BSOD during Windows XP login screen

I have been getting an error message after bootup on and XP Pro machine. Then BSOD within seconds of the message.

Message reads, The system could not log you on. Make sure your user name and domain are correct, then type your password again. Letters in passwords must be typed using the correct name.

Then I select ok to close the dialog box, Log in as admin or as a regular user and bluescreen followed by reboot.

Followed Windows BBS instructions on debugging > memory.dmp and have attached it.

Thanks,


Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\Windows;C:\Windows\system32;C:\Windows\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) MP (3 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c720
Debug session time: Tue Oct 27 10:28:41.218 2009 (GMT-7)
System Uptime: 0 days 0:01:04.781
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C000021A, {e2898470, c0000005, 7c9101b3, 109efc8}

Page 1277a not present in the dump file. Type ".hh dbgerr004" for details
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
Probably caused by : ntkrpamp.exe ( nt!KiFastCallEntry+fc )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: e2898470, String that identifies the problem.
Arg2: c0000005, Error Code.
Arg3: 7c9101b3
Arg4: 0109efc8

Debugging Details:
------------------

Page 1277a not present in the dump file. Type ".hh dbgerr004" for details
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details

ERROR_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down.

EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down.

EXCEPTION_PARAMETER1: e2898470

EXCEPTION_PARAMETER2: c0000005

EXCEPTION_PARAMETER3: 7c9101b3

EXCEPTION_PARAMETER4: 109efc8

ADDITIONAL_DEBUG_TEXT: Windows SubSystem

BUGCHECK_STR: 0xc000021a_csrss.exe_c0000005

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from 805c5ef0 to 804f9f0d

STACK_TEXT:
aa2fd934 805c5ef0 0000004c c000021a aa2fd9b0 nt!KeBugCheckEx+0x1b
aa2fd970 80655401 00000001 0000004c c000021a nt!PoShutdownBugCheck+0x5c
aa2fdb28 80612dae c000021a 00000004 00000001 nt!ExpSystemErrorHandler+0x511
aa2fdcd4 8061332f c000021a 00000004 00000001 nt!ExpRaiseHardError+0x9a
aa2fdd44 805413fc c000021a 00000004 00000001 nt!NtRaiseHardError+0x16b
aa2fdd44 7c90e514 c000021a 00000004 00000001 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0109ee90 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiFastCallEntry+fc
805413fc 8be5 mov esp,ebp

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: nt!KiFastCallEntry+fc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a78232a

