Win2k Logon Issue

[thelanlegend]

The computer I am working with is having issues logging in. About 9 times out of 10 the system will hang right after trying to log in as a user (doesn't matter which one). The system is still running, it hasn't crashed, and there isn't anything out of the ordinary in the task manager. The system was reformatted about 3 days ago, so the system is fairly clean, and running minial software.

The only fix I have so far is to log the user off and log back in. Any suggestions?

 

[mattjurado]

Have you looked at event viewer?
Did this happen right after the format, or after you installed patches and applications, etc...

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[thelanlegend]

It was doing this before I got ahold of it, when there weren't any updates applied, and also after I got ahold of it when I reformatted and applied all the patches. I did check event veiwer, and it did have three different errors listed, but they were almost random, it was teh same three, but only one of them would show up per boot, and there wasn't any kind of pattern to their appearance.

(Forgive me for not having them at the moment, for I am at home right now, but I will post them tommorrow)

 

[thelanlegend]

Actually it turned out to be a virus problem--one that Norton Antivirus, updated to current, could not detect. A little registry editing fixed it right up and the problem was resolved. Thanks for your help Matt, and anyone that wants more details on this, ask and you shall recieve.

 

[Davetoo]

What was the virus? and what was the fix?

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[thelanlegend]

We ran Trend Micro's Sysclean Utility (

http://www.trendmicro.com/download/dcs.asp)

and it found the virus Agabot.worm.

The method we used to find that the system was in need of a deeper scan was running through the task manager when the system hung, we found there to be 2 instances of the process "USB2.exe" one of which access to end the process was denied, and the other instance would appear and dissappear constantly. Ending that process allowed the system to boot normally.

Searching the registry we found three conspicuous files:
USB2.exe
System32.exe
SVHost.exe (not to be confused with SVCHost.xe)

All of these files could be found in the "run" section of the registry. They were even sitting nicely together under the "RunServices" key. Googling these files brought up references to numerous virii.

Sysclean is still scanning as we speak, but it found things Norton didn't so this just might fix us up. If you haven't used or atleast added sysclean to your toolkit, I suggest it.

 

[Davetoo]

I've had several people recommend the Trend product...might be time to look into it.

Thanks.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.