I have a windows 2008 r2 64 bits standard server that crashes with a blue screen when an user session is started, either over the console or remote desktop. When the session is started the icons blink twice and then it crashes with a blue screen.
It works in safe mode, the administrator session works ok, so I chcked it with the antivirus/antimalware solution and it found some malicious files but in a profile and none in the system folders.
When analyzing the event logs there were no error entries prior to the crash.
When started in safe mode with network support it crashes after a session is started so I suspect that some network drivers are corrupted or changed by some malware.
The server is running on hyper v, and the host machine is working properly. The virtual machine has 12 gigas of Ram and 100 gigas of virtual disk. It has the terminal server role.
Sadly, we have no copy of the machine prior the failing state.
Any thoughts? Any one has had a similar situation?. Any advices?