Solved Sporadic BSOD 0xC000021A at shutdown

Hairy Scot

Power User
VIP Member
Power User
Messages
220
As stated in title.
 

My Computer

System One

  • OS
    Windows 8.1 Pro X64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    CPU
    Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, 3601 Mhz, 4 Core(s)
    Motherboard
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    Memory
    8 GB DDR3 1600MHZ
    Graphics Card(s)
    GE Force GT 610
    Sound Card
    Onboard Realtek High Def
    Monitor(s) Displays
    Dell U2913WMP
    Screen Resolution
    2560x1080
    Hard Drives
    Western Digital WD10EZEX-00RKKA0 1TB
    Seagate ST2000DL003-9VT166 2TB
    Seagate ST31000528AS 1TB
Hi Hairy Scot ^_^,

I have analysed your dump files and below has been provided an analysis of the same for informative purposes :-
Code:
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: [B][COLOR=#0000ff]f[B]fffc0011bf7d610[/B][/COLOR],[/B] String that identifies the problem.
Arg2: ffffffffc0000005, Error Code.
Arg3: 00007fff5b53000a
Arg4: 00000043d3f6dd80
Now, if we dump the first argument that is the string which identifies the problem, we get the below :-
Code:
3: kd> db ffffc0011bf7d610
ffffc001`1bf7d610  57 69 6e 64 6f 77 73 20-53 75 62 53 79 73 74 65  [B]Windows SubSyste[/B]
ffffc001`1bf7d620  6d 00 32 5c 73 70 70 73-76 63 2e 65 78 65 00 00  [B]m.[/B]2[B][COLOR=#ff0000]\s[B]ppsvc.exe[/B][/COLOR].[/B].
ffffc001`1bf7d630  03 01 1d 03 46 4d 66 6e-b7 56 ae 8e 22 91 12 4a  ....FMfn.V.."..J
ffffc001`1bf7d640  04 f2 b6 01 00 00 00 00-a0 2b ce 47 01 e0 ff ff  .........+.G....
ffffc001`1bf7d650  cc 10 00 00 00 00 00 00-58 3e 33 33 01 c0 ff ff  ........X>33....
ffffc001`1bf7d660  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
ffffc001`1bf7d670  90 99 4a 4b 01 e0 ff ff-00 00 00 00 00 00 00 00  ..JK............
ffffc001`1bf7d680  a0 2b ce 47 01 e0 ff ff-00 80 01 00 00 00 00 00  .+.G............

As we can see, the bugcheck occurred due to SppSvc.exe which is the Microsoft Software Protection Platform Service. This is mostly due to corruption.
This should be fixed by running the DISM and the System File Checker.
Then please run the following DISM commands to see if there's any problems with the system (from an elevated (Run as administrator) Command Prompt). Press Enter after each one:
Code:

Code:
Dism /Online /Cleanup-Image /ScanHealth
Code:

Code:
Dism /Online /Cleanup-Image /CheckHealth
If the problem is fixable, you can use this command to repair it (from an elevated (Run as administrator) Command Prompt). Press Enter after typing it:
Code:

Code:
Dism /Online /Cleanup-Image /RestoreHealth
From this article: Repair a Windows Image

Once this is dun, please run sfc.exe /scannow from an elevated (Run as administrator) Command Prompt to check for further corruption.

Let me know how it goes ^_^
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Hi Hairy Scot ^_^,

I have analysed your dump files and below has been provided an analysis of the same for informative purposes :-
Code:
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: [B][COLOR=#0000ff]f[B]fffc0011bf7d610[/B][/COLOR],[/B] String that identifies the problem.
Arg2: ffffffffc0000005, Error Code.
Arg3: 00007fff5b53000a
Arg4: 00000043d3f6dd80
Now, if we dump the first argument that is the string which identifies the problem, we get the below :-
Code:
3: kd> db ffffc0011bf7d610
ffffc001`1bf7d610  57 69 6e 64 6f 77 73 20-53 75 62 53 79 73 74 65  [B]Windows SubSyste[/B]
ffffc001`1bf7d620  6d 00 32 5c 73 70 70 73-76 63 2e 65 78 65 00 00  [B]m.[/B]2[B][COLOR=#ff0000]\s[B]ppsvc.exe[/B][/COLOR].[/B].
ffffc001`1bf7d630  03 01 1d 03 46 4d 66 6e-b7 56 ae 8e 22 91 12 4a  ....FMfn.V.."..J
ffffc001`1bf7d640  04 f2 b6 01 00 00 00 00-a0 2b ce 47 01 e0 ff ff  .........+.G....
ffffc001`1bf7d650  cc 10 00 00 00 00 00 00-58 3e 33 33 01 c0 ff ff  ........X>33....
ffffc001`1bf7d660  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
ffffc001`1bf7d670  90 99 4a 4b 01 e0 ff ff-00 00 00 00 00 00 00 00  ..JK............
ffffc001`1bf7d680  a0 2b ce 47 01 e0 ff ff-00 80 01 00 00 00 00 00  .+.G............

