Solved

Windows XP logs in then logs off

Posted on 2004-04-29
74
130,664 Views
Last Modified: 2011-08-18
Anyone seen this one??

Machine starts up normally, goes to the XP Home welcome screen.  I click on one of the two profiles and it starts logging into the profile, as soon as the wallpaper comes up, it immediately logs back out to the welcome screen.  It also does this in safe mode and also safe mode with command prompt.

Any clues??
0
Comment
Question by:Mordanthanus
74 Comments
 
LVL 44

Accepted Solution

by:
CrazyOne earned 250 total points
ID: 10953026
Hmm perhaps

How Do I Do a "Repair Installation"?
http://www.dougknox.com/xp/tips/xp_repair_install.htm

Repair
How to Perform an In-Place Upgrade (Reinstallation) of Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;315341

Visual aid to the above procedure
http://www.webtree.ca/windowsxp/repair_xp.htm
Click on How To Run a Repair Install

You May Lose Data or Program Settings After Reinstalling, Repairing, or Upgrading Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;312369

Data Loss May Occur After Reinstalling, Repairing, or Upgrading Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;312368
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 10953029
Hi Mordanthanus,

Have you tried last known good configuration ? May be something is screwed. Try that and post back if it would function well. Did youdo any changes in your system recently ?

Check for virus and spyware in the system

Post back

Thanks
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 10953030
Hello Mordanthanus =)

Did u activate the XP ??

!! GOOD LUCK !!
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 10953377
0
 

Expert Comment

by:asrobinson
ID: 11039868
I am seeing the same problem on an XP system right after cleaning a virus. Click on profile to log in. Wall paper flashes briefly then logs me right back off. Anyone else seen this, any suggestions?
0
 

Expert Comment

by:highway-computers
ID: 11095580
I have  a customers Compaq laptop with the same problem, only I can login under administrator in safe mode but that account only. I have scanned for viruses in another computer, but found nothing.

This really has me stumped. Please help! I cannot install service pack 1 either and my customer requires all his data in one piece. I want to avoid a repair install if possible.

HELP:!!!
0
 

Expert Comment

by:pizza_man
ID: 11136220
I am having exactly the same problem. I try to log in with either my username or administrator and just logs out immediately. The same behaviour happens when I try it on safe mode. I've tried reinstalling windows (repair installation) several times but the same behaviour persists after. Any ideas?
0
 

Expert Comment

by:quintoncomputers
ID: 11147297
I have just fixed this issue for a client with the same simptoms by doing the following: using ESD commander, I was able to edit the registry and change the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit key from a garbled value his broadband provider's software set, to C:\WINDOWS\system32\Explorer.exe, for WinXPPro, home may have a different location for Explorer.exe, but this is almost always the problem with that behaviour. Re-installing windows is almost never necessary in this situation, changing the registry has worked the 5 or 6 times I have seen this problem.

 If you have access to another computer to burn a disk, there are several options to modify the registry, such as http://sourceforge.net/projects/austrumi .. google is your friend here.

 Good luck! This situation IS recoverable with a little work, without data loss.

        Andrew  Quinton
0
 

Expert Comment

by:pizza_man
ID: 11158150
I just checked that registry key in two computers, one with the log on-log off behavior and one that works okay and in both that key has this value : "C:\WINDOWS\system32\userinit.exe," and not explorer.exe. There is no explorer.exe in the system32 directory.
0
 

Expert Comment

by:pizza_man
ID: 11158518
I tried quintoncomputers solution and it worked for me. :D
0
 

Expert Comment

by:pizza_man
ID: 11158525
Although I did a slight modification in his solution, to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit  i added "C:\WINDOWS\Explorer.exe," and not "C:\WINDOWS\system32\Explorer.exe,". Yes, including the comma.
0
 

Expert Comment

by:eksperten
ID: 11210955
Where do you find ESD Commander and how to use it??
0
 

Expert Comment

by:pizza_man
ID: 11216701
Actually what he was referring to is ERD Commander from Winternals.
http://www.winternals.com/products/repairandrecovery/erdcommander2002.asp?pid=erd . But any other product which you could use to edit the registry from an unbootable system will work.
0
 

Expert Comment

by:quintoncomputers
ID: 11218486
Yes, I had an unfortunate typo there, ERD is spendy, but worth it, I am working on instructions on how to fix this with Open Source Software, but modifying the Windows registry from Linux can be a dangerous proposition, i should have complete instructions in a day or so (my wife is having a baby any day, so my computer interest is taking a back seat.)
0
 

Expert Comment

by:quintoncomputers
ID: 11218501
Sorry, Here is a link to get you started  http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html  i have used it with basic admin pasword changes (via the CD-ROM ISO) but haven't delved into the registry to any degree yet. Good luck, I'll update when I can.


