Weird XP Issue.

[Jayce]

Our security software popped up complaining about a .DLL file. The .DLL file was directly affiliated with the printer that was installed on the computer. After getting these errors and rebooting, suddenly we're locked out of the system.

Local access does not work.
Domain accounts do not work.

"The system cannot log you on due to the following error: Access is denied. Please try again or consult your system administrator."

I booted to safe mode. Local access works fine. I even reset the administrator password from that screen and tried to log on in regular mode locally - no dice. I even created a new account in safe mode and tried to log on in regular mode locally - also no dice.

In safe mode, I can see the individual's profile. So it's an option (and one we'll probably act on) to copy the profile, re-image, and re-deploy the profile so it's back to normal.

Thing is, that doesn't "solve" anything. It's just a fix/workaround.

Any ideas?

 

[C0RR0SIVE]

Possible virus that is changing permissions even while in safemode????

 

[Jayce]

No idea. Our scanners are real-time scanners... I'm not sure what else caused this. It's obvious it's some sort of process that runs in regular mode that is disabled in safe mode that is causing this. Thing is I don't know how I can get to the task manager from the logon screen to do a spot-check and see what's running and if anything looks suspicious.

For now I think we'll back it up and blast it. But otherwise, I have no idea what else to do.

 

[KSoD]

Maybe that .dll file wasnt just associated with the Printer. Maybe it was also a .dll that Windows used in association with it domain profile loading and when you allowed the change of that file it cause the system to not boot properly. But in safe mode since that driver doesnt load it works just fine.

 

[Jayce]

I deleted the driver and rebooted.

No dice.

Gosh I love imaging. If I had to set up a manual install every time one of our Windows machines had a problem I'd go nuts. Even if it doesn't "solve" problems it's so much more efficient to just blast the image in 15 minutes than redo an install + all software over the next 2 hours.

 

[Jayce]

Turns out it was a setting in the virus scanner itself. I'm not sure where in the GUI interface you could change this option, but in the registry the company informed us we should edit a certain switch which was "block all unknown." I don't know why it blocks you out of the system if this is enabled, maybe it's a security feature of some sort... but at least we know what we gotta change prior to imaging now!