As we can see, the bugcheck occurred due to SppSvc.exe which is the Microsoft Software Protection Platform Service. This is mostly due to corruption.
This should be fixed by running the DISM and the System File Checker.
Then please run the following DISM commands to see if there's any problems with the system (from an elevated (Run as administrator) Command Prompt). Press Enter after each one:
Code:

Code:
Dism /Online /Cleanup-Image /ScanHealth
Code:

Code:
Dism /Online /Cleanup-Image /CheckHealth
If the problem is fixable, you can use this command to repair it (from an elevated (Run as administrator) Command Prompt). Press Enter after typing it:
Code:

Code:
Dism /Online /Cleanup-Image /RestoreHealth
From this article: Repair a Windows Image

Once this is dun, please run sfc.exe /scannow from an elevated (Run as administrator) Command Prompt to check for further corruption.

Let me know how it goes ^_^

Hi Blueelvis.

The DISM didn't seem to work but SFC SCANNOW did repair something.
I have attached the logs if you would like to have a look.

Thanks very much for your interest and your help.
 

My Computer

System One

  • OS
    Windows 8.1 Pro X64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    CPU
    Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, 3601 Mhz, 4 Core(s)
    Motherboard
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    Memory
    8 GB DDR3 1600MHZ
    Graphics Card(s)
    GE Force GT 610
    Sound Card
    Onboard Realtek High Def
    Monitor(s) Displays
    Dell U2913WMP
    Screen Resolution
    2560x1080
    Hard Drives
    Western Digital WD10EZEX-00RKKA0 1TB
    Seagate ST2000DL003-9VT166 2TB
    Seagate ST31000528AS 1TB
After the DISM and SCANNOW the next shutdown produced another BSOD :- " IRQL_NOT_LESS_OR_EQUAL"


I should add that I did a clean install of Windows 8 Pro X64 on September 29 and have applied all available updates.
I have installed only a few applications.

When I try to update to 8.1 I get "0xC1900101 - 0x40017".

Is it possible that I have a hardware or memory problem?
 
Last edited:

My Computer

System One

  • OS
    Windows 8.1 Pro X64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    CPU
    Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, 3601 Mhz, 4 Core(s)
    Motherboard
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    Memory
    8 GB DDR3 1600MHZ
    Graphics Card(s)
    GE Force GT 610
    Sound Card
    Onboard Realtek High Def
    Monitor(s) Displays
    Dell U2913WMP
    Screen Resolution
    2560x1080
    Hard Drives
    Western Digital WD10EZEX-00RKKA0 1TB
    Seagate ST2000DL003-9VT166 2TB
    Seagate ST31000528AS 1TB
Hi Hairy Scot ^_^,

I apologize for the late response as I have been out of town :(
I have analysed your dump file and below has been provided an analysis of the same for informative purposes :-
Code:
**************************Wed Oct  1 15:00:52.302 2014 (UTC + 5:30)**************************
Loading Dump File [C:\SysnativeBSODApps\100214-45906-01.dmp]
 
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
 
Built by: 9200.16864.amd64fre.win8_gdr.140309-1509
 
System Uptime: 0 days 1:26:38.949
 
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
 
Probably caused by : CLFS.SYS ( CLFS!CClfsLogCcb::Release+23 )
 
BugCheck A, {8, 2, 0, fffff801b48ecb3d}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000000A]IRQL_NOT_LESS_OR_EQUAL (a)[/url]
 
Arguments: 
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
 bit 0 : value 0 = read operation, 1 = write operation
 bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff801b48ecb3d, address which referenced memory
BUGCHECK_STR:  AV
 
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
 
PROCESS_NAME:  System
 
FAILURE_BUCKET_ID:  AV_CLFS!CClfsLogCcb::Release
 
CPUID:        "Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz"
 
MaxSpeed:     3200
 
CurrentSpeed: 3193
 
  BIOS Version                  F5
 
  BIOS Release Date             11/14/2013
 
  Manufacturer                  Gigabyte Technology Co., Ltd.
 
