Page 1 of 2 12 LastLast
Results 1 to 15 of 19
  1. #1
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    I just had a call from a client who tells me he can't log on to his XP Home system and has a Blue Screen and nothing else. I asked him to reboot and tell me what comes up and he tells me that there was "something" before the Blue Screen. He booted the system and read me the following.....
    "Windows cannot load the user's profile but has logged you on with the default profile for the system.

    DETAIL - Insufficient system resources exist to complete the requested service"
    The system then counts down from 30 and boots to the BSOD again.

    I'm going to his location tomorrow, but wanted some input before I go. The error he is reporting seems to be for a 2003 Server and not XP.

    My thought is that the profile is corrupt and I may have to log on in Safe Mode as the Administrator and create a new profile, then log on tho that profile and move the data & settings from the old profile to the newly created profile and when all seems right in the new profile, delete the old one.

    Thoughts ??
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  2. #2
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,572
    Thanks
    5
    Thanked 1,057 Times in 926 Posts
    [quote name='DocWatson' post='795361' date='28-Sep-2009 14:44']I just had a call from a client who tells me he can't log on to his XP Home system and has a Blue Screen and nothing else. I asked him to reboot and tell me what comes up and he tells me that there was "something" before the Blue Screen. He booted the system and read me the following.....
    "Windows cannot load the user's profile but has logged you on with the default profile for the system.

    DETAIL - Insufficient system resources exist to complete the requested service"
    The system then counts down from 30 and boots to the BSOD again.

    I'm going to his location tomorrow, but wanted some input before I go. The error he is reporting seems to be for a 2003 Server and not XP.

    My thought is that the profile is corrupt and I may have to log on in Safe Mode as the Administrator and create a new profile, then log on tho that profile and move the data & settings from the old profile to the newly created profile and when all seems right in the new profile, delete the old one.

    Thoughts ??[/quote]

    Really need more details on BSOD.

    You might try booting to "Last known good configuration".

    Is this Terminal Server?

    Joe
    Joe

  3. #3
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    [quote name='joeperez' post='795371' date='28-Sep-2009 16:23']Really need more details on BSOD.

    You might try booting to "Last known good configuration".

    Is this Terminal Server?

    Joe[/quote]

    Yes, I tried to pry more out of him, and even offered to save him some $$$ by walking him through a Safe Mode boot to try "Last known good...." but he wants me to come down. I will try the "Last know good..." option first as that would be much easier than rebuilding his profile.

    The machine is a stand alone personal PC in an Antique store that the client uses for his personal stuff and does a little selling on eBay. No server involved.

    Thanks for the input Joe.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  4. #4
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    To update this, I went to the client's store this AM and had a very difficult time getting the system to boot into Safe Mode. As far as I could tell from the limited info on the screen, it was trying to boot into a Network when I couldn't get it into Safe Mode and when it booted into Safe Mode (finally) it offered F2 & F12 in the upper right corner rather than F2 and Booting to Network.

    In Safe Mode I was able to open an Administrator account and from there created new user account with Administrator privileges and logged off. Then logged on to the new user in Safe Mode and logged of and logged in on the old (bad) account with no problem. Logged off and logged into the Administrator account and after changing view settings to show Hidden files & folders, went to My Computer>C:>Documents & Settings>John(the bad profile) and renamed the NTUSER.DAT folder to NTUSER.DAT(old) and rebooted.

    The new profile, John2 was there on the Welcome screen along with the old John profile. Tried the old profile first and it wouldn't load and gave the same error message about Windows not being able to load the profile and clicking OK the system froze there. Booted back into Safe Mode and went back and renamed the user John folder John.old and rebooted.

    Again, had both profiles available & booted to John with the same result. Rebooted and tried John2 with the same result as John. It seems something is corrupting the profiles but I can't be sure and wouldn't know what to do if I was sure.

    The computer was not connected to the internet during this entire process, so that shouldn't have any bearing on the problem. I booted back into Safe Mode and tried to use System Restore, but there were no restore points AT ALL !!!