0
 

Expert Comment

by:DSoz
ID: 11227257
The free tool quintoncomputers mentioned worked well enough to show me the bad registry entry (wsaupdater.exe) that AdAware had removed. Then I went into Recovery Console to copy userinit.exe to wsaupdater.exe. Once back to the full version of Windows, I could fix the registry & remove the bad file again.
0
 

Expert Comment

by:carbonmonoxyd
ID: 11230873
I am also having the same problem with Windows XP Home Edition.

I was wondering what free tool it is that you were able to use, DSoz?
0
 

Expert Comment

by:DSoz
ID: 11231493
http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html

I used the ISO to make the boot disk. That only allowed me to see the registry key that was bad, not fix it. However, as I mentioned, it was enough to let me know what to do to work around the bad key enough to get into Windows & fix it right.
0
 

Expert Comment

by:dercoss
ID: 11260543
I've checked a working xp pro sp1 machine and its path is
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
with a value of "C:\WINDOWS\system32\userinit.exe,"

not "C:\WINDOWS\system32\explorer.exe. I changed an affected pc to the suggested setting but there was no difference the pc would still not boot.

Anybody else had this problem and managed to fix it when this fix hasn't worked??

dc
0
 

Expert Comment

by:kaseylongwood
ID: 11262595
dsoz...
i was wondering how you had the program search to see which registry value was bad. thanks

gvb
0
 

Expert Comment

by:quintoncomputers
ID: 11263461
The value of 'userinit.exe' runs a program that does start-up tasks, THEN is SUPPOSED to execute c:\windows\explorer.exe, - viruses, worms, and plain poor programming can cause userinit.exe to not call explorer.exe , which is the actual windows user interface - that's why you see the desktop flash, then logout - there isn't anything specified to run as a user interface - My mistake on an earlier post was to specify 'c:\WINDOWS\system32\explorer.exe' - explorer.exe actually resides in c:\WINDOWS on XP - change the registry entry to 'C:\windows\explorer.exe,' and try that out. You may have other problems, but if you see the desktop flash then logout, this should at least get you in to where you can run antivirus and ad/malware detection software.

 Hope this helps,

Andrew
0
 

Expert Comment

by:bmerritt79
ID: 11263734
I, too, ran into this problem last night; and thanks to the web and people like you, I was able to fix it.  

My problem occurred as I was installing R-DriveImage demo software (on an unrelated hard disk crash)... LavaSoft's Ad-Aware popped up and wanted to run, I let it.  Then I got a message that I needed to reboot (I wrongly thought it had to do with the R-DriveImage software.), I let it reboot... when it did, it logged on briefly to a blank desktop, then logged off to the Welcome screen with only an Administrator icon available.  Every time I would click on the Admin icon, the computer would log on and log off within a second or two.  I remembered that the R-DriveImage software had said something about needing Admin privileges (I am the only user on my machine so I had never set up either another user or input an Admin password.) so I thought maybe the password file had been corrupted... that eventually led me to PNordahl's http://home.ernet.no/~pnordahl/ntpasswd/bootdisk.html  

I tried several times to change/reset to blank my Administrator password... no joy... finally realized, duh, that the password was fine... when I clicked on the Administrator icon at the welcome screen, it didn't say I couldn't log on, it logged on and immediately off!

That led me to this thread.  I decided to use the austrumi ISO disk image mentioned by quintoncomputers and http://www.petri.co.il/forgot_administrator_password.htm#1 to burn a bootable CD Rom.  (When it boots, don't take too long to type in nt_pass at the boot: prompt or it will continue to boot to a Latvian version of the Linux GUI, which does not appear to have a GUI version of a windows registry editor.)  

