BSOD 0x000021a

speed258 · April 22, 2018

Yesterday I installed Bitdefender 2018 TS, after full system scan, I turned off pc and today pc boots with 21a error, If I disable driver enforcment mode pc boots normally no problem, I uploading dmp file, perfmon logs and msinfo.

What I tried:

Uninstall Bitdefend - no luck.
sfc /checknow - no luck.
chkdsk /c /f - no luck.
dism /online /cleanup-image /restorehealth - no luck.
System restore is not a option since my system didnt make any restore points for some reason.

Is there anything I could try to fix it?

P.S. sfc now shows that there is corrupt files but unable to repair them, adding log

Radium_Angel · April 22, 2018

36 minutes ago, speed258 said:

Yesterday I installed Bitdefender 2018 TS, after full system scan, I turned off pc and today pc boots with 21a error, If I disable driver enforcment mode pc boots normally no problem, I uploading dmp file, perfmon logs and msinfo.

What I tried:

Uninstall Bitdefend - no luck.

sfc /checknow - no luck.

chkdsk /c /f - no luck.

dism /online /cleanup-image /restorehealth - no luck.

System restore is not a option since my system didnt make any restore points for some reason.

Is there anything I could try to fix it?

P.S. sfc now shows that there is corrupt files but unable to repair them, adding log

042218-58468-01.dmp

log.html

msinfo.txt

CBS.log

Thanks for the dump log, give me a few minutes to look it over.

Radium_Angel · April 22, 2018

43 minutes ago, speed258 said:

Yesterday I installed Bitdefender 2018 TS, after full system scan, I turned off pc and today pc boots with 21a error, If I disable driver enforcment mode pc boots normally no problem, I uploading dmp file, perfmon logs and msinfo.

What I tried:

Uninstall Bitdefend - no luck.

sfc /checknow - no luck.

chkdsk /c /f - no luck.

dism /online /cleanup-image /restorehealth - no luck.

System restore is not a option since my system didnt make any restore points for some reason.

Is there anything I could try to fix it?

P.S. sfc now shows that there is corrupt files but unable to repair them, adding log

042218-58468-01.dmp

log.html

msinfo.txt

CBS.log

Ok, here is what you got:

Loading Dump File [E:\My Documents\Downloads\042218-58468-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 16299 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff803`80a18000 PsLoadedModuleList = 0xfffff803`80d7f130
Debug session time: Sun Apr 22 05:21:21.325 2018 (UTC - 4:00)
System Uptime: 0 days 0:01:00.034
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C000021A, {ffff8604971ed290, ffffffffc0000428, 0, 214cb340000}

ETW minidump data unavailable
Probably caused by : ntkrnlmp.exe ( nt!NtSetSystemPowerState+b90 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: ffff8604971ed290, String that identifies the problem.
Arg2: ffffffffc0000428, Error Code.
Arg3: 0000000000000000
Arg4: 00000214cb340000

Debugging Details:
------------------

ETW minidump data unavailable

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.16299.309 (WinBuild.160101.0800)

ERROR_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down.

EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down.

EXCEPTION_CODE_STR: c000021a

EXCEPTION_PARAMETER1: ffff8604971ed290

EXCEPTION_PARAMETER2: ffffffffc0000428

EXCEPTION_PARAMETER3: 0000000000000000

EXCEPTION_PARAMETER4: 214cb340000

DUMP_TYPE: 2

BUGCHECK_P1: ffff8604971ed290

BUGCHECK_P2: ffffffffc0000428

BUGCHECK_P3: 0

BUGCHECK_P4: 214cb340000

PROCESS_NAME: smss.exe

ADDITIONAL_DEBUG_TEXT: initial session process or

BUGCHECK_STR: 0xc000021a_SmpDestroyControlBlock_smss.exe_Terminated_c0000428

IMAGE_NAME: ntkrnlmp.exe

MODULE_NAME: nt

CPU_COUNT: 4

CPU_MHZ: e9c

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 10

CPU_MODEL: 4

CPU_STEPPING: 3

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: (REDACTED)