FAILURE_BUCKET_ID: 0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

BUCKET_ID: 0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

Followup: MachineOwner
---------

eax=ffdff13c ebx=aa2fd9b0 ecx=00000000 edx=80500461 esi=0000004c edi=c000021a
eip=804f9f0d esp=aa2fd91c ebp=aa2fd934 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
804f9f0d 5d pop ebp
ChildEBP RetAddr Args to Child
aa2fd934 805c5ef0 0000004c c000021a aa2fd9b0 nt!KeBugCheckEx+0x1b (FPO: [5,0,0])
aa2fd970 80655401 00000001 0000004c c000021a nt!PoShutdownBugCheck+0x5c (FPO: [6,5,0])
aa2fdb28 80612dae c000021a 00000004 00000001 nt!ExpSystemErrorHandler+0x511 (FPO: [Non-Fpo])
aa2fdcd4 8061332f c000021a 00000004 00000001 nt!ExpRaiseHardError+0x9a (FPO: [Non-Fpo])
aa2fdd44 805413fc c000021a 00000004 00000001 nt!NtRaiseHardError+0x16b (FPO: [Non-Fpo])
aa2fdd44 7c90e514 c000021a 00000004 00000001 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ aa2fdd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0109ee90 00000000 00000000 00000000 00000000 0x7c90e514
start end module name
804d7000 806e2000 nt ntkrpamp.exe Tue Aug 04 05:01:46 2009 (4A78232A)
806e2000 80702c80 hal halmacpi.dll Mon Nov 15 17:37:02 2004 (419959BE)
aa376000 aa3c7580 srv srv.sys Thu Dec 11 03:57:18 2008 (4941001E)
aa4b8000 aa4e4400 mrxdav mrxdav.sys Tue Aug 03 23:00:49 2004 (41107B91)
aa7dd000 aa7e0280 ndisuio ndisuio.sys Tue Aug 03 23:03:10 2004 (41107C1E)
acf2e000 acf45480 dump_atapi dump_atapi.sys Tue Aug 03 22:59:41 2004 (41107B4D)
acf6e000 acfb0000 BHDrvx86 BHDrvx86.sys Wed Jul 29 17:44:45 2009 (4A70ECFD)
acfb0000 ad02b000 ccHPx86 ccHPx86.sys Fri Jun 19 16:23:00 2009 (4A3C1DD4)
ad02b000 ad048000 EraserUtilRebootDrv EraserUtilRebootDrv.sys Mon Aug 17 16:05:39 2009 (4A89E243)
ad048000 ad0a6000 eeCtrl eeCtrl.sys Mon Aug 17 16:05:39 2009 (4A89E243)
ad156000 ad158900 Dxapi Dxapi.sys Fri Aug 17 13:53:19 2001 (3B7D843F)
ad16e000 ad19db80 fslx fslx.sys Fri Feb 20 15:04:36 2009 (499F3704)
ad19e000 ad20cc00 mrxsmb mrxsmb.sys Fri Oct 24 04:10:39 2008 (4901AD2F)
ad20d000 ad238180 rdbss rdbss.sys Tue Aug 03 23:20:05 2004 (41108015)
ad239000 ad25ac80 afd afd.sys Thu Aug 14 02:51:42 2008 (48A4002E)
ad25b000 ad282c00 netbt netbt.sys Tue Aug 03 23:14:36 2004 (41107ECC)
ad283000 ad2d7000 IDSxpx86 IDSxpx86.sys Fri Sep 04 00:28:40 2009 (4AA0C1A8)
ad2d7000 ad2eb500 SYMFW SYMFW.SYS Mon Jul 06 17:21:46 2009 (4A52951A)
ad2ec000 ad311000 SYMEVENT SYMEVENT.SYS Wed Jun 24 13:14:58 2009 (4A428942)
ad311000 ad331f00 ipnat ipnat.sys Tue Aug 03 23:04:48 2004 (41107C80)
ad332000 ad365600 SYMTDI SYMTDI.SYS Mon Jul 06 17:21:23 2009 (4A529503)
ad366000 ad3bdf80 tcpip tcpip.sys Fri Jun 20 03:45:10 2008 (485B8A36)
ad3be000 ad3d0400 ipsec ipsec.sys Tue Aug 03 23:14:27 2004 (41107EC3)
ad419000 ad432400 AEAudio AEAudio.sys Tue Jun 19 12:07:12 2007 (46782960)