    I brought the machine home with me and will play with it here where I have internet access and can pull the drive and slave it to my system if necessary to clean it up or add files to replace corrupt files. Any ideas what's up and where I should go from here ??

    Thanks.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  5. #5
    Uranium Lounger viking33's Avatar
    Join Date
    Jun 2002
    Location
    Cape Cod, Massachusetts, USA
    Posts
    6,308
    Thanks
    0
    Thanked 1 Time in 1 Post
    [quote name='DocWatson' post='795532' date='29-Sep-2009 14:03']I brought the machine home with me and will play with it here where I have internet access and can pull the drive and slave it to my system if necessary to clean it up or add files to replace corrupt files. Any ideas what's up and where I should go from here ??

    Thanks.[/quote]
    Doc,
    Any chance of doing a Repair Reinstall? Do you have his XP CD to boot to?
    BOB
    http://lounge.windowssecrets.com/S/flags/USA.gif http://lounge.windowssecrets.com/S/f...sachusetts.gif


    Long ago, there was a time when men cursed and beat on the ground with sticks. It was called witchcraft.
    Today it is called golf!

  6. #6
    Plutonium Lounger Leif's Avatar
    Join Date
    Dec 2000
    Location
    U.K.
    Posts
    14,010
    Thanks
    0
    Thanked 0 Times in 0 Posts
    [quote name='DocWatson' post='795532' date='29-Sep-2009 19:03']Any ideas....[/quote]
    A thorough Chkdsk?

  7. #7
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    [quote name='viking33' post='795543' date='29-Sep-2009 15:00']Doc,
    Any chance of doing a Repair Reinstall? Do you have his XP CD to boot to?[/quote]
    Nope. It's an OEM machine from Dell and he never made a restore disk. I have my XP CD, but it's XP Pro and his is XP Home. May try that as a last resort, but I'm concerned it might make things worse.

    Thanks for the idea.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  8. #8
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    [quote name='Leif' post='795549' date='29-Sep-2009 15:36']A thorough Chkdsk?[/quote]
    For some reason, it did a Chkdsk routine during one of those reboots this afternoon. Suprised the heck out of me, because I hadn't set it up to run and he wouldn't know how or why to run it.

    Since the only way I can access the Windows GUI is in Safe Mode, can I setup a Chkdsk run from there and please refresh my memory about the correct command to have it fix what it finds.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  9. #9
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    Moving on with this, I pulled the drive, slaved it to my system and ran Malwarebytes. It found nothing, but during the scan Avast lit up 3 times and I quarantined 3 trojans from the Recycler folder. 2 Win32 Trojan gen and 1 Win32 Goblin. I also ran Chkdsk /f and Chkdsk /r and all seemed OK. I then went into the Documents and Settings folder and checked the different profiles and their ntuser.dat files and ntuser.logs. All contained the word Dirty, although not quite spelled like that. I don't know if this is significant, but felt it worth mentioning.

    I've had all the fun I can stand for one night and have reinstalled the drive and will connect the system up tomorrow and see if anything is different, but I'm not counting on it.

    Any further suggestions are welcome.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  10. #10
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,572
    Thanks
    5
    Thanked 1,057 Times in 926 Posts
    [quote name='DocWatson' post='795606' date='29-Sep-2009 21:12']Moving on with this, I pulled the drive, slaved it to my system and ran Malwarebytes. It found nothing, but during the scan Avast lit up 3 times and I quarantined 3 trojans from the Recycler folder. 2 Win32 Trojan gen and 1 Win32 Goblin. I also ran Chkdsk /f and Chkdsk /r and all seemed OK. I then went into the Documents and Settings folder and checked the different profiles and their ntuser.dat files and ntuser.logs. All contained the word Dirty, although not quite spelled like that. I don't know if this is significant, but felt it worth mentioning.

    I've had all the fun I can stand for one night and have reinstalled the drive and will connect the system up tomorrow and see if anything is different, but I'm not counting on it.

    Any further suggestions are welcome.[/quote]

    Have you run any rootkit detection?