  Product Name                  To be filled by O.E.M.
 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
The dump file blames the CLFS.sys which is the Common Log File System Driver but since it is a component of Windows, chance of it being at fault is really less. Below is a list of 3rd party drivers present on your system :-
Code:
**************************Wed Oct  1 15:00:52.302 2014 (UTC + 5:30)**************************
[COLOR=#FF8C00][B][U]afcdp.sys                   Wed Jul 20 20:16:03 2011 (4E26EA2B)
[/U][/B][/COLOR]AppleCharger.sys            Wed Nov  2 08:16:00 2011 (4EB0AEE8)
Rt630x64.sys                Tue Jun 12 19:07:53 2012 (4FD74631)
RTKVHD64.sys                Tue Jun 19 14:20:56 2012 (4FE03D70)
HECIx64.sys                 Tue Jul  3 03:44:58 2012 (4FF21D62)
intelppm.sys                Thu Jul 26 07:56:48 2012 (5010AAE8)
[COLOR=#0000FF][B][U]iaStorA.sys                 Fri Aug 17 02:02:56 2012 (502D58F8)
[/U][/B][/COLOR]dump_iaStorA.sys            Fri Aug 17 02:02:56 2012 (502D58F8)
nvhda64v.sys                Wed Dec 19 11:11:41 2012 (50D15395)
nvlddmkm.sys                Fri Mar 15 07:07:00 2013 (51427B3C)
tib.sys                     Wed Mar 20 14:30:38 2013 (51497AB6)
fltsrv.sys                  Mon May 13 15:10:09 2013 (5190B4F9)
snapman.sys                 Wed Aug 14 17:47:26 2013 (520B7556)
tib_mounter.sys             Mon Sep 30 18:34:20 2013 (524976D4)
mbam.sys                    Wed Oct 30 21:41:45 2013 (52712FC1)
aswHwid.sys                 Thu Jun 26 17:01:26 2014 (53AC048E)
aswMonFlt.sys               Thu Jun 26 17:02:51 2014 (53AC04E3)
aswRdr2.sys                 Thu Jun 26 17:03:28 2014 (53AC0508)
aswKbd.sys                  Thu Jun 26 17:04:01 2014 (53AC0529)
aswSnx.sys                  Thu Jun 26 17:04:44 2014 (53AC0554)
aswRvrt.sys                 Thu Jun 26 17:05:39 2014 (53AC058B)
aswVmm.sys                  Thu Jun 26 17:05:49 2014 (53AC0595)
aswNdisFlt.sys              Thu Jun 26 17:06:26 2014 (53AC05BA)
aswStm.sys                  Thu Jun 26 17:17:09 2014 (53AC083D)
aswSP.sys                   Wed Jul  2 23:08:12 2014 (53B44384)
nvvad64v.sys                Thu Sep  4 22:40:48 2014 (54089D18)
NvStreamKms.sys             Sat Sep  6 10:07:11 2014 (540A8F77)
http://www.carrona.org/drivers/driver.php?id=afcdp.sys
http://www.carrona.org/drivers/driver.php?id=AppleCharger.sys
http://www.carrona.org/drivers/driver.php?id=Rt630x64.sys
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=HECIx64.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=iaStorA.sys
http://www.carrona.org/drivers/driver.php?id=dump_iaStorA.sys
http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
http://www.carrona.org/drivers/driver.php?id=tib.sys
http://www.carrona.org/drivers/driver.php?id=fltsrv.sys
http://www.carrona.org/drivers/driver.php?id=snapman.sys
http://www.carrona.org/drivers/driver.php?id=tib_mounter.sys
http://www.carrona.org/drivers/driver.php?id=mbam.sys
http://www.carrona.org/drivers/driver.php?id=aswHwid.sys
http://www.carrona.org/drivers/driver.php?id=aswMonFlt.sys
http://www.carrona.org/drivers/driver.php?id=aswRdr2.sys
http://www.carrona.org/drivers/driver.php?id=aswKbd.sys
http://www.carrona.org/drivers/driver.php?id=aswSnx.sys
http://www.carrona.org/drivers/driver.php?id=aswRvrt.sys
http://www.carrona.org/drivers/driver.php?id=aswVmm.sys
http://www.carrona.org/drivers/driver.php?id=aswNdisFlt.sys
http://www.carrona.org/drivers/driver.php?id=aswStm.sys
http://www.carrona.org/drivers/driver.php?id=aswSP.sys
http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys
http://www.carrona.org/drivers/driver.php?id=NvStreamKms.sys

