Recovery Disk. You should start backing up your data regardless of which repair you choose, to be on the safe side. 

If your system was built with a retail XP disk (full or upgrade version bought at a store), then you can probably borrow another retail disk of the same version as yours to run a repair install with. There's a chance that your product key won't work with the disk you borrow (in which case you can temporarily use its key, then change it back to your original later)-- and there's a likelihood that you will have to call Microsoft to re-activate your original license after the repair.
_____

*Another Alternative - manually repair the Registry using the Recovery Console*
This repair in generally only undertaken by advanced technicians - so if you decide to try it, make sure you backup all the data you need to save beforehand. 

The full details are in a Microsoft Knowledge Base article, & they mention starting the Recovery Console from the Windows XP CD. You can ignore that part, and start the Recovery Console using the same method as you did earlier in your repair efforts. Here is a link to the MSKB article --- http://support.microsoft.com/kb/307545

Unfortunately, if the trouble keeping your PC from booting isn't Registry damage, it's possible that even a successful Registry restore won't bring a successful boot. If the system files themselves are damaged, they'll need to be replaced. For that, you need access to clean system files -- and that usually requires having an installation CD.

__________

*AVG scan results*
It's interesting that AVG didn't find anything. Two tracking cookies aren't the sort of threats that bring down an operating system. It's possible that the earlier malware, or the cleaning up of that malware, caused damage to either the system files themselves, or to the permissions controlling access to them. So - even if the malware is possibly no longer present, it's damage might remain. It's also possible that the malware is still present, but is hidden by a rootkit undetected by the antimalware tools thus far.
__________

Best of luck
. . . Gary


----------



## TheOutcaste (Mar 19, 2009)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

The chkdsk summary shows the drive it checked has a total size of 13 GB, with only 615 MB free. Does that sound like the correct sizes for the Windows partition? Is there more than one partition on the disk?

The 0xc0000022 error means Access Denied, which could be the malware changed the NTFS Permissions. Without an XP CD to do a repair install, or create a BartPE or UBCD4Windows disk that can check the Security settings this could be hard to fix, if not impossible. If you can connect the drive to another system that would let you check file permissions

First thing I'd check is to see if these files are present, and check the size and modified dates using the Ubuntu CD:
(These will all be in *Windows\System32*)
Winlogon.exe
Userinit.exe
msgina.dll

Also check and see if you can find copies of those files elsewhere on the system, should be copies in this folder:
*\WINDOWS\ServicePackFiles\i386*
If there are copies there, I would rename the files in the *Windows\System32* folder and copy (don't move) replacements from the *\WINDOWS\ServicePackFiles\i386* folder.

There may also be copies in the *WINDOWS\$NtServicePackUninstall$* folder, or in one of the other *%NtUninstall...* folders, but these will be older versions.

If the malware changed the folder permissions though, this won't work, as the copies will just inherit the same permissions.


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Thanks for your help "OldGrayGary" and "TheOutcaste". I decided to do what Outcaste said first because I am on Ubuntu now, so it would take less time. 

Anyway, I found the 3 files you wanted me to. They all were in the* Windows\System32* folder.*

Winlogon *
Modified: Mon 14 Apr 2008 12:12:39 AM UTC
Size: 496.0 KB (507904 bytes)
*
Userinit.exe*
Modified: Mon 14 Apr 2008 12:12:38 AM UTC
Size: 25.5 KB (26112 bytes)

*msgina.dll*
Modified: Mon 14 Apr 2008 12:11:59 AM UTC
Size: 974.0 KB (997376 bytes)

I then found them in *\WINDOWS\ServicePackFiles\i386* Ithen renamed the ones in the* WINDOWS\SYSTEM32 *folder by adding a "OLD" after the words(E.G. winlogonOLD.Exe). After that, I copied copies from the *\WINDOWS\ServicePackFiles\i386 *folder into the* WINDOWS\SYSTEM32 Folder. 

*Going to reboot to windows now, hope it works.

Thanks again.