    Could be some other hardware issue such as bad RAM. Have you run a memory test?

    Joe
    Joe

  11. #11
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    [quote name='joeperez' post='795648' date='30-Sep-2009 08:58']Have you run any rootkit detection?

    Could be some other hardware issue such as bad RAM. Have you run a memory test?

    Joe[/quote]

    I just connected the system up and attempted to run it normally. No joy. But I was more observant on boot up and noticed that the upper right corner reads F2 Setup and below that "Attempting Network Boot". The machine has NEVER been part of a network and this doesn't seem right as I recall the second line being different on other occasions when booting yesterday, but cannot recall what it was.

    I haven't run any Rootkit detection software. I can still only access the GUI in Safe Mode. I'm going to pul the drive again later today, slave it to my system again and copy off the users data, email, favorites and settings for safe-keeping, copy the ntuser.dat, ntuser.dat.log andntuser.ini files for all profiles so they can be analyzed and then run rootkit detection and whatever else I have available to rule out any malware or virus issues. The Device Manager shows no problems with the hardware.

    I've never run a memory test. Can you tell me what is involved ??
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  12. #12
    4 Star Lounger
    Join Date
    Jan 2001
    Location
    Dundee, Scotland
    Posts
    404
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Hi,

    You say that the PC was a Dell. Does it have a recovery partition to allow re-installs? Ours here certainly do (even though computer services have imaged the whole lot with Windows 2000). Not sure how you'd access it though, but the info here might help.
    John (Unreconstructed Jacobite)

  13. #13
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    [quote name='jonWallace' post='795688' date='30-Sep-2009 11:45']Hi,

    You say that the PC was a Dell. Does it have a recovery partition to allow re-installs? Ours here certainly do (even though computer services have imaged the whole lot with Windows 2000). Not sure how you'd access it though, but the info here might help.[/quote]

    Thanks for the suggestion and the link. However, I do not believe there is a Recovery Partition on this disk, although I really haven't looked for one. I'll slave it back to my system and take a look with Computer Manager and Partition Magic though. I did copy off the i386 folder along with the users data and settings. But really don't know how useful that will be.

    All the ntuser log files contain a line čjDIRTˇ

    I do not know if this is normal or an indication of something amiss.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  14. #14
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,572
    Thanks
    5
    Thanked 1,057 Times in 926 Posts
    [quote name='DocWatson' post='795684' date='30-Sep-2009 10:01']I just connected the system up and attempted to run it normally. No joy. But I was more observant on boot up and noticed that the upper right corner reads F2 Setup and below that "Attempting Network Boot". The machine has NEVER been part of a network and this doesn't seem right as I recall the second line being different on other occasions when booting yesterday, but cannot recall what it was.

    I haven't run any Rootkit detection software. I can still only access the GUI in Safe Mode. I'm going to pul the drive again later today, slave it to my system again and copy off the users data, email, favorites and settings for safe-keeping, copy the ntuser.dat, ntuser.dat.log andntuser.ini files for all profiles so they can be analyzed and then run rootkit detection and whatever else I have available to rule out any malware or virus issues. The Device Manager shows no problems with the hardware.

    I've never run a memory test. Can you tell me what is involved ??[/quote]

    See Microsoft Online Crash Analysis - windiag for details on the Windows Memory Diagnostic.

    There are others around if you search for them.

    Joe
    Joe

  15. #15
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts
    Thanks Joe. I'll check it out.

    I slaved the drive again and looked at it in Computer Manager and Partition Magic an proved my ignorance. There are 2 other partitions on this drive. A small, 47 MB, DELLUTILITY, FAT partition and a 3.5 GB CP/M, Concurrent DOS, CTO partition. I'm guessing that the small one is the utilities to access the larger, restore partition. But neither is accessable to me other than to delete, format or realocate the partition.

    Guess I'm off to the Dell site to see if they have a way in.

    [attachment=85766:John_s_D...rtitions.JPG]

    [attachment=85767:John_s_D...on_Magic.JPG]
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •