Login starts then returns to Initial screen

[Guest]

wAll

I have a problem with a Windows 2000 server which was recently compromised
and used for SPAM. After the comprimise the system was trying to run A.TMP
out of the system32 folder as on loging i was prompted with the choose app to
run this with dialog. I thought i had fixed the problem by applying the
patch from MS but on reboot i can no longer login.

No i can remote access to the server via PCAnywhere and it veries the user
and PWD against windows and starts the session then i enter my credentials
for login, submit,and my settings start to load but then i gat the saving
settings and back to the logon screen

Anyone had experience of this and any possible solutions to get me logged in?

Later

Dave

 

[Steven L Umbach]

With a compromised server you really should consider a pristine install of
the operating system to make sure it is secure and working at peak
performance taking steps to prevent problems again or you may continue to
have the same problem.

Having said that you could try booting into Safe Mode and/or last known good
configuration to see if that makes a difference or not. If that does not
help you will need to check the permissions on the \documents and settings
folder, root folder, and \windows and \windows\system32 folders to make
sure users have proper permissions and I believe that lack of permissions to
userinit.exe in winnt\system32 for Windows 2000 can also give that type of
problem. Users have read/list/execute for just about everywhere other than
their user profile folders where they normally have full control. You could
try doing that via the network and also check the Event Viewer via the
network by using Computer Management - connect to another computer from
another computer on the network to see if anything is recorded in the logs
at the time of logon attempt that may give a clue.

Steve

 

[Roger Abell [MVP]]

What you say happens in a login starting to load but then bailing, tossing
you back to the login, can be caused by a corrupt profile, munged login
scripts, etc.. among other things.