"nt_pass" apparently runs a linux script that eventually runs chntpw (change nt passord?) that appears to be a version of the same program created by pnordahl.  

The script will stop and ask you to hit enter to continue to load SCSI drivers, it then asked me if I wanted it to probe for SCSI drivers: [n], I took the default [n]o and hit enter.  Next, it asked what partition contains your NT installation, I took the default again, in this case [/dev/hda2] and hit enter.  Then it asked:  what is the full path to the registry directory, again select the default [windows\system32\config].  Next came the question, which hives (files) do you want to edit (leave default for password setting, separate multiple names with spaces), the default was [sam system security], I chose to type software and hit enter.

I then chose option 9 - registry editor.

A ? will get you a list of commands that are available, I used ls which appears to be equivalent to a DOS dir command... cd to change directories... cat to print the value of a key... and ed to change the value of a key.  

For instance (this is from memory, not notes... sorry) at the prompt [1020], type cd Microsoft and hit enter, then cd Windows NT and hit enter, then cd CurrentVersion and hit enter, finally cd Winlogon and hit enter (case is important).  

Maybe you could just type one cd Microsoft/Windows NT/CurrentVersion/Winlogon and hit enter... I don't know.  But it seems to be the registry equivalent of
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
 
At that point I typed cat Userinit and lo and behold, up came
C:\WINDOWS\System32\wsaupdater.exe... I don't know what company replaced userinit.exe with this entry, but I don't think I like them.  At any rate I typed ed Userinit and at the prompt [C:\Windows\System32\wsaupdater.exe] I typed C:\Windows\System32\userinit.exe and hit enter.

Then q to quit (you will be asked if there is something to save), q to keep quitting and y when it asks if you're sure you want to write the changes (careful, careful... good luck).  The program then dumped me out to a # prompt and said I could rerun the script if I typed a space followed by sh /script/main.rc

I removed the cdrom from the drive and rebooted to Windows XP, no problems.

Good luck all and thanks for the help... did I mention I hate computers?
0
 

Expert Comment

by:kaseylongwood
ID: 11269348
thanks everybody who helped out, especially bmerritt. its all fixed and i had the same thing wsaupdater.exe. i have never had a problem with adaware but it might be a different program that caused it. i had just used spysweeper for the first time and most likely that is what caused it. oh well its fixed now. and thanks again to everyone.
0
 

Expert Comment

by:mer_ner
ID: 11271554
Hi, I was having this problem and I still am. I can't even get in on Safe Mode. I have installed Windows for a second time and I wish to be able to use all my old setting. I don't know how to look at the registry for the 1st Windows that was installed so I can change the key. Can you help?
0
 

Expert Comment

by:carbonmonoxyd
ID: 11276097
I had the same problem which stemmed from using Lavasoft's Ad-Aware and I found a very simple fix;

First off, boot your computer from your Windows XP restore cd/OS cd, when the menu comes up hit the R key to get to the recovery prompt.

The prompt should start off at C:\Windows. Type 'cd system32'. The prompt should now read 'C:\Windows\system32'

Type copy userinit.exe wsaupdater.exe

Viola.

That did it for me. I'm not sure this will work for all cases, as mine stemmed from Ad-Aware deleting/replacing files. Hope this helps.

Matt Featherstone
0
 

Expert Comment

by:avi_india
ID: 11279569
Hi All,

I am facing same issue :

This morning, I was working on my laptop at my home. then while coming to  work, I just closed the lid and brought notebook to my workplace. (something which i do daily). When I opened the lid, it will not resume (from standby position). At that time I cold rebooted the machine. I get to login screen, but as soon as I log  in, I am logged out back to login screen. Happenes with all the users on the system.

What should I do in such a case? I can not use any of the tools described above as I simply can not login. Can this be a virus? If yew, how do i clean. I have antivitus but I never created a rescue disk.. :((

-Ajay

0
 

Expert Comment

by:ndknightmare
ID: 11322440
Hi,

I had exactly the same problem after doing a repair on windows XP - i was going to copy the userinit.exe to  wsaupdater.exe, but it wasnt there.

I started the recovery console and then did expanded it from the windows xp cd

d:
cd i386
expand userinit.ex_ c:\windows\system32

i was then able to get in to windows.