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

UPDATE! I rebooted and I am on windows. The only problem is, My start menu, taskbar, and desktop icons are gone. The wallpaper is still there. I hit Ctrl+ALT+DEL and task manager shows up and it shows that all the processes are running. I tried to then start a new task and open up explorer to restore the desktop, but I got an error. I then opened firefox so I can access here. I have ESET NOD 32, Malware Bytes Anti Malware, and SuperAntiSpyware Free edition. I tried opening them all up, and the opened but did not open a window. I also have HijackThis, if that could be of help. NOD has blocked 2 things since i got on here. I managed to get a screenshot of the second. The picture is attached.


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

More virus stuff popping up. Ugh. Now when i go on tech support here it loads the page and then it "unloads it." So now I have to go here via a Proxy.

Wow just as I am typing this, NOD blocked something again.


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Its not letting me edit my post so I guess ill make another..

More virus stuff popping up. Ugh. Now when i go on tech support here it loads the page and then it "unloads it." So now I have to go here via a Proxy.

I have now tried to use the run command in the Process manager to open Control panel (Control) - Got and error. Most all the programs I try to open will not they give me this same error below. 










Hijackthis I cannot get opened, but here is my process list right now









I found that Cfmon.exe is a trojan, so I killed the process.

Another block.


----------



## TheOutcaste (Mar 19, 2009)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

The file sizes on those three files you copied all match the SP3 version of the files, so nothing was added, but they could have been modified.

What was the error when you tried starting Explorer? Was it Access Denied or something else?

Have you tried booting into Safe Mode? See if you can start explorer there if it doesn't start when you boot.
Try starting it using this method:
Start Task Manager
Click File, then hold *CTRL* while you click *New ask (Run...)*
This will open a Command Prompt, type explorer at the prompt.

You can also try copying *explorer.exe* from *WINDOWS\ServicePackFiles\i386* to *WINDOWS* as you did with the other three files.

Looks like you are still infected with the Anitvirus 2010.
The *ctfmon.exe* file is a part of MS Office, so it could be legitimate, but is one that malware targets.
This file is bogus though, I'd kill it:
*6colhhmef.com*

Then see if you can get explorer or any of the other programs to start.

umgisvr.exe is part of some ArcSoft products. ACService is ArcSoft Connect, so looks like it belongs.
CSHelper.exe appears to be part of ArtistScope products.

The rest of the processes appear to be normal Windows processes, though any of them could be infected.

See if you can collect any of the info from the below link, and start a thread in the Malware forum. Include a link back to this thread.

Click this link: *First steps* and follow the instructions there and post the requested info in the Virus/Trojan/Spyware Help Forum, not here.
If you are unable to complete any of the steps, proceed to the next one, but be sure to note which step you were unable to complete, and include any error messages you received while trying to do that step.


----------



## patmark (Jul 11, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Yup Buckeye, I think Outcaste has got it right here, your still infected. I say this because I just finished fixing my dad's computer from a malware infection yesterday and it was so embedded in the system that regular extermination proceedures were unable to get rid of it. A regular scan of the system could not even find it. It wasn't until I followed the securty section proceedures and let them help me that I was able to find and eradicate it. They use a program called combofix that is very powerful and extremely good at removing these nasty little buggers. However even with my experience I wouldn't have been able to do it without their guidance. I know your in a hurry to get this fixed but consider this. If you try to take shortcuts here you it will only cause you more grief and take that much longer to fix. Here's the malware proceedures again for you. 

Please follow our pre-posting process outlined here: 
http://www.techsupportforum.com/secu...oval-help.html

After running through all the steps, please post the requested logs in the Virus/Trojan/Spyware Help forum, not here.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

If you don't post the required logs, it will slow them down with getting any help.

I will monitor this thread throughout this process. If you resolve this problem on your own or with the info we have provided please let us know so we can move on to other issues. Also *please mark this thread solved using the thread tools option located at the top of this thread and selecting solved from the drop down menu when your computer is working correctly and you are through with this thread.*

Thank you
Patmark


----------



## Buckeye80 (Sep 24, 2010)

*Re: "Stop: c000021a {Fatal System Error} - Status 0xc0000022" on Startup*

Outcaste: Thanks again. I was away from my computer for a little bit, and it went into hibernation. I then hit the space bar to start it back up, and I got the error. I tried to restart my PC and I got the error. I now went back into Ubuntu and replaced the files again and I am back onto XP. Also, I tried Safe Mode, and I still could not open explorer. 

I am making the malware thread now, thanks for your help!


----------

