Re: Server is working but unable to logon by any means

I was looking into this
http://www.symantec.com/security_response/writeup.jsp?docid=2005-070514-5200-99&tabid=2
but didn't find anything of mentioned on my system. However I'm still havin
SideBySide errors in event log. To give better overview here're the errors
from event log:

Event Type: Error
Event Source: SideBySide
Event Category: None
Event ID: 59
Date: 9/12/2006
Time: 2:52:49 PM
User: N/A
Computer:
Description:
Generate Activation Context failed for System Default Context. Reference
error message: The referenced assembly is not installed on your system.
..


Event Type: Error
Event Source: SideBySide
Event Category: None
Event ID: 32
Date: 9/12/2006
Time: 2:52:49 PM
User: N/A
Computer:
Description:
Dependent Assembly Microsoft.Windows.IsolationAutomation could not be found
and Last Error was The referenced assembly is not installed on your system.





"Martin" <no@xxxxxxxxx> wrote in message
news:%236NsKEx1GHA.476@xxxxxxxxxxxxxxxxxxxxxxx
yes I said it's working, and it was working until I rebooted it.
Yesterday I end up with restoring the system partition. After that it was
all ok and when I was leaving work, server was working with no problem,
loggin in to the system was working as well. When I arrived today I found
the server in the same state as it was yesterday (before the reboot). It's
working but will not log you in. Fortunately after the restore I left my
terminal session open so I'm connected to server and can work via TS as
well. SlideBySlide errors reapeared in event log again so it looks like
the malware which Edwin mention in this thread.

Martin

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:%23uaxtXr1GHA.324@xxxxxxxxxxxxxxxxxxxxxxx
There are several ways to access your server's hard disk:
- From a networked PC (you said that the server is working!)
- By booting it with a Win98 boot disk (www.bootdisk.com)
and running ntfsdos.exe (www.sysinternals.com).
- By booting it with a Bart PE boot CD
http://www.nu2.nu/pebuilder/#download


"Martin" <no@xxxxxxxxx> wrote in message
news:OQqx2Co1GHA.4176@xxxxxxxxxxxxxxxxxxxxxxx
couldn't find that out because system is unaccessible, it won't boot to
any
mode, still end's on background

Martin

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:OF%23fxjn1GHA.4816@xxxxxxxxxxxxxxxxxxxxxxx
. . . and the age of the files in the Repair directory?

"Martin" <no@xxxxxxxxx> wrote in message
news:eTLNNhn1GHA.1548@xxxxxxxxxxxxxxxxxxxxxxx
I changed the registry settings back to original settings and
rebooted
after
that. So I've rebooted the server with no changes done at all. And
the
result is as I described.

answers:
- Safe Mode is not working - same issue it will not display logon
screen
only the background
- Last known good configuration does not help
- Yes I proved that userinit.exe is the same file as it was on the
other
servers
- No I didn't scan my machine manualy however there's antivirus
software
installed (SAV) which scans the system on regular basis and raises
and
alarm
if virus is detected. AV software had up to date definitions.

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:enCRxan1GHA.4976@xxxxxxxxxxxxxxxxxxxxxxx
It seems you have gone backwards. In your first post
you reported that you could enter your logon credentials
but that the logon session would terminate quickly. This
is usually caused by userinit.exe not doing its job. You
now report that you do not even get a logon screen.
I recommend that you undo the registry changes you
made in order to restore the system to its previous
state.

Some questions:
- Have you tried Safe Mode?
- Have you tried Last Known Good Configuration?
- What is the date of the registry backup files in
c:\windows\repair?
- Did you prove to your satisfaction that userinit.exe
is intact and is not some malware program?
- Have you scanned your machine for viruses?


"Martin" <no@xxxxxxxxx> wrote in message
news:uzUc$Vn1GHA.4816@xxxxxxxxxxxxxxxxxxxxxxx
I just rebooted the system, it will come up but only screen is
displayed,
no
logon window or so. Only background, does not matter in which mode
I'll
boot
up the server. THanks

Martin

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:ufJnLzm1GHA.3372@xxxxxxxxxxxxxxxxxxxxxxx
Make sure that this is a reg_sz value, without any quotes.
You should also ensure that userinit.exe has not been
replaced by some malware program of the same name.


"Martin" <no@xxxxxxxxx> wrote in message
news:O9rTrjm1GHA.4176@xxxxxxxxxxxxxxxxxxxxxxx
Thanks for the reply, but my driver letter didn't change and
userinit.exe
is
in System32 folder. However I found that path to userinit.exe
was
set
in
registry to "C:\Winnt\system32\userinit.exe," (winnt is my
installation
folder) so I removed "," from the path. I will see if it makes
any
difference after reboot. Thanks

Martin

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:%23CxDcOm1GHA.476@xxxxxxxxxxxxxxxxxxxxxxx
Have a look at the item "Server Logoff", posted in this
newsgroup
two days ago.


"Martin" <no@xxxxxxxxx> wrote in message
news:e15CO8l1GHA.4452@xxxxxxxxxxxxxxxxxxxxxxx
Dear All,

I'm having strange issues with our Windows 2003 Standard.
It's
a
file
server
with also DHCP service installed on it. It has latest OS
patches
installed.

The issue is following:

anytime I try to logon to server via terminal services,
after
entering
logon
credentials it displays "Loading your personal settings"
then
"applying
settings..." and after that immediately displays "Saving
your
settings"
and
will log you off and close the terminal session. Same
happens
if
I
try
to
log on to console (physicaly not remotely). I can see
hundrets
of
messages
from source "SideBySide" with IDs 32 and 59. The sequence of
events
is
32,
59,59 and this is reapeating all the time every few seconds.
All
services
served by server are working and there seems to be nothing
wrong
with
it
expect of unability to log on it (which is quite important
function
for
me
;-)). This issue is lasting for a week already and I'm
stucked.
Does
anyone
know what can cause this? Many thanks

--
Martin

























.

Relevant Pages

  • Re: Event ID 537
    ... Nothing on workstation has changed, although I have recently applied SP1 for the SBS2003 server. ... I have around 2000-3000 errors in my event log. ... An error occurred during logon ...
    (microsoft.public.windows.server.sbs)
  • Re: Preparing Network Connections... forever
    ... Windows IP Configuration ... "Replication Services" event log contained the same error as originally posted. ... The Security System detected an authentication error for the server ldap/Client-1DC.client-1.local. ... The failure code from authentication protocol Kerberos was "There are currently no logon servers ...
    (microsoft.public.windows.server.active_directory)
  • Re: Terminal services suddenly have stopped working..
    ... I am not sure if the event in the event log is related to your logon failure. ... I would suggest checking all the policy values that may deny you logon to server. ... terminal server users group and they were connecting to this server.. ...
    (microsoft.public.windows.terminal_services)
  • Re: Preparing Network Connections... forever
    ... Windows IP Configuration ... "Replication Services" event log contained the same error as originally posted. ... The Security System detected an authentication error for the server ldap/Client-1DC.client-1.local. ... The failure code from authentication protocol Kerberos was "There are currently no logon servers ...
    (microsoft.public.windows.server.active_directory)
  • Re: DC diag ERROR
    ... Connecting to directory service on server aedak-server. ... The DC AEDAK-SERVER is advertising itself as a DC and having a DS. ... The File Replication Service Event log test ...
    (microsoft.public.windows.server.dns)