Thanks for all the helpful suggestions above.

ndk
0
 

Expert Comment

by:lewisrw
ID: 11356359
Hi - just had the same problem with my son's laptop and Win XP; although since he doesn't have Lavasoft Ad-Aware installed, I can't blame it on Ad-Aware. Thank you for all of the ideas in this thread.  I fixed the problem by 1) booting to a Repair Console (IBM provides this on their laptops), 2) changing to C:\WINDOWS\System32, and 3) copying userinit.exe to wsaupdater.exe (there was no wsaupdater.exe present). I then 4) reboot into Safe mode and successfully logged-on as Adminstrator (for the first time in several days!)  Next step was to 5) edit the registry and change userinit in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon from "wsaupdater.exe," to "userinit.exe,"; 6)  final reboot and back to normal!  Thanks everyone.  --Rick Lewis--
0
 

Expert Comment

by:janedoe
ID: 11522124
Hey, I changed the registry key (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon) to 'explorer.exe,' from 'userinit.exe' which didn't fix the problem. I am unsure of what to do next. I'm running Windows Xp Home
0
 

Expert Comment

by:Packet1009
ID: 11531417
tried this today on a client box - wsaupdater.exe was missing but referenced in the registry. copying userinit.exe over to it worked just fine. thanks
0
 

Expert Comment

by:supergjsy
ID: 11631475
I Love clever people (compared to me thats most of you guys) I had this thing on friends pc
tried many things no joy :(   Friend had already had a play  :(

Any way long story short bmerritt thankyou for the noddys guide you are now adistinction
and pnordhal who has saved me many hours in the past with pass word changer should now be elevated to god status

thanks agian bmerritt/pnordahl you guys are way to clever for me
0
 
LVL 2

Expert Comment

by:Syncubus
ID: 11894549
Just wanted to post a quick "thank you" to the solution providers for this topic.  It was helpful to me, as well.
0
 

Expert Comment

by:yogi_bear_rulez
ID: 11898029
Yo,
I had almost the same problem, but I was so foolish to delete the entire Userinit Value !
Here is my solution for that ! :) Took a while to figure it out.

Boot with the Windows XP install CD-rom and go to the Recovery Console (pressing R)
Log on to the correct WINDOWS partition, normally the 1.
Go to C:\WINDOWS\system32\config
Give the command dir and you will see the hive called software.
Copy this "corrupted" hive to e.g. C:\software.bak using the following command:
copy C:\WINDOWS\system32\config\software C:\software.bak
This is to have your Software Hive / Registry handy to edit it later with the REG tool.

Now to get your system bootable again.....

Copy the REPAIR version of this SOFTWARE hive (kind of registry) to the operational location.
Do this with the following command:

copy C:\WINDOWS\Repair\software C:\WINDOWS\system32\config\software

Now a running SOFTWARE hive is copied to the operational location.
exit the Recovery Console using the exit command.

Reboot the system and see if the system starts.

If the system starts. you need to get the backed up software hive up and running

Open a DOS prompt
Use the command REG
REG LOAD HKLM\WRONG C:\software.bak

It should say import successfuly.

Now open regedt32 and Go to HKEYLOCALMACHINE and then WRONG
You will see that the entire SOFTWARE tree is located there....:)
Add the key as mentioned above Userinit type REG_SZ with the value as mentioned above
C:\WINDOWS\system32\userinit.exe,
Don't forget the comma !

Now exit regedt32

Now save this WRONG subkey as a file again.
Open a DOS box again and use the REG command again to save the subkey.
REG SAVE HKLM\WRONG C:\sofware.new

Open the regdt32 again and delete the key WRONG, because it is not doing anything usefull.

Reboot the system with the Windows XP install CD
Go to the recovery console (R)

Now copy the new software hiv to the operational location:

copy C:\software.new C:\WINDOWS\system32\config\software

It will ask for overwrite,...choose Y ofcourse.

Your done ,... reboot the system and it should work.

