?
Solved

I disabled some startup programs, now XP won't start properly

Posted on 2006-04-16
27
Medium Priority
?
741 Views
Last Modified: 2012-06-27
Hi experts,
My PC (Win XP, SP2) was running a bit slowly, and after sweeping it for viruses and spyware, I decided to switch off some things that are loaded on startup. I used a program that I downloaded and have used previously without problems. I switched off anything that looked unnecessary eg Copernik desktop search, some Dell multimedia things (it is a Dell laptop), can't remember the rest. I then rebooted, and it gets to the login screen. I login as normal, get the jingle that I usually get, it says "loading your personal settings", but then after a few seconds I get the shutting down jingle, it says "logging off", and I'm back to the logon screen.
I've tried F8 on reboot and tried "last known good settings" - this didn't change the problem.
I tried safe mode, and it booted up in 460x680. I managed to  get the utility going again and switched back on those I remember switching off. However it is still doing the same.
Any ideas, please? Big rush, I've got work to do!!
Thanks
Stuart
0
Comment
Question by:StuartOrd
  • 8
  • 8
  • 7
  • +2
27 Comments
 
LVL 32

Expert Comment

by:masnrock
ID: 16464780
Does this utility have a undo feature?
0
 

Author Comment

by:StuartOrd
ID: 16464878
No,  I can't find one.
I've tried a system restore to yesterday's settings, and it made no difference. However when I reloaded the utility, I noticed that Copernik was ticked. As I hadn't re-ticked it, then Restore must have done  that. I also had deleted a couple of double entries the first time I used it, and they had been retreived from the "deleted" tab and were back under the tab where thay had been, so I guess all the other changes made by the utility are OK
Stuart
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 16464925
Hmmm.  It sounds like you have the sort of logon-logoff loop that is described about 2/3 or the page down on this website, although I cannot for the moment see how disabling startup programs would cause it:

http://www.winxptutor.com/wsaremove.htm
Unable to logon to Windows after removing BlazeFind using a spyware removal utility?

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.


NOTE    If you don't have a Windows XP CD-ROM, you need to use Windows XP Setup floppy disks to enter the Recovery Console.

 Phase II  -  Fixing a registry entry which causes the Quick Launch issue (not retaining the settings)

Click Start, Run and type REGEDIT. Navigate to:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon]

In the right-pane, change the value of Userinit to "C:\WINDOWS\system32\userinit.exe,"

Type the above value exactly as given, including the comma - exclude the quotes. Also, change the path to userinit.exe appropriately, if Windows is installed in a different drive.

Close Registry Editor and restart Windows. The Quick Launch settings should be retained now.


 
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 23

Expert Comment

by:phototropic
ID: 16464946
Solution is here, I think:

http://www.mcse.ms/message616432.html

I had this problem on a client's machine after running a repair install. I followed the suggestion in the above post:

1.get the userinit.exe file from anywhere its in c:/windows/system32/
2.copy it into your windows setup location ie in your c:/windows/system32/
3.rename userinit.exe as wsaupdater.exe and then copy it on into th same fol
der i.e c:/windows/system32

You can do this from a DOS prompt, or mount the non-booting drive as a slave drive in a working machine.
0
 
LVL 23

Expert Comment

by:phototropic
ID: 16464955
On second thoughts, before you try the above, why not just open the Run box in safemode, type "msconfig" (without the quotes), click on the Startup tab, and then just hit the big "Enable All" button. Then reboot, and you should be back where you started.
0
 

Author Comment

by:StuartOrd
ID: 16465033
Thanks for your suggestions.
LeeTutor, I agree, this is the last thing I expected. Sadly this is a Dell laptop with Dell-installed Windows and no recovery or restore disks given to the user. I suppose I could invoke their 24-hr help as a last resort as when I asked them for the disks they said that they would do this if needed, although i guess they'd just re-install windows. Anyway, I can't do what you suggest.
Phototropic, I tried what you said but it made no difference. I was able to copy and rename as you suggested in safe mode.

0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 16465058
Do you have a friend with the same version of XP on it -- by the way is it Home or Pro? -- with an XP install CD that you can borrow for going into Recovery Console?
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 16465067
Hold it, you said you copied the file in Safe mode?!  Then do the registry edit in safe mode, too, and see if that allows you to get back to normal mode.
0
 
LVL 23

Assisted Solution

by:phototropic
phototropic earned 600 total points
ID: 16465083
Did you check this part of the post:

check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and make sure Userinit value is listed. Data field should be c:\windows\system32\userinit.exe. If that value isn't there and you need to create it, use String Value when you create it.

