So tonight I fire up my desktop PC just like usual, key in my password just like usual and as a result am greeted by the “Welcome” message and animated spinner, just like usual. Except unlike usual, the “Welcome” message sits there perpetually spinning for fifteen minutes with no further response.
I hit the reset button and tried it again two or three more times, in case it was a fluke. Still couldn’t logon. I even used System Restore to go back to the previous restore point, which was yesterday evening, when I knew the machine was running normally. Nope…still couldn’t logon.
Naturally, I’d arranged to work from home tomorrow, and now it was looking like I wasn’t going to have a PC to actually work on. So I did what any reasonable man would do in the year 2012: I got on my smartphone and started looking for clues. While that was underway, I tried booting to Windows 7’s Safe Mode. Interestingly, that worked. From there, I checked the System event log and found a whole lot of messages about services timing out or not starting in a timely fashion, like this:
A timeout was reached (30000 milliseconds) while waiting for the Print Spooler service to connect.
This was really just symptomatic of the problem, not indicative of its cause.
Fortunately, after relatively little searching, I found Microsoft Knowledge Base article 2578159. It describes a hotfix meant to resolve issues with the logon process, in which a “race condition” between the Windows Event Log service and the Event Tracing for Windows functions causes a deadlock situation. Now, quite honestly I have no idea what that means or why it would suddenly decide to happen after a year of trouble-free OS operation. But it sure described my problem to a T, so I decided to give it a try.
Here’s where the sheer number of hoops that I needed to jump through just to install a hotfix became comical. First off, Microsoft wouldn’t let me just download the hotfix. They made me give them my email address so they could email me a link to it. OK, fine. So after I’d downloaded the hotfix (still running in Safe Mode, remember) I tried to install it, but the installer service reported that I could not do so from Safe Mode. Great, so how am I supposed to install it if I can’t login normally?
Further searching of the web revealed that I could use msconfig.exe to selectively disable all non-Microsoft startup items, which would allow me to login normally (read: not in Safe Mode). After firing up msconfig, at first I tried to be greedy and just choose the “Diagnostic startup” option. Unfortunately, that didn’t work, because that prevents the Windows Installer service from loading, thus the hotfix still could not be installed. Grudgingly, I went back to msconfig, picked “Selective startup”, and then literally unchecked all of the Services and Startup items that did not say “Microsoft Corp.” listed as their manufacturer. Finally, after doing that and rebooting, I was able to not only logon normally, but also install hotfix 2578159.
Since installing the hotfix, I have had no further issues with logging on. It does indeed seem to have solved my problem.
Just thought I would put that out there, with an added smattering of real-world experience, in case anyone else runs into this.
This seems like the kind of thing Microsoft might want to be on top of, instead of just going, “Well, let’s see how many people end up having this problem, and we might implement an actual patch at some point in the future if it gets out of hand.”
Typically these “hotfixes” are patches that somebody at Microsoft wrote up quickly without going through all the rigorous testing that regular Windows Updates get. The idea being that after sufficient amounts of testing, the hotfix will be rolled up into a proper Windows Update or future service pack.
However, this hotfix was published in August, and seven months seems like kind of a long time with no proper patch being offered. But who knows; an organization the size of Microsoft probably takes as long to certify a hotfix as the Titanic took to turn around in a circle.
Interestingly, I’ve been having other strange issues with this machine today. My anti-virus software (Avast) somehow got corrupted, requiring that I run the installer’s “Repair” process to get it going again. This weirded me out sufficiently to run a full system scan as well as a MalwareBytes scan. Nothing came up. Checked netstat to ensure there were no ports open to foreign IPs that I don’t recognize, and again, nothing abnormal. Just weird.
And my left mouse button is occasionally not firing when I click it now. Extremely annoying.
Wow. That is weird. I’m glad I left behind Avast (and the endless supply of false positives it gave me, not to mention the craaaazy slowdowns its anti-malware engine caused) in favor of MSE. Since switching over to MSE, I’ve had one minor false positive, as opposed to Avast sometimes nearly crippling my system because of the wonky false positives it would report.