Ronald van Dorp
0
 
LVL 4

Expert Comment

by:zookeepa1
ID: 11935873
worked for me as well.....
0
 
LVL 11

Expert Comment

by:Paul S
ID: 11981167
my website has the solution also. For anybody who finds this page later.

http://www.paulscomputerservice.net/index.php?body=./os/autoLogoff.php
0
 

Expert Comment

by:Chunster
ID: 12000588
Thank you quinton computers, bmerritt79 and Pizza Man - I was able to solve my log in problem!
0
 

Expert Comment

by:TheDeputy
ID: 12107709
Okay I tried what Bmerritt79 said and it appeared to work, it booted into the user account and I THOUGHT it was going then BAM! Logging off user.  WTF?!

Anyone else have this happen?
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 

Expert Comment

by:TheDeputy
ID: 12107861
This may work for some of you, but is not the only solution cause I did everything in this thread and nothing worked.  I still log on and then get booted off right away.  
Looks like a Format C: and wipe the whole hard drive clean is the only true solution
0
 
LVL 11

Expert Comment

by:Paul S
ID: 12108533
You copied the registry from the Repair folder and it didn't work? did you try editing the registry from a bootable disk? You can always do a repair install of xp and save some time. that way you don't have to backup data.
0
 

Expert Comment

by:mikewund
ID: 12127433
Pure genius.  I had the same problem on a Win XP Home laptop and used ERD Commander to edit the registry entry contemplated in this thread.  My problems began when I used Ad-Aware to remove tons of ad-ware / malware from the machine.  The winlogon value was set to "wsaupdater.exe" and I changed it to "C:\Windows\System32\userinit.exe" and all is good.

Thanks everyone, especially quintoncomputers!
0
 

Expert Comment

by:R_McCullough
ID: 12148404
I also have the logon / logoff problem but when I use the recovery console I have to select the windows installation (c:\windows). Once selected a password is requested  for safe mode admin account.  I have never assigned a password to that account.  How do I get to the point where I can  change to the C:\windows\system32 ditrectory and type "copy userinit.exe wsaupdater.exe"?
0
 

Expert Comment

by:danno30
ID: 12273625
Thanks for the info from carbonmonoxyd
worked well and very simple thanks again
0
 

Expert Comment

by:marcus_solorio
ID: 12381782
Quintoncomputers!!!! You are the man!  Thanks for your help.

Marcus
0
 

Expert Comment

by:pat6
ID: 12529541
G'day All!

Well, it seems that I get to join the crowd with this same sort of problem.  Six days ago I loaded the new Yahoo Toolbar - with anti-spyware and anti-adware - anyway when I rebooted the system I got an error message associated with "userinit.exe" and it would not bring up the logon screen.  I was able to access the system via Safe Mode with Networking and uninstalled the Yahoo Toolbar.  I tried to reboot but was getting the same error (userinit.exe).  Well, I ended up moving the file to the recycle bin and rebooted - after this point whenever I get to the signon screen it just says it's logging on, then logging off, saving my settings and then I'm stcuk at the signon screen.  If I try to get in through Safe Mode it just does the same thing and knocks me back to the signon screen.
I used a bootdisk and am able to bring up a C: prompt, but I'm stuck now.  I don't see any files named userinit.exe or wsaupdater.exe - CAN ANYONE HELP?  I'm about ready to just reformat the hard drive.  Any assistance would be greatly appreciated - I'm not that comptuer literate so whatever advice you have please dumb it down for me.

Thanks,
Pat
0
 
LVL 11

Expert Comment

by:Paul S
ID: 12530938
stick in your xp cd. boot off of it and go to recovery console. once there type:

expand d:\i386\userinit.ex_ c:\windows\system32\userinit.exe

then reboot.

or pull the file from another computer and get it on the system some how.

P.S. you might want to open a new question for this problem.
0
 

Expert Comment

by:jspadea
ID: 12722948
A coworker had same problem.  He called toshiba tech support and they had him install a parallel WinXP Pro :(

I followed bmerrit79's solution and I could not save - feature not supported.  His software hive is 19MB - maybe it is too big.

His Userinit key was set to C:\program files\comcast\security manager\app\securitymanager.exe

I booted into the parallel install and  copied userinit.exe from the parallel install to securitymanager.exe

Then I tried booting into the original and it seemed to hang on "loading your personal settings.....", but then it logged me in!

