Solved

Windows XP Logon - Logoff loop

Posted on 2006-07-05
10
2,990 Views
Last Modified: 2008-01-09
Initial problem was that http stopped working after 10 minutes. Ran Spy Catcher and quarantined some items and  uninstalled zone alarm. When I restarted, the system booted up, I put in admin password, it started to log in, showed the desktop, and logged me off just like I had selected to logoff. After research on the web I found what seemed to be the answer in http://www.winxptutor.com/wsaremove.htm


I followed the direction of booting into the recovery console and:
type COPY USERINIT.EXE WSAUPDATER.EXE and hit enter

now type Exit and hit enter

This did not allow me to log in. I also tried copying the userinit.exe file from another XP system over, this did not work either. One post I read said that you have to run regedit.ext and modify the registry before it will allow you to log in. When I checked the registry, the key was in place and with the correct information. Wiping the system and reinstalling clean is not an option. In addtion to WSAUPDATER.exe instructions, Tried doing an XP Repair install, no change. Ran chkdsk /r and repaired a few problems. Was running XP SP1, installed SP2. Still had the login logoff loop, but found that if I left it booted to the login screen, it downloaded and installed all 42 updates/security updates so it seems that things are working except for the minor problem of not being able to login. Along the way created several new administer accounts to test for corrupt user profile. The only error I get in the System event log when booting in normal mode is "The hpdj service failed to start due to the following error:
The system cannot find the file specified." Event ID 7000. Source: Service Control Manager.  In desperation I have even openned a ticket with Microsoft's XP team, they have been useless and have mostly concentraited on troubleshooting problems that turn out to be related to being in safemode. Here's your chance to show up the "Experts".  ;-)

 
0
Comment
Question by:adamant40
10 Comments
 
LVL 7

Expert Comment

by:puter_geek
ID: 17046501
Is there an option to Undo changes made by Spy Catcher.

Is This Home or Pro??  When you boot up to safe mode, is there a password on the admin account?  Try removing the password and then boot into the recovery console.
0
 
LVL 7

Expert Comment

by:puter_geek
ID: 17046648
Did you create a backup of the userinit.exe before you moved the new file in?
0
 

Author Comment

by:adamant40
ID: 17046873
System is XP Pro SP2. Reinabled everything from Spy Cather while in safe mode, no change. Admin account has a password. New admin accounts created do not. I did manage to get this partially resolved. In a fit of brilliance/desperation I tried going backwards. I copied init.exe to wsaupdate.exe. Then modified the HKLM\software\Microsoft\WindowsNT\CurrentVersion\Winlogon key from c:\WINDOWS\system32\userinit.exe  to c:\WINDOWS\system32\wsaupdater.exe
This fixed the logon - logoff loop problem and I was able to login successfully. This pretty much points to the problem being somewhere in the registry. Now I need to get this thing working the way it should. I'm sure if I run any spyware detectors they will freak and mess this up again. I have tried searching the registry for any additional instances of wsaupdater.exe, none were found.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 17047087
From this webpage:

http://www.eventid.net/display.asp?eventid=7000&eventno=108&source=Service%20Control%20Manager&phase=1

A general note about this event - potentially any service may cause this to be recorded so there could be 1000s of variants. Missing or corrupted files, insufficient rights, missing registry entries, antivirus software, faulty hardware, software bugs and probably many other reasons may cause a service to fail in the starting process. The Service Control Manager that handles the startup of services simply records the failure.

- "The system cannot find the device specified." - This error occurs when a hardware device was removed without removing the drivers as well. The service reported varies depending on the hardware. For a generic description of this error see the link to Error code 20.

- "The service did not start due to a logon failure." - We encountered this message when a server is restarted and the password for some service accounts have been changed without updating the service properties. See the link to Error code 1069.

- "The system cannot find the file specified." - This event may occur when a service was not uninstalled properly (not removed from the service database). The Service Control Manager is trying to start the service but the executable is not there. Remove the entries for the service from the registry. This may also occur if one of the dependent files are missing or are the for the wrong OS version. For generic information about the "The system cannot find the file specified" error see the link Error code 2.


Another page with the same info plus some more info on the error, which apparently has to do with HP Deskjet printers:

http://groups.google.com/group/microsoft.public.windowsxp.perform_maintain/browse_thread/thread/875e4bc80fe8bb05/2f5f40bd43d19991%232f5f40bd43d19991
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 

Author Comment

by:adamant40
ID: 17047695
Thanks Lee,
I think I can ignore any of the stuff on the event log now since I have been able to get into the system when it is booted normally by copying the userinit.exe to wsaupdater.exe, and then changing the HKLM\software\Microsoft\WindowsNT\CurrentVersion\Winlogon key from c:\WINDOWS\system32\userinit.exe to c:\WINDOWS\system32\wsaupdater.exe
Because this lets me login normally, with only those changes, it seems to me that there is either something in the registry that is still calling wsaupdater.exe or there is some piece of spyware or virus that is still doing it. I tried extracting a new userinit.ini from the Windows CD and changing the HKLM key back to userinit.exe, login logout loop returns. I searched the registry for another wsaupdater.exe reference, nothing. I ran 4 different spyware scans and found a few little things but nothing that made a difference. I installed Symantec Corporate edition 10.0, updated and scanned, found nothing.
0
 
LVL 44

Expert Comment

by:scrathcyboy
ID: 17048894
There are several service packs that cause a failure to login due to an invalid detect of a supposed wrong serial number registering the product.  Once this happens, it changes the files in XP at the source, and you cannot recover without either (a) calling MS for a new serial to fic the problem, or (2) doing a totally clean install to a clean HDD.  Note, this flaw is a "MS service pack update" that supposedly fixes a lot of problems.  SURE ....

I turn off ALL automatic updates.  SP2 is all you need if not behind a good router firewall, if you are, SP1a is all you need.  The rest of the MS updates are trouble waiting to happen.  If you can get back to a stable SP2 install, I would do that (first a repair install , then apply SP2, then turn off automatic updates).

If you cant do this, your options are 1 and 2 I just listed above.  Sorry.
0
 

Author Comment

by:adamant40
ID: 17056037
Scrathcyboy,
I can login if I change the HKLM value, see my temp fix above. But thanks for the information. The guy wants his system back so I'm going to leave it with my temp fix. I am going to close this question (If I can figure out how).
0
 
LVL 5

Accepted Solution

by:
Netminder earned 0 total points
ID: 17105683
Closed, 500 points refunded.
Netminder
Site Admin
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

If you have done a reformat of your hard drive and proceeded to do a successful Windows XP installation, you may notice that a choice between two operating systems when you start up the machine. Here is how to get rid of this: Click Start Clic…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now