ad433000 ad454700 portcls portcls.sys Tue Mar 16 11:58:17 2004 (40574E49)
ad455000 ad4a4000 ADIHdAud ADIHdAud.sys Tue Jul 10 09:08:21 2007 (4693AEF5)
ad4a4000 ad4a7b00 usbscan usbscan.sys Tue Aug 03 22:58:44 2004 (41107B14)
b968e000 b96be100 rdpdr rdpdr.sys Tue Aug 03 23:01:10 2004 (41107BA6)
b96bf000 b96cfe00 psched psched.sys Tue Aug 03 23:04:16 2004 (41107C60)
b96d0000 b96e6780 ndiswan ndiswan.sys Fri Apr 25 02:41:51 2008 (4811A75F)
b9707000 b9709280 rasacd rasacd.sys Fri Aug 17 13:55:39 2001 (3B7D84CB)
b970f000 b9722900 parport parport.sys Tue Aug 03 22:59:04 2004 (41107B28)
b9723000 b9748000 HDAudBus HDAudBus.sys Fri Jan 07 17:07:15 2005 (41DF3243)
b9748000 b976ae80 USBPORT USBPORT.SYS Tue Aug 03 23:08:34 2004 (41107D62)
b976b000 b978d680 ks ks.sys Tue Aug 03 23:15:20 2004 (41107EF8)
b978e000 b97b9000 b57xp32 b57xp32.sys Mon Sep 17 13:00:10 2007 (46EEDCCA)
b97b9000 b97ccf00 VIDEOPRT VIDEOPRT.SYS Thu Aug 03 07:02:07 2006 (44D201DF)
b97cd000 b9cff000 ati2mtag ati2mtag.sys Wed Nov 12 19:18:46 2008 (491B9C96)
b9d17000 b9d1ac80 mssmbios mssmbios.sys Tue Aug 03 23:07:47 2004 (41107D33)
b9d47000 b9d5e800 SCSIPORT SCSIPORT.SYS Tue Aug 03 22:59:39 2004 (41107B4B)
b9d5f000 b9d9f000 ahcix86 ahcix86.sys Thu Oct 25 20:25:13 2007 (47215E19)
b9d9f000 b9db9580 Mup Mup.sys Tue Aug 03 23:15:20 2004 (41107EF8)
b9dba000 b9de6a80 NDIS NDIS.sys Fri Apr 25 02:41:49 2008 (4811A75D)
b9de7000 b9e73480 Ntfs Ntfs.sys Tue Aug 03 23:15:06 2004 (41107EEA)
b9e74000 b9e8a980 KSecDD KSecDD.sys Mon Jun 22 04:35:42 2009 (4A3F6C8E)
b9e8b000 b9eda000 SYMEFA SYMEFA.SYS Tue Jun 23 14:50:40 2009 (4A414E30)
b9eda000 b9eebf00 sr sr.sys Tue Aug 03 23:06:22 2004 (41107CDE)
b9eec000 b9f0a780 fltMgr fltMgr.sys Tue Aug 03 23:01:17 2004 (41107BAD)
b9f0b000 b9f22480 atapi atapi.sys Tue Aug 03 22:59:41 2004 (41107B4D)
b9f23000 b9f48700 dmio dmio.sys Tue Aug 03 23:07:13 2004 (41107D11)
b9f49000 b9f67880 ftdisk ftdisk.sys Fri Aug 17 13:52:41 2001 (3B7D8419)
b9f68000 b9f78a80 pci pci.sys Tue Aug 03 23:07:45 2004 (41107D31)
b9f79000 b9fa6d80 ACPI ACPI.sys Tue Aug 03 23:07:35 2004 (41107D27)
ba0a8000 ba0b0c00 isapnp isapnp.sys Fri Aug 17 13:58:01 2001 (3B7D8559)
ba0b8000 ba0c2500 MountMgr MountMgr.sys Tue Aug 03 22:58:29 2004 (41107B05)
ba0c8000 ba0d4c80 VolSnap VolSnap.sys Tue Aug 03 23:00:14 2004 (41107B6E)
ba0d8000 ba0e0e00 disk disk.sys Tue Aug 03 22:59:53 2004 (41107B59)
ba0e8000 ba0f4200 CLASSPNP CLASSPNP.SYS Tue Aug 03 23:14:26 2004 (41107EC2)
ba0f8000 ba103080 PxHelp20 PxHelp20.sys Fri Aug 19 11:05:00 2005 (43061F4C)
ba128000 ba132380 imapi imapi.sys Tue Aug 03 23:00:12 2004 (41107B6C)
ba138000 ba144180 cdrom cdrom.sys Tue Aug 03 22:59:52 2004 (41107B58)
ba148000 ba156080 redbook redbook.sys Tue Aug 03 22:59:34 2004 (41107B46)
ba168000 ba177d80 serial serial.sys Tue Aug 03 23:15:51 2004 (41107F17)
