Services have become disabled

[Tringa]

Can anyone help with this problem please?

Set up

Intel 7300
Gigabyte EP31-DS3L
2 Gig RAM
NVIDIA 7900 GT/GTO
SAMSUNG 80 Gig Hard drive
Hitachi 250 Gig Hard drive
Optiarc DVD RW

XP Service Pack 3 and all updates

Zone Alarm
AVG
Asquared
SpyBot S&D
Malwarebytes
CCleaner

All the security progs are kept up to date and used regularly

Been using this setup for about 2 years with no problems.


A couple of days ago switched on but instead of the usual Windows screen with the icons for each user I got a smaller logon window.

Logged on OK but found Ctrl-Alt & Del did not bring up the Task Manger,but a window with a number of buttons for Lock Computer, Log Off, Shut Down,Change Password,Task Manager, Cancel.

Decided to reboot and found I could not get in the internet, or print to a printer attached to another PC. Eventually found via Administartive Tools that virtually all the services had become disabled.

Reset all the services, everything runs fine, except still the odd logon as described above. I ran all the security progs but found nothing also used HijackThis, but the log was OK.

Seems the services get disabled with each reboot.

Grateful for any ideas on the cause and a solution.

[Singh400]

Start > Run > Msconfig > Services > Enable All?

[smargh]

You should be looking in the Windows event logs to look for anything which would be off use - i.e. corrupt applications, faulty disks, signs of faulty memory or a bad power supply etc.

[Paul Adams]

A couple of days ago switched on but instead of the usual Windows screen with the icons for each user I got a smaller logon window.

Logged on OK but found Ctrl-Alt & Del did not bring up the Task Manger,but a window with a number of buttons for Lock Computer, Log Off, Shut Down,Change Password,Task Manager, Cancel.

Both of these symptoms would imply Fast User Switching and/or the Secondary Logon service was not running (which fits in with the rest of your reported symptoms).

Decided to reboot and found I could not get in the internet, or print to a printer attached to another PC. Eventually found via Administartive Tools that virtually all the services had become disabled.

Reset all the services, everything runs fine, except still the odd logon as described above.
...
Seems the services get disabled with each reboot.

Do you log on as Administrator, or a user who is a member of the Administrators group?

Just to confirm, you see the startup type for almost all services is Disabled (or possibly Manual?), after every reboot is that correct?

If you start up and keep tapping F8 immediately after the POST to get the boot menu and go into Safe Mode, do the services still have the wrong startup type?
(Bear in mind Safe mode by design will not start all of the services, even tagged as Automatic, we are interested in knowing if the startup type is what is wrong here.)


The startup type for each service is controlled through the registry:
Key: HKLM\SYSTEM\CurrentControlSet\servces\service name
Value: Start (REG_DWORD)

e.g. for the Secondary Logon service the full path would be:
HKLM\SYSTEM\CurrentControlSet\servces\seclogon\Start

Disabled = 4
Manual/On demand = 3
Automatic = 2


So if this value is correct until a reboot is done, I would use Process Monitor's boot logging to find out what is writing to those locations during startup:
http://technet.microsoft.com/en-us/s.../bb896645.aspx


Tips:
If you run the following commands at a command prompt you can see the current state and internal name of every service on the machine:
sc query > svc.txt
notepad svc.txt

If you run this command at a command prompt then you can see the list of currently running services (and a breakdown of which services are in the same svchost.exe instance):
tasklist /svc

[Tringa]

Thanks all for the suggestions.

Event log shows a few instances of WMP11 crashing. Not really thought of this as the cause of the services becomeing disabled because it has happened in the past, but so infrequently and first occurred ages ago, well before the services became disabled.

I'm logging on as user who is a member of the Administrator group. I would try it log on as Administrator except I can't remember the password and would normally access it by doing Ctrl, Alt & Del twice at the normal logon on screen, but I don't see the "normal" logon screen anymore.

Checked the effects of rebooting. Seemed that if I reset all the services and rebooted, things were OK. However, if I rebooted again, then the services were disabled again.

I have checked Fast User Switching Compatability and Secondary Logon. The first is set to Manual and Started; Secondary Logon is Automatic and Started. In the registry the values for these are 3 and 2 respectively

Since reading the replies I have booted in safe mode and the services were OK. Then rebooted normally and the services were still OK. Just tried another normal reboot and the services are still fine. I have no idea why they seem to be stable now.

Still get the odd logon screen and the different screen when I do Ctrl, Alt & Del, but other than that everything seems to be OK.

Yesterday I was concerned why things wern't working; today I'm concerned why they are.

[Paul Adams]

I'm logging on as user who is a member of the Administrator group.

I would recommend NOT using an admin user for day-to-day use if you can get away with it, it's the cheapest and broadest method of mitigating against malware installation.
Any application I find doesn't run as a normal user I research a workaround or contact the manufacturer as there is no good reason to require such high privilege.