Error message: "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" in Win32k.sys or a "Stop error code 0xC000021A"

This article was previously published under Q294728
Notice
This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy.
This article has been archived. It is offered "as is" and will no longer be updated.
SYMPTOMS
When you restart your computer, you may receive the following error message:
STOP 0x0000001e KMODE_EXCEPTION_NOT_HANDLED in win32k.sys

or
STOP 0xC000021A {Fatal System Error}The Windows Logon Process terminated unexpectedly.
CAUSE
This behavior can occur if you downloaded the Backdoor.NTHack virus from a remote host into your computer. This virus is initiated by the Dl.bat file in the InetPub\Scripts folder.

As a result, both the Firedaemon.exe and Sud.exe files are installed on the computer as well as the Os2srv.exe and Mmtask.exe files, which along with the Sud.exe and Index.exe files are run as services.
RESOLUTION
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows

To resolve this behavior, you must perform a parallel install of Windows NT 4.0 or Windows 2000 and/or make the following changes by using the Windows 2000 Recovery Console.

The Newgina.dll file is specified under the following registry key when you access the original software hive from a parallel install:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value = GinaDLL REG_SZ

Gina.dll = Newgina.dll
Original Gina.dll = Msgina.dll (or Awgina.dll)
  1. From the parallel install or in the Recovery Console, rename the Newgina.dll file to "Newgina.old".
  2. Rename the original Gina file, for example, the Msgina.dll file to "Newgina.dll". This renaming enables the original Gina file to be loaded under the name "Newgina.dll" which is specified in the registry.
If you cannot locate the Newgina.dll file in Windows Explorer, you can delete or replace the newgina.dll value in GinaDLL (REG_SZ) with msgina.dll (or awgina.dll) under the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
This change enables the original Gina.dll file to be loaded from the cache.

You must also disable and delete the services that are associated with the virus as well as the files that are installed in the C:\Winnt\System32\Os2\New folder.

The Dl.bat file in the InetPub\Scripts folder must also be deleted.
MORE INFORMATION
This virus downloads the Dl.exe file from the remote host, runs the program, and then runs an install routine that installs files under the C:\Winnt\System32\Os2\ folder in a hidden folder called "New".

This hidden folder contains the following files: Firedaemon.exe, Dir.txt, Login.txt, Remscan.txt, Sud.exe, and Sud.bak.

NOTE: The following processes may also be running on your computer: Sud.exe, Firedaemon.exe, Mmtask.exe, and Os2serv.exe. If you attempt to end a task on any of these processes, you may receive an "Access is denied" error message. In Task Manager, these processes are listed in all capital letters.

In addition, the Msgina.dll (or Awgina.dll) file is replaced with the Newgina.dll file.

The Newgina.dll file captures password information when someone logs on to the computer.

The passwords that are captured are then stored in a .tmp file in the root of drive C. A new File Transfer Protocol (FTP) server is also installed called "UServ". These files and folders must also be deleted.

For additional information about a security fix for Microsoft Internet Information Server (IIS) to block this type of virus, click the article number below to view the article in the Microsoft Knowledge Base:
269862 Patch Released for Canonicalization Error Issue
For more information regarding the Backdoor.NTHack virus, refer to the following Symantec and Network Associates Web sites:
firedaemon winlogon virus newgina
Properties

Article ID: 294728 - Last Review: 12/06/2015 01:46:53 - Revision: 2.0

Microsoft Windows 2000 Server, Microsoft Windows NT Server 4.0 Standard Edition

  • kbnosurvey kbarchive kberrmsg kbprb KB294728
Feedback