ba178000 ba180f00 IFXTPM IFXTPM.SYS Fri Dec 01 05:34:46 2006 (45702F76)
ba188000 ba195000 AmdPPM AmdPPM.sys Mon Apr 16 14:46:33 2007 (4623EEB9)
ba198000 ba1a4880 rasl2tp rasl2tp.sys Tue Aug 03 23:14:21 2004 (41107EBD)
ba1a8000 ba1b2200 raspppoe raspppoe.sys Tue Aug 03 23:05:06 2004 (41107C92)
ba1b8000 ba1c3d00 raspptp raspptp.sys Tue Aug 03 23:14:26 2004 (41107EC2)
ba1c8000 ba1d0900 msgpc msgpc.sys Tue Aug 03 23:04:11 2004 (41107C5B)
ba1d8000 ba1e1f00 termdd termdd.sys Tue Aug 03 22:58:52 2004 (41107B1C)
ba1e8000 ba1f7000 AmdLLD AmdLLD.sys Fri Jun 29 12:47:32 2007 (468561D4)
ba218000 ba221480 NDProxy NDProxy.SYS Fri Aug 17 13:55:30 2001 (3B7D84C2)
ba238000 ba246100 usbhub usbhub.sys Tue Aug 03 23:08:40 2004 (41107D68)
ba258000 ba266b80 drmk drmk.sys Tue Aug 03 23:07:54 2004 (41107D3A)
ba268000 ba270700 wanarp wanarp.sys Tue Aug 03 23:04:57 2004 (41107C89)
ba278000 ba280700 netbios netbios.sys Tue Aug 03 23:03:19 2004 (41107C27)
ba2a8000 ba2b1080 SRTSPX SRTSPX.SYS Mon Jun 22 19:15:26 2009 (4A403ABE)
ba2b8000 ba2c7900 Cdfs Cdfs.SYS Tue Aug 03 23:14:09 2004 (41107EB1)
ba2c8000 ba2d0880 Fips Fips.SYS Fri Aug 17 18:31:49 2001 (3B7DC585)
ba308000 ba314200 HPZid412 HPZid412.sys Sun Jan 16 20:51:53 2005 (41EB4469)
ba328000 ba32e200 PCIIDEX PCIIDEX.SYS Tue Aug 03 22:59:40 2004 (41107B4C)
ba330000 ba334900 PartMgr PartMgr.sys Fri Aug 17 18:32:23 2001 (3B7DC5A7)
ba360000 ba367b80 usbccgp usbccgp.sys Tue Aug 03 23:08:45 2004 (41107D6D)
ba380000 ba385280 GEARAspiWDM GEARAspiWDM.sys Mon May 18 05:16:53 2009 (4A1151B5)
ba390000 ba394280 usbohci usbohci.sys Tue Aug 03 23:08:34 2004 (41107D62)
ba398000 ba39e800 usbehci usbehci.sys Tue Aug 03 23:08:34 2004 (41107D62)
ba3a0000 ba3a5a00 mouclass mouclass.sys Tue Aug 03 22:58:32 2004 (41107B08)
ba3a8000 ba3ae000 kbdclass kbdclass.sys Tue Aug 03 22:58:32 2004 (41107B08)
ba3b8000 ba3be780 USBSTOR USBSTOR.SYS Tue Aug 03 23:08:44 2004 (41107D6C)
ba3c0000 ba3c6b00 fdc fdc.sys Tue Aug 03 22:59:25 2004 (41107B3D)
ba3e0000 ba3e4880 TDI TDI.SYS Tue Aug 03 23:07:47 2004 (41107D33)
ba3f0000 ba3f4580 ptilink ptilink.sys Fri Aug 17 13:49:53 2001 (3B7D8371)
ba3f8000 ba3fe500 usbprint usbprint.sys Tue Aug 03 23:01:23 2004 (41107BB3)
ba400000 ba404080 raspti raspti.sys Fri Aug 17 13:55:32 2001 (3B7D84C4)
ba408000 ba40d020 wanatw4 wanatw4.sys Tue Jul 16 08:23:14 2002 (3D343A62)
ba410000 ba417400 SymIM SymIM.sys Mon Jun 22 16:01:39 2009 (4A400D53)
ba420000 ba425440 HPZius12 HPZius12.sys Thu Dec 23 21:37:44 2004 (41CBAB28)
ba448000 ba44e180 HIDPARSE HIDPARSE.SYS Tue Aug 03 23:08:15 2004 (41107D4F)
ba450000 ba455200 vga vga.sys Tue Aug 03 23:07:06 2004 (41107D0A)
ba458000 ba45c500 watchdog watchdog.sys Tue Aug 03 23:07:32 2004 (41107D24)
ba460000 ba464a80 Msfs Msfs.SYS Tue Aug 03 23:00:37 2004 (41107B85)
ba470000 ba477880 Npfs Npfs.SYS Tue Aug 03 23:00:38 2004 (41107B86)