It appears that you have installed the Avast & MalwareBytes. Till the time we are troubleshooting, I would suggest you to remove those two using **THIS** and **THIS** tool respectively.

Please update the Intel Rapid Storage as well as your Acronis Drivers. See if your manufacturer has the latest drivers for the Intel Rapid Storage or not. If not then please install the drivers from the Intel Drownload Center over **HERE**.

Let me know how it goes ^_^
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Elvis,
I have just moved the goalposts.
Have done a complete revamp of my system.
Ran exhaustive disk and memory checks. Formatted all disks.
Did fresh install of Windows 8.1 Pro X64 and reinstalled some applications, including aVast, Malwarebytes, and Acronis True Image which are three products in which I have a lot of faith.
Recovered my data from a file backup rather than a disc image.
Let's see how it goes from there.
I will mark this thread as solved.


PS

I will ensure all drivers are up to date. :)


PPS

For a variety of other reasons I have decided to drop Acronis True Image. :(
 
Last edited:

My Computer

System One

  • OS
    Windows 8.1 Pro X64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    CPU
    Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, 3601 Mhz, 4 Core(s)
    Motherboard
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    Memory
    8 GB DDR3 1600MHZ
    Graphics Card(s)
    GE Force GT 610
    Sound Card
    Onboard Realtek High Def
    Monitor(s) Displays
    Dell U2913WMP
    Screen Resolution
    2560x1080
    Hard Drives
    Western Digital WD10EZEX-00RKKA0 1TB
    Seagate ST2000DL003-9VT166 2TB
    Seagate ST31000528AS 1TB
Sure thing keep me updated.

In case of any further problems, do not hesitate to post back ^_^
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
I just installed an Intel SSD and added more memory to my PC so I decided to do a complete reinstall of Windows 8.1 Pro X64.
Guess what?
The 0xC000021A is back! :(

Once again the DISMs and SCANNOW come up clean.

I have a sneaking suspicion the problem may be related to eternal HDDs (USB).

Have attached the diagnostics.View attachment 54878
 

My Computer

System One

  • OS
    Windows 8.1 Pro X64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    CPU
    Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, 3601 Mhz, 4 Core(s)
    Motherboard
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    Memory
    8 GB DDR3 1600MHZ
    Graphics Card(s)
    GE Force GT 610
    Sound Card
    Onboard Realtek High Def
    Monitor(s) Displays
    Dell U2913WMP
    Screen Resolution
    2560x1080
    Hard Drives
    Western Digital WD10EZEX-00RKKA0 1TB
    Seagate ST2000DL003-9VT166 2TB
    Seagate ST31000528AS 1TB
Using Driver Verifier I discovered that there was a Trusteer Rapport Driver, RapportHades64.SYS, which was from an older version of Windows.
I uninstalled Rapport, ensured all traces were removed and installed from the latest setup file.
This removed the out of date driver but the BSOD continued and in fact occurred with every shutdown or restart.
So I removed Trusteer Rapport and the problem has disappeared. For now at least. :sarc:
A quick search on Google brought up a number of hits for 0xC000021Aand Rapport.
 

My Computer

System One

  • OS
    Windows 8.1 Pro X64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    CPU
    Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, 3601 Mhz, 4 Core(s)
    Motherboard
    Gigabyte Technology Co., Ltd. GA-B75M-D2V
    Memory
    8 GB DDR3 1600MHZ
    Graphics Card(s)
    GE Force GT 610
    Sound Card
    Onboard Realtek High Def
    Monitor(s) Displays
    Dell U2913WMP
    Screen Resolution
    2560x1080
    Hard Drives
    Western Digital WD10EZEX-00RKKA0 1TB
    Seagate ST2000DL003-9VT166 2TB
    Seagate ST31000528AS 1TB
I am sorry for the late response since I am having my exams.

Test your system and let me know how it goes ^_^
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Back
Top