Solved Windows 7 broken: can no longer log in...

[Kaktussoft]

create a temp file in c:\users
is it then is F:\users as well, so junction point works?

same for program files etc

 

[TerDale]

bcdedit/set {default} safeboot minimal
this sets the default bootmode to safe mode.

So set the default boot setting to safe mode now. Then boot into advanced boot options and select "Disable Automatic Restart on System Failure"

Now the system starts in its standard mode (which is safe mode now) and doesn't restart on crash (I assume this "don't restart option" is only once[?])

Only once, confirmed

Now you see the BSOD. What does it say?

STOP C000021A {Fatal System Error}
Initial session process or system process terminated unexpectedly with a status of 0x00000000 (0xc0000001 0x00100590)
The system has been shut down

 

[TerDale]

But please disconnect all unneeded hardware for now, just as test. So
disconnect external, drives, printers, usb sticks etc. Leave mouse and keyboard attached.

Windows should even start without a mouse so disconnect that as well (impossible if it's a touchpad).

I don't expect it will boot then succesfully, but give it a try

Done:
- while configured in safe mode by default, as per your recommendations: same result as with everything connected: BSOD
- while back to normal mode: again no difference: the same logon screen with empty icon, reconnected keyboard to attempt to log in, but denied as previously

 

[TerDale]

create a temp file in c:\users
is it then is F:\users as well, so junction point works?

same for program files etc

Done: no problems after cerating a dir in c:\users, and one in "c:\program files", dir are properly created, so junctions work

 

[TerDale]

Fixed below post with BSOD info: stop code is C000021A instead of C0000214. Sorry

 

[Kaktussoft]

C0000214STATUS_TRANSACTION_INVALID_ID
Don't know what to do about it. But it can be:

• Virus, rootkit etc. Microsoft Standalone System Sweeper Beta | Microsoft Connect Run it and create a bootable dvd. boot from that dvd and let it scan windows. post results
• do a memory check from within recovery environment and let it run a few hours

 

[TerDale]

Erm... based on How to troubleshoot a "STOP 0xC000021A" error, it sounds that either Winlogon.exe or Csrss.exe (or one of the DLLs they depend on) is broken. Considering I don't have this STOP in normal mode, I wonder if that couldn't be a malware infection....

 

[Kaktussoft]

Fixed below post with BSOD info: stop code is C000021A instead of C0000214. Sorry

GRRRRR

but please perform a check for malware. Where do you live btw?

 

[TerDale]

C0000214STATUS_TRANSACTION_INVALID_ID
Don't know what to do about it. But it can be:

I made a typo, it is C000021A instead

• Virus, rootkit etc. Microsoft Standalone System Sweeper Beta | Microsoft Connect Run it and create a bootable dvd. boot from that dvd and let it scan windows. post results
• do a memory check from within recovery environment and let it run a few hours

Memory check from RC already done 1 hr ago, no issue detected.

Will go for System Sweeper now, thanks for the tip and your great support so far.

I'll post the results later on in the afternoon...

 

[TerDale]

Where do you live btw?

France, why? Could it be the reason Windows no longer allows me to log in?

 

[Kaktussoft]

After Updates, computer blues screens with error codes c000021a, - Microsoft Answers

It runs Winlogon.exe or Csrss.exe in usermode. since there is a fatal error it cannot garantuee security, so it swaps to kernel mode. Since winlogin is needed for logon process it crashes.

Did you do a "system restore" to a date prior to possible infection? try an earlier restore point.
and perform a malware check

 

[TerDale]

Did you do a "system restore" to a date prior to possible infection?

Well... hard to tell, I did a system restore with a restore point dated from the day before, so one could conclude that the infection occurred that day, but it's difficult to be sure.

try an earlier restore point.
and perform a malware check

Sure, I'll try earlier ones.
About MS System Sweeper, did you use it already?
Tried to burn a DVD from 2 machines, but, in both cases, it told me that it couldn't found any CD or DVD
Same issue with USB key from one of the machine, and on the 2nd it told me that it will use A:, while it is a obviously a diskette drive and that my USB key is in E:...

 

[TerDale]

About MS System Sweeper, did you use it already?
Tried to burn a DVD from 2 machines, but, in both cases, it told me that it couldn't found any CD or DVD
Same issue with USB key from one of the machine, and on the 2nd it told me that it will use A:, while it is a obviously a diskette drive and that my USB key is in E:...

OK, my fault, once run elevated it works to burn my DVD
Burn in progress...

 

[Kaktussoft]

first try a restore point from a few days prior to infection.
after that try ms system sweeper

 

[TerDale]

first try a restore point from a few days prior to infection.
after that try ms system sweeper

Why this order? Actually it is currently scanning. If it can found something and fix it, I would prefer to get my Windows back to the most up-to-date state in terms of settings & installed apps.

 

[Kaktussoft]

first try a restore point from a few days prior to infection.
after that try ms system sweeper

Why this order? Actually it is currently scanning. If it can found something and fix it, I would prefer to get my Windows back to the most up-to-date state in terms of settings & installed apps.

Going back in time "software and settings" is better then destroying virus/malware using tools. You go back in time so virus is almost sure gone.

it's your decision.

Tell me if sweeper finds something, and if so tell me what it found.

 

[TerDale]

Going back in time "software and settings" is better then destroying virus/malware using tools. You go back in time so virus is almost sure gone.

OK, I get your point.

Tell me if sweeper finds something, and if so tell me what it found.

Sweeper (actuall Windos Defender Offline) found 2 issues rated as "serious":
- Trojan/Java-openConnection.01
- Exploit/Java-CVE-2010-840.EX
Was puzzled reading this...indeed FMPOV, don't think these are the actual issue affecting the logon process, considering they are bot Java-related....
Anyway, tried to reboot in safe mode and of course the same BSOD, so tried to repair fom within RC, still working...

But, don't think MS is the best for malware fighting, so will try some of the rescue CDs provided by most AV vendors.

 

[Kaktussoft]

Going back in time "software and settings" is better then destroying virus/malware using tools. You go back in time so virus is almost sure gone.

OK, I get your point.

Tell me if sweeper finds something, and if so tell me what it found.

Sweeper (actuall Windos Defender Offline) found 2 issues rated as "serious":
- Trojan/Java-openConnection.01
- Exploit/Java-CVE-2010-840.EX
Was puzzled reading this...indeed FMPOV, don't think these are the actual issue affecting the logon process, considering they are bot Java-related....
Anyway, tried to reboot in safe mode and of course the same BSOD, so tried to repair fom within RC, still working...

But, don't think MS is the best for malware fighting, so will try some of the rescue CDs provided by most AV vendors.

"startup repair" isn't needed. System starts fine. But there's a crash!

Try to do system restore

 

[Kaktussoft]

have to go now.

 

[gregrocker]

Work through these steps for Troubleshooting Windows 7 Failure to Boot - Windows 7 Forums.

Double check infection is cleaned up using Malwarebytes if you can get into Safe Mode, or another bootable AV given in blue link tutorial.

Then repair damaged System files by going through the steps given which will assure you've done all you can.

If force to re-image or reinstall then this time keep your Programs on the same partition as OS. Since they write registry keys to OS they should be contained within it, and in the same backup image which is the modern replacement for reinstall. Backup Complete Computer - Create an Image Backup http://www.sevenforums.com/tutorials/663-backup-complete-computer-create-image-backup.html