My wife’s laptop has a tendency to lose the list of users presented in XP (Pro) when booting up. You see the normal blue logon window, but no list to choose an account from. Safe boot shows the same thing. Ultimately I wind up reinstalling windows, but that’s getting old, as this has happened 4 or 5 times now.
Anyone familiar with this particular problem? And please spare me any “get a MAC” advice.
As a PS, we always have McAfee Virsu scan up to date, so I’m doubting that it’s viral in nature (but I could be wrong).
That would be just a different login mode, and can be changed back.
You can just type in the user name to login to the system in that mode, and password if used.
No, you’re not understanding my problem. Normally I use the login mode that does list all the available accounts on the machine. Problem is there is no list showing. I see the welcome screen, just no choices of users.
I cannot logon.
You said that the login window is there without the list. That would be the screen with a blank box in which you can type in the account user name. There will not be a list of names.
The XP logo screen would be a hang in the OS system and indicative of a computer not fully compliant to run XP.
Yeah it doesn’t sound like a user accounts / logon problem, but rather a startup crash.
I’d suggest booting with Boot Logging Enabled (selectable through the F8 menu before windows starts up). It will create a file called ntbtlog.txt. Have a look to see what’s the last entry in that file, and it’s likely the driver/service that’s hanging and preventing the User Logon screen from coming up.
At the screen where you would normally get the list of accounts, if you press CTRL-ALT-DEL twice you ought to get the old-style login dialog, at which you can type in the account name and enter the password. That should get you into Windows, where you can investigate further what’s going on with the user accounts. If it doesn’t bring up the dialog box at all, then that’ll pretty much confirm that it’s a startup crash, as the others here have suggested.
Possibly a hardware compatibility issue, or a corrupted driver. Or both. Or neither.
Not sure what you mean that you don’t have access to the boot log. Have you tried booting to the command prompt (F8, again) and looking at it The Old Fashioned Way (i.e. DOS commands)?
If it’s still acting as a print server, you should be able to access it remotely. Try connecting to the c$ share - \problem_machine\c$ and doing a search for *.log. Secondly, do you have Remote Desktop enabled? If so, you should be able to connect via that, and if not, you can enable it remotely by starting the Remote Access Connection Manager.
This sounds like malware. When you try to map a drive, you are using machinename\username aren’t you? Try connecting to Admin$ instead, then create a new share pointing at C:. You must use an administrator-level account.
Ah, it’s not installed on Windows 2000, but you should be able to install it from your Windows XP disk. Autorun the CD and it’s one of the menu options (I forget which).
I’m out of luck. Any attempt to logon/connect to my wife’s machine is refused with an incorrect password. Since it only had 2 accounts (admin and one other) and I set the passwords the same, and neither work, there must be corruption of some sort.
This is the work of 15 mins or less with the right tools, probably. However I’m not going to detail them in an open forum, and I’m not sure that you’d be comfortable using them anyway. Your local generic PC clone maker should have them and be able to help you. It will cost you, of course, but how valuable is your data?
One last thing, though: do you have simple networking turned on? If so, turn it off, and when you map a drive, select ‘Connect as a different user’.
Here’s the deal. There are some shares on the “affected” machine that are still accessible, so there is no personal data that I cannot retrieve.
I’m just really tired/pissed off that this crap keeps happening. I keep everything up to date on that machine (antivirus/anti-spyware), I’m really dilligent. No bs, this must be the fourth time this has happened in a year, and I want to know the whe f*ck is happening so I can prevent it, yet I’m always in the same boat, in that I can access any info of value to debug this.
One other thing I forgot to mention. Right after it died, I did a boot with “use last known good …”. It said it found some registry corruption and would repair it. But the repair does nothing.
Anyway, I do have simple networking turned on. I already tried connect as a different user (when I try to map drives), but I’ll try it again after disabling simple networking.
I appreciate your help; I just can’t believe this isn’t a common documented problem.
This is interesting. The sdbot family of worms, for example, specifically target the c$ and c shares. There are specific registry entries for this.
From the information given it does sound like malware, so what’s happenning to the machine that it gets infected? Does your wife take the laptop to clients and plug it in to their networks? Does it have a wireless or infrared link that she keeps enabled? Does she connect it directly to the internet - no firewall or NAT device in the way? She’s got a virus-checker but does she use a firewall? Something like ZoneAlarm?
Supposing it’s not malware: is the machine’s BIOS up to date? When you reinstall XP, do you do it from system restore CDs or off an XP CD? If the latter, you should install any chipset drivers first.
I’m not being clear. I made her c drive shareable. That share works to a point. Since the user accounts seem to be hosed I cannot access certain subfolders (like c:\windows c:\program files. I also had the foresight to make her documents folder shareable. That’s also okay. So like I said, no data lost but I cannot access anything to help me debug what went wrong; and since this is a recurring problem I’m rather annoyed.
AS for connectivity, the laptop never leaves the desk, it has a hard connection to the router. My wife rarely has time to use it. It’s mostly me if it’s left up (not the norm). The last thing we did was look at some reknowned window installer sites (as in Anderson windows, etc). I’ve looked at those sites with my machine as well, so any worms should have got me too. Both machines have upto McAfee and various anti-spyware s/w. Only the XP SP2 machine gets slammed.
I did remember one possibly interesting fact. This stuff all started happening after SP2 was made available. Naturally when I reformatted the machine, I reinstalled the original XP Pro, and then let the windows updater guide me to being current.
I still think the logfile is the key to find out what’s causing the computer to hang on startup. If it’s so early that it prevents safe mode as well, it must be something fundamental.
Get a Linux LiveCD and boot to it. Now you’ll be able to browse the filesystem and you can find that .log file.