When you use Performance Monitor to monitor a computer (either locally or from a remote computer), the monitored computer may experience a STOP:0xC000021A or you get
WinLogon.exe App. Error - The instruction at xzzzzzzzz referenced memory at xyyyyyyyy. The memory could not be read. Click OK to terminate the app
when you add an object.
This normally indicates a problem with an extensible Performance Counter overwriting its' buffers.
Disable the malfunctioning performance counter's .dll by renaming or removing its entry from the Windows NT registry. Use Regedt32 to browse to:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Click Find Key on the View menu and enter performance and press Find Next. For each performance key, select the Library value and modify the library name by prefixing it with xx so that name.DLL becomes xxname.DLL.
Now find the next performance key and repeat the process. When you have changed all the performance keys, restart Performance Monitor. If it works, restore the first library value and retry Performance Monitor until you locate all the failing counters.
If you have Exctrlst.exe from the
, you can get a list of all the extensible counters in the registry, making your task somewhat easier.
