STOP: c000021A (Fatal System Error)

[CarlaSita27]

When I boot into XP, I get an error,
"STOP: c000021a {Fatal System Error}
The session manager initialization system process terminated unexpectedly with a status of 0xc0000263 (0x00000000 0x00000000). The system has been shut down.

This error was caused by me changing the boot screen to a customized one. These were the steps I followed taken from

http://www.themexp.org/howto.php:

1. Backup (copy) the file %windir%\system32\ntoskrnl.exe (most likely C:\windows\system32\ntoskrnl.exe - the boot screen)
2. Download the .zip to your computer
3. Extract ntoskrnl.exe to a directory other than %windir%\system32 (most likely C:\windows\system32)
4. Reboot your computer into Safe Mode (hit F8 before the boot screen) or into true DOS (from a boot disk)
5. Overwrite the file %windir%\system32\ntoskrnl.exe (which should have been backed up) with the extracted exe
6. Reboot your computer as you normally would

After rebooting my PC, the New Boot Screen does show, but then afterwards a blue screen occurrs with the STOP error. The same error occurs if I try to boot into SAFE MODE. I followed the instructions carefully and I'm pretty knowledgeable in computers, I just do not know what went wrong. I've done this before and it went smoothly. Does anyone have any ideas on to get me up and running without having to format my drive? Thanks!

 

[bcastner]

GoBack installed from Norton SystemWorks?

http://support.microsoft.com/default.aspx?scid=kb;en-us;316503

 

[CarlaSita27]

I did not install GoBack. That's not how the error started...Any other ideas?

 

[TKoch]

The new ntoskrnl.exe is the problem. It was probably created from a different version than you are currently using. (ie different service pack installed on the creator's computer)

Since safe mode does not work you will need to run the recovery from the winxp cd.
on the recovery command propmpt you will need to replace the current ntoskrnl with your backup of the previouse one.

http://www.wown.com/j_helmig/wxprcons.htm

- for help with getting to recovery console, and available commands.



- Trevor
CCNA, CCNT, A+, NET +

 

[CarlaSita27]

Good info! I will try this out. Thank you very much!

 

[bcastner]

Aumha site says: "This occurs when Windows switches into kernel mode and a user-mode subsystem, such as Winlogon or the Client Server Runtime Subsystem (CSRSS), is compromised and security can no longer be guaranteed. Because Win XP can’t run without Winlogon or CSRSS, this is one of the few situations where the failure of a user-mode service can cause the system to stop responding. This Stop message also can occur when the computer is restarted after a system administrator has modified permissions so that the SYSTEM account no longer has adequate permissions to access system files and folders."

What I can tell you is that it used to be a popular backdoor into Windows to rename or replace the startup files so that you could launch a scheduled task or just access the CMD line. This is no longer so easy.

In any case, use Recovery Console and replace your c:\windows\system32\ntoskrnl.exe with the backup.