Now I have to figure out how to undo all the damage the parallel install did!
0
 

Expert Comment

by:pogojohnny
ID: 12947602
Hi All,

I also am experiencing this problem. I finally managed to change my registry setting (it was wrong) and could log in, however something still manages to change the "logon value" in the resgistry every time I reboot.
Any ideas as to what program could be doing that?
I cannot find any kind of virus so far.

thx

Peter
0
 
LVL 11

Expert Comment

by:Paul S
ID: 13010910
try following these steps to make sure your system is clean

http://www.paulscomputerservice.net/index.php?body=./software/malwareinstructions.php
0
 

Expert Comment

by:xyratex
ID: 13022454
I had the same problem with a remote machine at work....

The trick worked fine and fixed the problem....

However the machine was in a remote office so using ERD etc was not option. Luckly remote desktop was enable under windows XP which mean having ADMIN rights on the domain I could access the users C$ drive and copy the required file. Editing the regitery was done remotley using the standard regedit then using the connect to remote computer option.

After a reboot the problem was fixed! thanks for the info on this... life saver! Also handy to know that you can do it via remote desktop if you have admin rights!

Cheers Glyn
0
 
LVL 5

Expert Comment

by:jjk16
ID: 13111739
Ill add to the discussion as i had the same problem but a variation..

the userinit key in the winlogon was pointing to c:\windows\userinit.exe

i expanded userinit.ex_ from the c:\i386\ folder to c:\windows\system32\userinit.exe

before i did that i renamed the userinit.exe userinit.old as a safety precaution

it seems that the key is that, the  userinit key is supposed to point to the userinit.exe file or whatever file is loading the desktop and explorer.exe etc

just additon hope this helps someone else
0
 

Expert Comment

by:luskentyre
ID: 13481424
Thank you everyone who contributed to this thread (esp bmerritt79 who gave us a very helpful rundown on editing the registry).  I changed the relevant key to "C:\windows\explorer.exe" and sorted the problem.  Thanks all!

0
 

Expert Comment

by:jose_viadas
ID: 14064489
Thank everyone, this helps me to resolve my problem i get the ERD and i change the key in the registry, but the change i have was:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value: Userinit
Data: c:\WINNT\userinit.exe, %SystemRoot%\:iProtect.exe

this what i have, i delete de data and change it for:
Data: c:\Windows\System32\userinit.exe,

thanks.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 14082321
I would like to say thanks as well.
The key on my system was missing altogether. Replaced using BartCD and Bingo!.
Thanks
0
 
LVL 1

Expert Comment

by:tijsjansen
ID: 14114225
Just adding my experience with a similar problem (logging on then being logged off again straight away) and my problem was different from the registry keys mentioned earlier. I cloned a laptop harddisk using an external USB box on a different machine and when the image restored the drive was locked in a wrong drive letter (which gives problems with windows, see http://support.microsoft.com/kb/249321 )
The solution is to boot from a Win98 startup disk and run fdisk /mbr
This will rewrite the Master Boot Record even if it cannot see the HD because it is NTFS. THis resets the GUID an you're able to log on.
Strangely, i tried this with XP's recovery console fixmbr command which did not work.
Hope it helps for those who stumble on this page like I did where the regkey is not the problem (not spyware related)
0
 

Expert Comment

by:JohnGault121
ID: 14245910
Oh this is killing me! :) I too have the momentary Log-on/Log-off

This is what I've tried so far.....

Copied userinit.exe to wsaupdater.exe - SameThing

Replaced the userinit with one from another, working, computer and copied that to wsaupdater - SameThing

I created a BartsPE disk with the RegEdit plug-in as described on "paulscomputer" page.

When I edit the registry it says userinit is X:\i386\system32\userinit.exe,
I change it to C:\Windows\system32\userinit.exe,

But it doesn't save some how.... When I go back it's back to "X\i386"
It looks to me like That key is from the Barts disk, where a \i386\system32 DOES exist
What's with this "X" stuff?? ;)

Is there a way to point the Registry Editor to another place?

Am I doing something wrong?

If I try to import a copy of the last Good registry, I can't find where it resides...

I've come, Paid-Up for a month just trying to resolve this and frankly, don't see much here I didn't find on my own :(

OK, a little history - WinXP Home OEM SONY VAIO desktop. Giant said Nero was trying to make some changes, I uninstalled - ran "RegDoctor" to clean up any Nero keys left over. I uninstalled RegDoctor. I shutdown. Next Day - I'm in trouble!