I actually had a weird occurrence with my PC this week, too. Our cable modem was wonky, so it had to be replaced. When Windows found the “new” network connection from the new modem, it asked me to create a HomeGroup for Windows 7 PCs on the home network. I did it, and a “memory leak” error popped up in Event Viewer. I did a quick look around and — aside from one scare-monger screaming “virus-infected svchost!” (which I figured wasn’t the case, as I had just run a full-system virus scan the previous day and hadn’t done anything outside of turn on the PC at that point) — some people were saying they kept getting the same memory leak error every time they tried to create a HomeGroup in Win7. So I deleted the HomeGroup (left it, whatever) and the error hasn’t come back since.
I have similar problems with my mouse at times, but it’s done that for a while now. Probably because it’s over ten years old at this point!
Yeah, my mouse is old too. (About six years…not quite as old as yours.) The thing that weirds me out about the mouse button is that, given all the other PC oddities I’ve experienced in the last 24 hours, I’m having trouble accepting that it’s just the mouse’s fault. Ideally I should connect a different mouse and see if it behaves differently, but the problem is so intermittent that I’d have to run the test for at least a couple of days.
Windows can be so annoying with its network settings, especially if the gateway ever changes (as you found out). It makes it think it’s in an entirely different place on an entirely new network. Although I can’t say I’ve ever run into any issues with HomeGroups…nor do I really use them, though, only having two Windows PCs in the house (one of which is mostly shut off all the time).
Not sure what to think about the Avast deal. I ran MSE for a while too and liked it. It seemed like I had an issue with MSE where it was hogging CPU cycles which, combined with the new version of Avast that was lighter weight, compelled me to switch back to Avast. This problem today is the first issue I’ve had with it since, and I can’t really be sure what caused it. Seems very suspicious that an AV program would suddenly become corrupted right at the same time other peculiar system behavior arose, but as I mentioned, I can find no evidence of malfeasance.
I’m sure Windows 8 will make it all better by turning everything into colored building blocks!
Where the hell can I download the hotfix? It seems there’s no link for it on microsoft.com.
This was the really stupid part, because Microsoft requires that you jump through a bunch of hoops to actually get the download. On the KB article I posted above, there’s a fairly small link next to the wrench-and-screwdriver icon at the top of the page that says “View and request hotfix downloads”.
When you click it, you’ll first have to agree to some draconian terms, then you will be taken to a page where you have to check a checkbox, fill out a valid email address and solve a captcha. Then you will get an email at the address you entered with a link to download the actual hotfix.
Ridiculous.
Wasted 3 hours on my colleagues computer before I found your fix. Thank you.
Any idea what may have triggered it? Computer is 2 years old.
Actually had to take a MS Excel update off several workstations two weeks ago as it crashed them or screwed up shared excel files. Now this.
Wondering if some recent MS update may be cause. There was a .net and a Silverlight update on her computer two weeks ago–strange it would trigger now.
You’re quite welcome; glad that the hotfix solved your issue.
As for the cause, that really is the million-dollar question. The fact that I could logon normally if I disabled all non-Microsoft startup items suggests that it may not be a recent Microsoft update that triggered this, but I have no idea what else to think. Unfortunately, the evening before this occurred I had installed an unusual volume of new software, so I was in an unusually poor position to try and isolate the cause.
Hopefully some more info about this will surface on the web given time, because I remain curious.
I want to add to this that I believe this problem started for me when I installed Office 2010 (home and student). Recovering using an image from my external did not fix the problem from before the problem actually started.
Interesting. I also had Office 2010 installed at the time this occurred. It’s possible that it’s related.
Just wanted to say thanks for posting this, I’m a unix guy not a windows guy so I was pretty stumped by the fact that I couldn’t seem to install this stupid hotfix on my laptop. You’re my hero.
Just wanted to toss a thank you your way. Brilliant write up. I’ve jumped through my fair share of Windows hoops in the past and this one was proving to be a real bugger until I found this article. You’re a gentleman and a scholar.
You’re welcome, guys. Glad I could help.
Thank you very much! Worked for me!
04/23/13
Issue still exists
Hotfix never rolled into an update as Advapi32.dll is older than the one in the hotfix