ANALYSIS_SESSION_TIME: 04-22-2018 07:27:25.0443

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

LAST_CONTROL_TRANSFER: from fffff80380e44fef to fffff80380b8d510

STACK_TEXT:
fffff38c`ede5a7e8 fffff803`80e44fef : 00000000`0000004c 00000000`c000021a fffff38c`ee2df538 ffffcb01`6e249f30 : nt!KeBugCheckEx
fffff38c`ede5a7f0 fffff803`80e4c0c0 : 00000000`00000000 fffff38c`ede5a930 ffffffff`80000544 fffff38c`ede5a930 : nt!PopGracefulShutdown+0x28f
fffff38c`ede5a830 fffff803`80ba0003 : 00000000`00000004 fffff803`00000006 00000000`c0000004 00000000`00000000 : nt!NtSetSystemPowerState+0xb90
fffff38c`ede5a9e0 fffff803`80b90f30 : fffff803`811103f0 00000000`00000000 00000000`c0000004 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff38c`ede5ab78 fffff803`811103f0 : 00000000`00000000 00000000`c0000004 00000000`00000000 fffff803`80d7b060 : nt!KiServiceLinkage
fffff38c`ede5ab80 fffff803`8111064d : ffffcb01`6a96a040 fffff803`80a538a4 00000000`000001dd 00000000`00000000 : nt!PopIssueActionRequest+0x1cc
fffff38c`ede5ac20 fffff803`80a2ea8a : 00000000`00000001 00000000`00000002 ffffcb01`6a84d400 00000000`00000000 : nt!PopPolicyWorkerAction+0x6d
fffff38c`ede5ac90 fffff803`80a534d5 : ffffcb01`6a96a040 fffff803`80a2ea10 ffffcb01`6a84d490 ffffcb01`00001000 : nt!PopPolicyWorkerThread+0x7a
fffff38c`ede5acc0 fffff803`80b2ec07 : ffffcb01`6a96a040 00000000`00000080 ffffcb01`6a84b2c0 ffffcb01`6a96a040 : nt!ExpWorkerThread+0xf5
fffff38c`ede5ad50 fffff803`80b94cc6 : ffff9700`7142b180 ffffcb01`6a96a040 fffff803`80b2ebc0 00000000`00000000 : nt!PspSystemThreadStartup+0x47
fffff38c`ede5ada0 00000000`00000000 : fffff38c`ede5b000 fffff38c`ede55000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

THREAD_SHA1_HASH_MOD_FUNC: 419b7cf41d42b3c6186404588cb590dfcdbb030a

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: bda932f4b5fb8bebbb7eaf768616ed23a76c8925

THREAD_SHA1_HASH_MOD: b28610981796779b4ac02f58898fde25728a775c

FOLLOWUP_IP:
nt!NtSetSystemPowerState+b90
fffff803`80e4c0c0 cc int 3

FAULT_INSTR_CODE: 44fb8bcc

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!NtSetSystemPowerState+b90

FOLLOWUP_NAME: MachineOwner

DEBUG_FLR_IMAGE_TIMESTAMP: 5a979177

IMAGE_VERSION: 10.0.16299.309

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: b90

FAILURE_BUCKET_ID: 0xc000021a_SmpDestroyControlBlock_smss.exe_Terminated_c0000428_nt!NtSetSystemPowerState

BUCKET_ID: 0xc000021a_SmpDestroyControlBlock_smss.exe_Terminated_c0000428_nt!NtSetSystemPowerState

PRIMARY_PROBLEM_CLASS: 0xc000021a_SmpDestroyControlBlock_smss.exe_Terminated_c0000428_nt!NtSetSystemPowerState

TARGET_TIME: 2018-04-22T09:21:21.000Z

OSBUILD: 16299

OSSERVICEPACK: 309

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-03-01 00:36:55

BUILDDATESTAMP_STR: 160101.0800

BUILDLAB_STR: WinBuild

BUILDOSVER_STR: 10.0.16299.309

ANALYSIS_SESSION_ELAPSED_TIME: 9c7

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xc000021a_smpdestroycontrolblock_smss.exe_terminated_c0000428_nt!ntsetsystempowerstate

FAILURE_ID_HASH: {6ae6fe00-a198-89fa-6794-96f7f849b4bf}

Followup: MachineOwner
---------

Ok, what you have (and I'm analyzing this crash dump with my Win7 box) is a driver failure tied into Windows logon, which probably means your bit defender is corrupted somehow.

If you can log into safe mode, perhaps there is a removal tool for bit defender. If it's a service that's causing this, look into the Services section of Windows and disable anything related to bit defender and see what gives...