Here is another suggestion from a different forum:

1. Navigate to
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

2. If there is a key named "OldUserinit", delete the "Userinit" key and rename the "OldUserinit" key to "Userinit".

3. The "Userinit" key should now say
"WINDOWS_PATH\system32\userinit.exe,"

"WINDOWS_PATH" is relative to where you have your windows installed.
Mine would be "C:\WINDOWS\system32\userinit.exe,"

Now you can log in again

Any luck? Let us know.
0
 

Author Comment

by:StuartOrd
ID: 16465296
OK. I missed your second post LeeTutor so I've tried Enable All. They were all ticked anyway, but I unticked and reticked and rebooted just to see - no change.
Sorry, no helpful friends with CDs to hand (sad really) It's XP Home. I've never used the Recovery Console but it always starts in safe mode OK
No, there's no OldUserInit
I'm not very au fait with registry keys. The path I've got is the same as yours. If I open Userinit, mine says "C:\WINDOWS\system32\userinit.exe," (the comma is correct)
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16465342
sounds like a corrupt Ntoskrl file to me log into safe mode with command prompt and goto at the command prompt type sfc see if that clears it up
0
 

Author Comment

by:StuartOrd
ID: 16465441
If I run sfc in DOS I get (abbreviated)
File checker v5.1
SFC [/scannow] [/scanonce] [/scanboot] [/revert] [/purgecache] [/cachesize=x]
So I tried sfc/scannow
and it gave me
Windows file protection could not initiate a scan of the protected system files
The specific error code is 0x000006ba [The RPC server is not available]
I tried sfc/revert
and got a similar message.
0
 
LVL 59

Assisted Solution

by:LeeTutor
LeeTutor earned 800 total points
ID: 16465513
Uhoh.  That doesn't sound good.  Here is an MSKB article that contains that error message.  It's for Win2k, but probably applies to XP also:

http://support.microsoft.com/?kbid=296241
Windows File Protection may not start
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16465544
ok do it like this goto the recovery console and logon to the partitoin and type expand d:\i386\ntoskrnl.ex_ c:\windows\system32 see if that resolves the issue
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 16465555
Venom, he doesn't have an XP CD, so cannot go to the Recovery Console.
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16465560
yes he can on dell it is set aside as a fat32 partition
0
 

Author Comment

by:StuartOrd
ID: 16465604
Yes, it quotes the same error code. I followed it through and it's similar to XP but slightly different, and the last part was completely different such that I couldn't follow it.
My long stop is going to be to export all my documents to an external drive using safe mode and then reinstall an Acronis image. Unfortunately the last one I did was several weeks ago so there'll be some repairs to do, but it's starting to sound appealing.
I'm doing another virus scan just in case now that it's offline. This has told me that
Partition table [MBR]          Reading error
Boot sector of disk             Reading error     Path C:
shell32.dll                         Change
user32.dll                         Change
ntoskrnl.exe                     Change
Then it cut out, but looks like it had run out of battery power and not warned me. On restart, it found nothing.
Do those give you any ideas?

0
 
LVL 15

Expert Comment

by:venom96737
ID: 16465629
goto the recovery console and type fixmbr
0
 
LVL 15

Accepted Solution

by:
venom96737 earned 600 total points
ID: 16465640
and also looks like your system files are corrupt and need to be replaced the only way to this is to replace them in the recovery console.
0
 

Author Comment

by:StuartOrd
ID: 16465706
I can't do this from RC. From safe mode, run, I got "Windows cannot find fixmbr"
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16465723
ok on your dell it is located an a seperate partition when you boot up there will be 2 options one is windows xp home the other one is recovery console that is where u want to go.
0
 

Author Comment

by:StuartOrd
ID: 16465728
OK, I give in. Like you I am surprised and rather disappointed that an apparently healthy machine should go so completely wrong for no obvious reason. Any chance that there's a disk fault? Any hints on what to look for once I've reinstalled the image?
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 16465772
venom96737 must be talking about a recovery partition, not the Recovery Console.  A recovery partition will just restore your computer to its original factory state.  And certainly not all Dells have them.  My Inspiron 1150 laptop came with an XP install CD.  I used Partition Magic to create another partition on it for data.  I also used the XP install CD to put the Recovery Console on my hard drive.  
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16465905
No lee it is the recovery console place on a partition in other words the xp cd placed on the partition any system that does not come with an xp disc comes with this partition.  It will enter in just like setup and then you press r and enter the recovery console just like if you had the xp cd in your drive.  If you do not press R it continues on with the format install or recovery just like if you had the CD in your drive.  All systems are provided with either a cd OR this partition no if ands or buts about it.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 16466311
Which models of Dell pcs have this?  I have a Dell Dimension 4100 desktop (several years old) and a Dell Inspiron 1150 laptop (a couple of years old?) and neither has it.  Can you point us to a web page describing this?
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16466415
aahh i stand corrected Dell switched over to making you buy the xp disc seperate and providing only the recover to factory setting partitions in order to make more money.  Just another reason to hate dell but on another note you can use the ultimate boot cd to do all the commands desribed earlier which can be found here http://ubcd.sourceforge.net/ and reover can be possible without restoring an image or reverting back to the factory settings.
0
 

Author Comment

by:StuartOrd
ID: 16473686
Thanks for your help. I rebuilt the machine but it seems to have another problem now - another question coming.
I'll split points equally for help
Stuart
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article (http://rdsrc.us/u3GP7A) first and run the tool TDSSKiller (http://rdsrc.us/GDBBs4) to get rid of the infection. Once done, and if the …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?

750 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question