Cannot Login 1

[robros]

WIN2K Machine user explains one day it work now it dont
The machine boots but will not load the login screen it sits with the blue background and the arrow just wanting. I can get into safe mode and login with no problems.

Here is what I have done

1. Last Know good config did not work
2. Ran Repair from WIN2K cd Nothing
3. Ran Second Repair From INstall menu( when it detects the os and asks if you want to repair)
4. Ran two virus scanns and nothing found
5. Ran Two Spyware Programs NOTHING FOUND

What else can I try...

Reinstall is my last resort I dont have a ton of time in this yet so I am willing to try other things

Any Ideas

Again thanks its great to have a place like this


If two wrongs do make a right then how can to wrights make and airplane fly ?

 

[Tearose]

When a similar thing happened to a computer at work, I called the manufacturer, and he said it needed a new install, so that's what I'd recommend, provided you have a way to back up important files first, and can get the installation keys for all software. He also recommended downloading Belarc Advisor to tell me what's on the computer. Great little program!

 

[robros]

Tearose

Thanks but much like my listing stayed I would like to avoid that if possible give the small amount of time invested so far




If two wrongs don't make a right then how can to wrights make and airplane fly ?

 

[Live2Die]

Have you applied any new Service Packs before you noticed the problem. If so check the documnetation to them and see if there are any issues with your hardware and the service pack.

Life is a mind game
Wanna Play?

 

[sostek]

If you need to extract data from it, get a copy of Knoppix. It's a Linux OS that boots from a CD and reads NTFS partitions without any problems. It also connects to the net easily.

WRT service packs, if you didn't check off not to back up files you can uninstall them in safe mode and see if you can get in then.

 

[bcastner]

Download and re-apply the newest driver set for your video board in Safe Mode with Networking.

If I had to guess, Windows update pushed out to this client an inappropriate video driver update.

 

[robros]

I will try that

Just an add note I attempted to run the SFC from safe mode and got an error stating the RPC service is not availble ?

If two wrongs don't make a right then how can to wrights make and airplane fly ?

 

[bcastner]

SFC will not run from Safe Mode.

 

[robros]

Ok that rules one thing out

Do have any other IDeas I can try to get this thing working again?

If two wrongs don't make a right then how can to wrights make and airplane fly ?

 

[bcastner]

From a second machine with a working network connection, download two things:

AutoRuns:

http://www.sysinternals.com/ntw2k/freeware/autoruns.shtml

Hijack This!: links can be found in faq608-4650

Bring both to the troubled machine and boot that machine into Safe Mode. Create new folders for both and unpack the files.

. Run Autoruns. Are there entries there you do not recognize or seem questionable? If so checkmark them to disable them.

Try a normal boot and logon.

. If no joy, return to Safe Mode (you could try Safe Mode with Networking) and the Hijack This folder you created. Run Hijack This and post the results here.

 

[robros]

Before you posted I reinstalled clean and still same error

Autorun file (to me a fresh install it lookst ok )

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

+ C:\WINNT\system32\userinit.exe Userinit Logon Application Microsoft Windows 2000 Publisher c:\winnt\system32\userinit.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

+ Explorer.exe Windows Explorer Microsoft Windows 2000 Publisher c:\winnt\explorer.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

+ SchedulingAgent Task Scheduler Setup Microsoft Windows 2000 Publisher c:\winnt\system32\mstinit.exe

+ Synchronization Manager Microsoft Synchronization Manager Microsoft Windows 2000 Publisher c:\winnt\system32\mobsync.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

+ MigrateMMDrivers Control Panel Drivers Applet Microsoft Windows 2000 Publisher c:\winnt\system32\mmsys.cpl

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

+ WinZip Quick Pick.lnk WinZip Executable (Not verified) WinZip Computing, Inc. c:\program files\winzip\wzqkpick.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

+ ^SetupICWDesktop Internet Connection Wizard Microsoft Windows 2000 Publisher c:\program files\internet explorer\connection wizard\icwconn1.exe



If two wrongs don't make a right then how can to wrights make and airplane fly ?

 

[robros]

HIJACK THIS LOG

Logfile of HijackThis v1.99.1
Scan saved at 1:34:23 PM, on 5/27/2005
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\autoruns.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /firstlogon
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\RunOnce: [MigrateMMDrivers] rundll32.exe mmsys.cpl,mmseRunOnce
O4 - HKCU\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O20 - Winlogon Notify: EFS - C:\WINNT\SYSTEM32\sclgntfy.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe



If two wrongs don't make a right then how can to wrights make and airplane fly ?

 

[robros]

Ran this on my machine I use for work Same OS differnt Hdwe

Logfile of HijackThis v1.99.1
Scan saved at 13:53:36, on 27-May-05
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\ntpd.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\system32\kmw_run.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2004\MemOptimizer.exe
C:\WINNT\system32\KMW_SHOW.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\WISPTIS.EXE
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Visio\Visio32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Citrix\icaweb32\wfica32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\rross\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://tech.msn.com/news/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by ClinPhone Inc.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.10.231:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =

http://clinsweep2.clinphone.com;<local>

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [kmw_run.exe] kmw_run.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2004\MemOptimizer.exe" autostart
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office 200\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.0\bin\npjpi140.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.0\bin\npjpi140.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI3ED3~1\OFFICE11\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nj.clinphone.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nj.clinphone.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = nj.clinphone.com
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: NetworkTimeProtocol - Unknown owner - C:\WINNT\system32\ntpd.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe





If two wrongs don't make a right then how can to wrights make and airplane fly ?

 

[bcastner]

Your Hijack logs are clean on both machines. (You were not kidding it was run after a clean install on the first one).

This is clearly a hardware issue. Have you investigated the possibility of leaky capacitors?

http://www.badcaps.net/ident/