Re: Server is working but unable to logon by any means

yes I said it's working, and it was working until I rebooted it. Yesterday
I end up with restoring the system partition. After that it was all ok and
when I was leaving work, server was working with no problem, loggin in to
the system was working as well. When I arrived today I found the server in
the same state as it was yesterday (before the reboot). It's working but
will not log you in. Fortunately after the restore I left my terminal
session open so I'm connected to server and can work via TS as well.
SlideBySlide errors reapeared in event log again so it looks like the
malware which Edwin mention in this thread.

Martin

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:%23uaxtXr1GHA.324@xxxxxxxxxxxxxxxxxxxxxxx
There are several ways to access your server's hard disk:
- From a networked PC (you said that the server is working!)
- By booting it with a Win98 boot disk (www.bootdisk.com)
and running ntfsdos.exe (www.sysinternals.com).
- By booting it with a Bart PE boot CD
http://www.nu2.nu/pebuilder/#download


"Martin" <no@xxxxxxxxx> wrote in message
news:OQqx2Co1GHA.4176@xxxxxxxxxxxxxxxxxxxxxxx
couldn't find that out because system is unaccessible, it won't boot to
any
mode, still end's on background

Martin

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:OF%23fxjn1GHA.4816@xxxxxxxxxxxxxxxxxxxxxxx
. . . and the age of the files in the Repair directory?

"Martin" <no@xxxxxxxxx> wrote in message
news:eTLNNhn1GHA.1548@xxxxxxxxxxxxxxxxxxxxxxx
I changed the registry settings back to original settings and rebooted
after
that. So I've rebooted the server with no changes done at all. And the
result is as I described.

answers:
- Safe Mode is not working - same issue it will not display logon
screen
only the background
- Last known good configuration does not help
- Yes I proved that userinit.exe is the same file as it was on the
other
servers
- No I didn't scan my machine manualy however there's antivirus
software
installed (SAV) which scans the system on regular basis and raises and
alarm
if virus is detected. AV software had up to date definitions.

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:enCRxan1GHA.4976@xxxxxxxxxxxxxxxxxxxxxxx
It seems you have gone backwards. In your first post
you reported that you could enter your logon credentials
but that the logon session would terminate quickly. This
is usually caused by userinit.exe not doing its job. You
now report that you do not even get a logon screen.
I recommend that you undo the registry changes you
made in order to restore the system to its previous
state.

Some questions:
- Have you tried Safe Mode?
- Have you tried Last Known Good Configuration?
- What is the date of the registry backup files in
c:\windows\repair?
- Did you prove to your satisfaction that userinit.exe
is intact and is not some malware program?
- Have you scanned your machine for viruses?


"Martin" <no@xxxxxxxxx> wrote in message
news:uzUc$Vn1GHA.4816@xxxxxxxxxxxxxxxxxxxxxxx
I just rebooted the system, it will come up but only screen is
displayed,
no
logon window or so. Only background, does not matter in which mode
I'll
boot
up the server. THanks

Martin

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:ufJnLzm1GHA.3372@xxxxxxxxxxxxxxxxxxxxxxx
Make sure that this is a reg_sz value, without any quotes.
You should also ensure that userinit.exe has not been
replaced by some malware program of the same name.


"Martin" <no@xxxxxxxxx> wrote in message
news:O9rTrjm1GHA.4176@xxxxxxxxxxxxxxxxxxxxxxx
Thanks for the reply, but my driver letter didn't change and
userinit.exe
is
in System32 folder. However I found that path to userinit.exe
was
set
in
registry to "C:\Winnt\system32\userinit.exe," (winnt is my
installation
folder) so I removed "," from the path. I will see if it makes
any
difference after reboot. Thanks

Martin

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:%23CxDcOm1GHA.476@xxxxxxxxxxxxxxxxxxxxxxx
Have a look at the item "Server Logoff", posted in this
newsgroup
two days ago.


"Martin" <no@xxxxxxxxx> wrote in message
news:e15CO8l1GHA.4452@xxxxxxxxxxxxxxxxxxxxxxx
Dear All,

I'm having strange issues with our Windows 2003 Standard.
It's
a
file
server
with also DHCP service installed on it. It has latest OS
patches
installed.

The issue is following:

anytime I try to logon to server via terminal services, after
entering
logon
credentials it displays "Loading your personal settings" then
"applying
settings..." and after that immediately displays "Saving your
settings"
and
will log you off and close the terminal session. Same happens
if
I
try
to
log on to console (physicaly not remotely). I can see
hundrets
of
messages
from source "SideBySide" with IDs 32 and 59. The sequence of
events
is
32,
59,59 and this is reapeating all the time every few seconds.
All
services
served by server are working and there seems to be nothing
wrong
with
it
expect of unability to log on it (which is quite important
function
for
me
;-)). This issue is lasting for a week already and I'm
stucked.
Does
anyone
know what can cause this? Many thanks

--
Martin























.

Relevant Pages

  • Re: Another disaster recovery exercise (but not yet)...
    ... Do the full system state restore. ... I updated a client's Server. ... > indeed, I reboot before updating, and after ). ... Still very slow boot time and many ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Server is working but unable to logon by any means
    ... I changed the registry settings back to original settings and rebooted after ... So I've rebooted the server with no changes done at all. ... Safe Mode is not working - same issue it will not display logon screen ... difference after reboot. ...
    (microsoft.public.windows.server.general)
  • Restoring Windows 2003 Server (Enterprise) system state results in continuous rebooting
    ... We have a single Windows 2003 Server running as a DC, AD, File, DNS ... Restore procedure and results are as follows: ... boot into directory restore mode, get the .bkf file conaining the ... continuous reboot loop. ...
    (microsoft.public.windows.server.general)
  • Restoring Windows 2003 Server (Enterprise) system state results in continuous rebooting
    ... We have a single Windows 2003 Server running as a DC, AD, File, DNS ... Restore procedure and results are as follows: ... boot into directory restore mode, get the .bkf file conaining the ... continuous reboot loop. ...
    (microsoft.public.windows.server.general)
  • Cant login the morning after.
    ... I tried to log on after a reboot and got 2 ... logon after multiple reboots without getting a error ... server re-syncronize. ... >Each workstation has netbios turned off, ...
    (microsoft.public.windowsxp.security_admin)