Solved

Windows XP Logon - Logoff loop

Posted on 2006-07-05
10
2,995 Views
Last Modified: 2008-01-09
Initial problem was that http stopped working after 10 minutes. Ran Spy Catcher and quarantined some items and  uninstalled zone alarm. When I restarted, the system booted up, I put in admin password, it started to log in, showed the desktop, and logged me off just like I had selected to logoff. After research on the web I found what seemed to be the answer in http://www.winxptutor.com/wsaremove.htm


I followed the direction of booting into the recovery console and:
type COPY USERINIT.EXE WSAUPDATER.EXE and hit enter

now type Exit and hit enter

This did not allow me to log in. I also tried copying the userinit.exe file from another XP system over, this did not work either. One post I read said that you have to run regedit.ext and modify the registry before it will allow you to log in. When I checked the registry, the key was in place and with the correct information. Wiping the system and reinstalling clean is not an option. In addtion to WSAUPDATER.exe instructions, Tried doing an XP Repair install, no change. Ran chkdsk /r and repaired a few problems. Was running XP SP1, installed SP2. Still had the login logoff loop, but found that if I left it booted to the login screen, it downloaded and installed all 42 updates/security updates so it seems that things are working except for the minor problem of not being able to login. Along the way created several new administer accounts to test for corrupt user profile. The only error I get in the System event log when booting in normal mode is "The hpdj service failed to start due to the following error:
The system cannot find the file specified." Event ID 7000. Source: Service Control Manager.  In desperation I have even openned a ticket with Microsoft's XP team, they have been useless and have mostly concentraited on troubleshooting problems that turn out to be related to being in safemode. Here's your chance to show up the "Experts".  ;-)

 
0
Comment
Question by:adamant40
10 Comments
 
LVL 7

Expert Comment

by:puter_geek
ID: 17046501
Is there an option to Undo changes made by Spy Catcher.

Is This Home or Pro??  When you boot up to safe mode, is there a password on the admin account?  Try removing the password and then boot into the recovery console.
0
 
LVL 7

Expert Comment

by:puter_geek
ID: 17046648
Did you create a backup of the userinit.exe before you moved the new file in?
0
 

Author Comment

by:adamant40
ID: 17046873
System is XP Pro SP2. Reinabled everything from Spy Cather while in safe mode, no change. Admin account has a password. New admin accounts created do not. I did manage to get this partially resolved. In a fit of brilliance/desperation I tried going backwards. I copied init.exe to wsaupdate.exe. Then modified the HKLM\software\Microsoft\WindowsNT\CurrentVersion\Winlogon key from c:\WINDOWS\system32\userinit.exe  to c:\WINDOWS\system32\wsaupdater.exe
This fixed the logon - logoff loop problem and I was able to login successfully. This pretty much points to the problem being somewhere in the registry. Now I need to get this thing working the way it should. I'm sure if I run any spyware detectors they will freak and mess this up again. I have tried searching the registry for any additional instances of wsaupdater.exe, none were found.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 17047087
From this webpage:

http://www.eventid.net/display.asp?eventid=7000&eventno=108&source=Service%20Control%20Manager&phase=1

A general note about this event - potentially any service may cause this to be recorded so there could be 1000s of variants. Missing or corrupted files, insufficient rights, missing registry entries, antivirus software, faulty hardware, software bugs and probably many other reasons may cause a service to fail in the starting process. The Service Control Manager that handles the startup of services simply records the failure.

- "The system cannot find the device specified." - This error occurs when a hardware device was removed without removing the drivers as well. The service reported varies depending on the hardware. For a generic description of this error see the link to Error code 20.

- "The service did not start due to a logon failure." - We encountered this message when a server is restarted and the password for some service accounts have been changed without updating the service properties. See the link to Error code 1069.

- "The system cannot find the file specified." - This event may occur when a service was not uninstalled properly (not removed from the service database). The Service Control Manager is trying to start the service but the executable is not there. Remove the entries for the service from the registry. This may also occur if one of the dependent files are missing or are the for the wrong OS version. For generic information about the "The system cannot find the file specified" error see the link Error code 2.


Another page with the same info plus some more info on the error, which apparently has to do with HP Deskjet printers:

http://groups.google.com/group/microsoft.public.windowsxp.perform_maintain/browse_thread/thread/875e4bc80fe8bb05/2f5f40bd43d19991%232f5f40bd43d19991
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 

Author Comment

by:adamant40
ID: 17047695
Thanks Lee,
I think I can ignore any of the stuff on the event log now since I have been able to get into the system when it is booted normally by copying the userinit.exe to wsaupdater.exe, and then changing the HKLM\software\Microsoft\WindowsNT\CurrentVersion\Winlogon key from c:\WINDOWS\system32\userinit.exe to c:\WINDOWS\system32\wsaupdater.exe
Because this lets me login normally, with only those changes, it seems to me that there is either something in the registry that is still calling wsaupdater.exe or there is some piece of spyware or virus that is still doing it. I tried extracting a new userinit.ini from the Windows CD and changing the HKLM key back to userinit.exe, login logout loop returns. I searched the registry for another wsaupdater.exe reference, nothing. I ran 4 different spyware scans and found a few little things but nothing that made a difference. I installed Symantec Corporate edition 10.0, updated and scanned, found nothing.
0
 
LVL 44

Expert Comment

by:scrathcyboy
ID: 17048894
There are several service packs that cause a failure to login due to an invalid detect of a supposed wrong serial number registering the product.  Once this happens, it changes the files in XP at the source, and you cannot recover without either (a) calling MS for a new serial to fic the problem, or (2) doing a totally clean install to a clean HDD.  Note, this flaw is a "MS service pack update" that supposedly fixes a lot of problems.  SURE ....

I turn off ALL automatic updates.  SP2 is all you need if not behind a good router firewall, if you are, SP1a is all you need.  The rest of the MS updates are trouble waiting to happen.  If you can get back to a stable SP2 install, I would do that (first a repair install , then apply SP2, then turn off automatic updates).

If you cant do this, your options are 1 and 2 I just listed above.  Sorry.
0
 

Author Comment

by:adamant40
ID: 17056037
Scrathcyboy,
I can login if I change the HKLM value, see my temp fix above. But thanks for the information. The guy wants his system back so I'm going to leave it with my temp fix. I am going to close this question (If I can figure out how).
0
 
LVL 5

Accepted Solution

by:
Netminder earned 0 total points
ID: 17105683
Closed, 500 points refunded.
Netminder
Site Admin
0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Windows XP Embedded and SHA-2 certificate 7 275
rebuilding your XP box 15 150
Windows 7 Share with XP 22 132
Exchange & AD management console 2 89
If you build your web application in Visual Studio you'll get at least a few binaries, or .DLL, files in your bin folder. However, there is more compiling to be done. Normally this would happen when an ASP.NET resource within the web site is request…
Migration of Exchange mailbox can be done with the ExProfre.exe tool. But at times, when the ExProfre.exe tool migrates the Exchange Server user profile, it results in numerous synchronization problems. Synchronization error messages appear in the e…
Many functions in Excel can make decisions. The most simple of these is the IF function: it returns a value depending on whether a condition you describe is true or false. Once you get the hang of using the IF function, you will find it easier to us…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

912 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now