ba490000 ba497400 SYMNDIS SYMNDIS.SYS Mon Jul 06 17:21:33 2009 (4A52950D)
ba4a0000 ba4a6700 SYMIDS SYMIDS.SYS Mon Jul 06 17:21:54 2009 (4A529522)
ba4b8000 ba4bb000 BOOTVID BOOTVID.dll Fri Aug 17 13:49:09 2001 (3B7D8345)
ba564000 ba566880 Iviaspi Iviaspi.sys Tue Sep 20 02:27:19 2005 (432FD5F7)
ba570000 ba573f60 HPZipr12 HPZipr12.sys Thu Dec 23 21:39:10 2004 (41CBAB7E)
ba57c000 ba57fc80 serenum serenum.sys Tue Aug 03 22:59:06 2004 (41107B2A)
ba584000 ba586280 wmiacpi wmiacpi.sys Tue Aug 03 23:07:39 2004 (41107D2B)
ba58c000 ba58e580 ndistapi ndistapi.sys Fri Aug 17 13:55:29 2001 (3B7D84C1)
ba5a8000 ba5a9b80 kdcom kdcom.dll Fri Aug 17 13:49:10 2001 (3B7D8346)
ba5aa000 ba5ab100 WMILIB WMILIB.SYS Fri Aug 17 14:07:23 2001 (3B7D878B)
ba5ac000 ba5ad700 dmload dmload.sys Fri Aug 17 13:58:15 2001 (3B7D8567)
ba5be000 ba5bf100 swenum swenum.sys Tue Aug 03 22:58:41 2004 (41107B11)
ba5c4000 ba5c5280 USBD USBD.SYS Fri Aug 17 14:02:58 2001 (3B7D8682)
ba5cc000 ba5cdf00 Fs_Rec Fs_Rec.SYS Fri Aug 17 13:49:37 2001 (3B7D8361)
ba5d0000 ba5d1080 Beep Beep.SYS Fri Aug 17 13:47:33 2001 (3B7D82E5)
ba5d4000 ba5d5080 mnmdd mnmdd.SYS Fri Aug 17 13:57:28 2001 (3B7D8538)
ba5d8000 ba5d9080 RDPCDD RDPCDD.sys Fri Aug 17 13:46:56 2001 (3B7D82C0)
ba5ec000 ba5ed100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 14:07:23 2001 (3B7D878B)
ba644000 ba645500 regi regi.sys Mon Apr 16 08:19:05 2007 (462393E9)
ba670000 ba670d00 pciide pciide.sys Fri Aug 17 13:51:49 2001 (3B7D83E5)
ba72d000 ba72dc00 audstub audstub.sys Fri Aug 17 13:59:40 2001 (3B7D85BC)
ba788000 ba788b80 Null Null.SYS Fri Aug 17 13:47:39 2001 (3B7D82EB)
ba7ff000 ba7ffd00 dxgthk dxgthk.sys Fri Aug 17 13:53:12 2001 (3B7D8438)
bf000000 bf011580 dxg dxg.sys Tue Aug 03 23:00:51 2004 (41107B93)
bf012000 bf063000 ati2dvag ati2dvag.dll Wed Nov 12 19:19:11 2008 (491B9CAF)
bf063000 bf0f0000 ati2cqag ati2cqag.dll Wed Nov 12 18:13:20 2008 (491B8D40)
bf0f0000 bf163000 atikvmag atikvmag.dll Wed Nov 12 18:21:22 2008 (491B8F22)
bf163000 bf1ad000 atiok3x2 atiok3x2.dll Wed Nov 12 18:18:12 2008 (491B8E64)
bf1ad000 bf59a840 ati3duag ati3duag.dll Wed Nov 12 18:55:34 2008 (491B9726)
bf59b000 bf7fc300 ativvaxx ativvaxx.dll Wed Nov 12 18:39:35 2008 (491B9367)
bf800000 bf9c3280 win32k win32k.sys Fri Apr 17 03:09:14 2009 (49E8554A)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Wed Aug 04 00:56:56 2004 (411096C8)

Unloaded modules:
ba158000 ba165000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba298000 ba2a1000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba288000 ba293000 p3.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba578000 ba57c000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba438000 ba43d000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ba574000 ba577000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

Try going into Safe Mode.