ANY help would REALLY be Appreciated.....
0
 
LVL 1

Expert Comment

by:tijsjansen
ID: 14254746
Hi JohnGault121,
As this question is already answered you might consider posting a new question that describes your situation to bring it under the experts attention. Last Known Good Configuration is probably not going to help but is an option on the same screen where you can start the PC in safe mode. Good luck.
0
 

Expert Comment

by:renga080798
ID: 14373148
Hi

I had this log on/Log off issue in the following way.

a. When I log in direclty on the XP Pro Desktop it logs on fine.

b. But when I try to log on from another computer on the same network using remote log on it used to log on and then log off after a brief flash.

Solution:

I inspected the settings in the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
        1.0 Userinit         --> This was mapped correctly to C:\Windows\system32\userinit.exe,
        2.0 AllowMultipleTSSessions  --> In the faulty computer this was set to 0x00000001(1)
                                                        I changed this to 0x00000000(0)
        3.0 ShowLogOnOptions   --> In the faulty computer this was set to 0x00000000(0)
                                                        I changed this to 0x00000001(1)

After the above change it worked for me. I was able to log on remotely without the problem stated in b.

R
0
 

Expert Comment

by:frozenJim
ID: 14446260
Anybody know how to get the console running if you do NOT HAVE an XP cd?  I have a laptop that came with XP bundled and with a recovery cd... the recovery cd doesn't have any obvious XP cd in it.

Incidentally, I found a great tool set for registry editing and much more at http://ebcd.pcministry.com.  Nice password reset tool as well and it boots from CD or Floppy+CD for older bios.  It's all linux based so if you're handy with a unix prompt, you've got full access to your system.

My system was fine until I failed to respond correctly to the Windows File Protection dialog.  How COULD I insert my Windows XP SP2 CD when I was never given one?

I checked in system32 and now there are only 33 .exe files... compated to 334 .exe files on my other PC.  Hmmmmm.....
0
 

Expert Comment

by:e_giancarlo
ID: 14472704
I had the same problem with it:

PLEASE I NEED HELP!!!!!! HELP PLEASE
I tryed to fix again , and it didn't work!! So , look what I did:

Insert Windows XP CD
recover console  = R
which windows (1)
then i've typed : cd system32

then I've Typed:copy userinit.exe wsaupdater.exe
 enter

it gave me an error
Few months ago I've had this problem and I could fix using these strings ;
How can I do now? I can't log on ..
0
 

Expert Comment

by:kaseylongwood
ID: 14475459
i had this problem a while back and was able to fix it with the help of this forum, but i later found out that the best and easiest fix is to get rid of windows and move to mac. that's what i idid and haven't had one problem since.
0
 

Expert Comment

by:e_giancarlo
ID: 14476626
its definitely the best choice since you are mac friendly user.. I don't know a single command for mac. I wish I knew!!! Thank you anyway!!
0
 

Expert Comment

by:e_giancarlo
ID: 14476641
by the way how did you fixed it????
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 14476645
This post has been closed for quite some time. You would be best to create a new posting. Likely get more responses.

--Rob
0
 

Expert Comment

by:frozenJim
ID: 14479843
kaseylongwood and e_giancarlo:

It's true... I installed Linux on most of my computers.  It has taken me a year or so but now I'm just as expert with Linux as I was with Windows.  I downloaded a "brand" of linux called GENTOO - just because it is the hardest one to learn.  It comes basically as a bootable CD full of source code.  Daunting at first, but soon you know the operating system intimately.  And it's amazing...  And it's secure...  And it's free!

Once you switch, you'll never, ever go back.

Most of my clients are now running one Linux machine each... just to see how it "feels".  It certainly doesn't hurt that all of the software is free AND that you can still use those old P100 machines.

Just imagine... the beauty of a Mac with the stability of Linux... hhmmmmmm....
0
 

Expert Comment

by:lnikolov
ID: 14822115
Non-administrator users on my WinXP Home Sony Vaio laptop get logged off immediately after they log in. My registry key points to the right place (userinit.exe,). I also tried changing the value of the Winlogin\Userinit registry key to notepad.exe and it started opening Notepad for Admins as expected, but for non-admins it still logs out immediately, without ever bringing Notepad up. Something must be causing it to log out before it even hits the Userinit registry key. If I switch the regular user into an Admin user account, they can log in normally, when I switch them back to regular user, they can no longer log in.

