Go Premium for a chance to win a PS4. Enter to Win


Windows XP Logon - Logoff loop

Posted on 2006-07-05
Medium Priority
Last Modified: 2008-01-09
Initial problem was that http stopped working after 10 minutes. Ran Spy Catcher and quarantined some items and  uninstalled zone alarm. When I restarted, the system booted up, I put in admin password, it started to log in, showed the desktop, and logged me off just like I had selected to logoff. After research on the web I found what seemed to be the answer in http://www.winxptutor.com/wsaremove.htm

I followed the direction of booting into the recovery console and:

now type Exit and hit enter

This did not allow me to log in. I also tried copying the userinit.exe file from another XP system over, this did not work either. One post I read said that you have to run regedit.ext and modify the registry before it will allow you to log in. When I checked the registry, the key was in place and with the correct information. Wiping the system and reinstalling clean is not an option. In addtion to WSAUPDATER.exe instructions, Tried doing an XP Repair install, no change. Ran chkdsk /r and repaired a few problems. Was running XP SP1, installed SP2. Still had the login logoff loop, but found that if I left it booted to the login screen, it downloaded and installed all 42 updates/security updates so it seems that things are working except for the minor problem of not being able to login. Along the way created several new administer accounts to test for corrupt user profile. The only error I get in the System event log when booting in normal mode is "The hpdj service failed to start due to the following error:
The system cannot find the file specified." Event ID 7000. Source: Service Control Manager.  In desperation I have even openned a ticket with Microsoft's XP team, they have been useless and have mostly concentraited on troubleshooting problems that turn out to be related to being in safemode. Here's your chance to show up the "Experts".  ;-)

Question by:adamant40

Expert Comment

ID: 17046501
Is there an option to Undo changes made by Spy Catcher.

Is This Home or Pro??  When you boot up to safe mode, is there a password on the admin account?  Try removing the password and then boot into the recovery console.

Expert Comment

ID: 17046648
Did you create a backup of the userinit.exe before you moved the new file in?

Author Comment

ID: 17046873
System is XP Pro SP2. Reinabled everything from Spy Cather while in safe mode, no change. Admin account has a password. New admin accounts created do not. I did manage to get this partially resolved. In a fit of brilliance/desperation I tried going backwards. I copied init.exe to wsaupdate.exe. Then modified the HKLM\software\Microsoft\WindowsNT\CurrentVersion\Winlogon key from c:\WINDOWS\system32\userinit.exe  to c:\WINDOWS\system32\wsaupdater.exe
This fixed the logon - logoff loop problem and I was able to login successfully. This pretty much points to the problem being somewhere in the registry. Now I need to get this thing working the way it should. I'm sure if I run any spyware detectors they will freak and mess this up again. I have tried searching the registry for any additional instances of wsaupdater.exe, none were found.
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

LVL 59

Expert Comment

ID: 17047087
From this webpage:


A general note about this event - potentially any service may cause this to be recorded so there could be 1000s of variants. Missing or corrupted files, insufficient rights, missing registry entries, antivirus software, faulty hardware, software bugs and probably many other reasons may cause a service to fail in the starting process. The Service Control Manager that handles the startup of services simply records the failure.

- "The system cannot find the device specified." - This error occurs when a hardware device was removed without removing the drivers as well. The service reported varies depending on the hardware. For a generic description of this error see the link to Error code 20.

- "The service did not start due to a logon failure." - We encountered this message when a server is restarted and the password for some service accounts have been changed without updating the service properties. See the link to Error code 1069.

- "The system cannot find the file specified." - This event may occur when a service was not uninstalled properly (not removed from the service database). The Service Control Manager is trying to start the service but the executable is not there. Remove the entries for the service from the registry. This may also occur if one of the dependent files are missing or are the for the wrong OS version. For generic information about the "The system cannot find the file specified" error see the link Error code 2.

Another page with the same info plus some more info on the error, which apparently has to do with HP Deskjet printers:


Author Comment

ID: 17047695
Thanks Lee,
I think I can ignore any of the stuff on the event log now since I have been able to get into the system when it is booted normally by copying the userinit.exe to wsaupdater.exe, and then changing the HKLM\software\Microsoft\WindowsNT\CurrentVersion\Winlogon key from c:\WINDOWS\system32\userinit.exe to c:\WINDOWS\system32\wsaupdater.exe
Because this lets me login normally, with only those changes, it seems to me that there is either something in the registry that is still calling wsaupdater.exe or there is some piece of spyware or virus that is still doing it. I tried extracting a new userinit.ini from the Windows CD and changing the HKLM key back to userinit.exe, login logout loop returns. I searched the registry for another wsaupdater.exe reference, nothing. I ran 4 different spyware scans and found a few little things but nothing that made a difference. I installed Symantec Corporate edition 10.0, updated and scanned, found nothing.
LVL 44

Expert Comment

ID: 17048894
There are several service packs that cause a failure to login due to an invalid detect of a supposed wrong serial number registering the product.  Once this happens, it changes the files in XP at the source, and you cannot recover without either (a) calling MS for a new serial to fic the problem, or (2) doing a totally clean install to a clean HDD.  Note, this flaw is a "MS service pack update" that supposedly fixes a lot of problems.  SURE ....

I turn off ALL automatic updates.  SP2 is all you need if not behind a good router firewall, if you are, SP1a is all you need.  The rest of the MS updates are trouble waiting to happen.  If you can get back to a stable SP2 install, I would do that (first a repair install , then apply SP2, then turn off automatic updates).

If you cant do this, your options are 1 and 2 I just listed above.  Sorry.

Author Comment

ID: 17056037
I can login if I change the HKLM value, see my temp fix above. But thanks for the information. The guy wants his system back so I'm going to leave it with my temp fix. I am going to close this question (If I can figure out how).

Accepted Solution

Netminder earned 0 total points
ID: 17105683
Closed, 500 points refunded.
Site Admin

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disclosure: Use this tutorial only when no other options helps to get Windows XP running without any problems and you don't want to format the drive. The back up of the data is the responsible of the user, however there is a description of how t…
We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Suggested Courses

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question