I also tried cleaning Application, Security and System event logs and that didn't help.

What else should I do? I do not have a Windows XP installation CD as the Sony Vaio laptops don't come with one (cheap bastards, how much would that reduce their profit? 50c?)
0
 
LVL 4

Expert Comment

by:ZaSSeR
ID: 14914054
..hmm.. did the copy thing & the registry thing (there was no Useinit in Winlogon [???] so I added it) but no luck. It flashes the background image (desktop) and logs off as soon as I try to log in. :(
0
 

Expert Comment

by:Radiomedic21
ID: 22210689
Hello all,
     I have been reading all the post and thank everyone for the answers they provied but as others have stated they did everything posted and nothing seemed to work.  
     Well the solution I found to be the answer is this, you need to take a copy of the Userinit.exe file from a WinXp working machine and copy it into the C:\WINDOWS\System32 directory of the machine with the problem.  The problem is that the removal programs now take the entire program out of the OS but leave the path in the registry.  Fixed all 6 machines that I have on my bench with the same issue.  Seems that the removal of the XP Anti 2008 trojan can cause this issue to arise once again...  Hope this helps.
0
 
LVL 1

Expert Comment

by:Tbaba
ID: 22283919
This prob is caused by 2 different reasons:

1.  No or missing userinit location in the registry
2.  Corruoted user profile

To fix it, you MUST first try to access your registry on the hardrive.  you can do this with numerous software listed above or by connecting the hardisk to another system and loading the SOFTWARE hive and then browsing to the appropriate registry key and adding or changing the usernit key to the right location.

If due to corrupt profile. you must connect the hardrive to another computer and run a scandisk(chkdsk) repairing all errors on the drive.

You could do both, just to be sure.  Good luck

0
 

Expert Comment

by:dercoss
ID: 22285363
What's the point? It's easier to use a new user profile rather than take things apart..

dc
0
 
LVL 1

Expert Comment

by:Tbaba
ID: 22302966
@dercoss

Well, the idea is, you won't be able to create a new profile if you cant logon (the prob this thread focuses on) due to your whole Documents and Settings (D&S) Folder being corrupt.  In that vain, if ur prob is due to a corrupt (D&S) Folder then u must first run a chkdsk to fix the error.

There was a situation once where after running chkdsk on the drive the whole D&S Folder was repaired one of those chkdsk repair folders, all I did was rename it and voila...

0
 

Expert Comment

by:dercoss
ID: 22304241
That's not a problem. There was a second account working and all the relevant documents and emails from the old account were copied over without problem..

dc
0
 

Expert Comment

by:alacy
ID: 22623963
My brother had spyware issues. I ran the geek squad MRI on it. Now its doing this logon loop. I went to regedit on the MRI cd because i can't get into normal or safe mode. His key is set to "X:\windows\system32\userinit.exe," . I've tried changing the X to a C and I've tried doing the copy userinit.exe to wsaupdate.exe. I've also tried using the userinit.exe from a non affected pc. It looks like theres a X:(Boot) partition that has windows files in it. I don't know if thats from the spyware or if its something HP does. Also when I go back into regedit after trying to log in again its set back to X:\ and not C:\. Not sure what to do. Any thoughts?
0
 

Expert Comment

by:KJS69
ID: 23696785
log on/off loop
0
 

Expert Comment

by:MichaelWhelan
ID: 26309957
Same symptoms, no AdAware.  Internet Protection 2010 Infection (or funweb ro myweb) seems to have detected the install of Norton and decided to get nasty.  It deleted the Winlogon registry value.  Using ERD's regedit I was able to add the value (userinit.exe,)  then rename the folder "C\:Program Files\InternetProtection2010" to "junk"  and it booted OK, ready to be disinfected.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Most of the time we are in fix when all of sudden our systems behave weirdly.  Such problems cost time and effort... so it's best to take some preventive actions so that we can avoid such issues or overcome such problems more easily. Preventive M…
Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now