?
Solved

XP login/logoff issue

Posted on 2009-12-27
18
Medium Priority
?
553 Views
Last Modified: 2012-05-08
I have XP login/logoff issue. I try to login and it logs off.
I cannot login safe mode.

Need Help.
0
Comment
Question by:w2009
  • 7
  • 5
  • 3
  • +2
17 Comments
 
LVL 3

Expert Comment

by:beanrod
ID: 26127162
It could be that your windows has deactivated, I presume you are trying to login with an admin account?
Can you please provide any more details of the circumstances around the issue?
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 26127163
The following page describes how this problem occurs after you have attempted to clean up adware/spyware with a certain version of the data, and also what to do about it:

http://www.winxptutor.com/wsaremove.htm
Unable to logon to Windows after removing BlazeFind using a spyware removal utility?

[begin quote from the above page:]

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.


NOTE    If you don't have a Windows XP CD-ROM, you need to use Windows XP Setup floppy disks to enter the Recovery Console.

 Phase II  -  Fixing a registry entry which causes the Quick Launch issue (not retaining the settings)

Click Start, Run and type REGEDIT. Navigate to:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon]

In the right-pane, change the value of Userinit to "C:\WINDOWS\system32\userinit.exe,"

Type the above value exactly as given, including the comma - exclude the quotes. Also, change the path to userinit.exe appropriately, if Windows is installed in a different drive.

Close Registry Editor and restart Windows.

[end quote.]


Sometimes, you will find that there is no file Userinit.exe or Wsaupdater.exe in the \Windows\System32\ folder.  In this case, all you need to do is, while in the Recovery Console, use the following command to decompress the file userinit.ex_ into the \Windows\System32\ folder as userinit.exe (where X: is replaced by whatever drive letter your CD-ROM uses):

EXPAND X:\I386\USERINIT.EX_  C:\WINDOWS\SYSTEM32
0
 
LVL 11

Expert Comment

by:nordtorp
ID: 26127175
Are you able to login with other user accounts? If so, this could be a problem if you have a corrupt user profile.

This could also be another problem, try the following:
1. Boot using your Windows XP CD
2. Enter recovery console.
3. At the command prompt go to C:/windows/system32
4. Type: dir wsaup*
5. Do you see a wsaupdater.exe? Continue
6. Type copy userinit.exe wsaupdater.exe

Exit and reboot normally. You should now be able to logon.

1. Run regedit
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
3. In the right pane, you should see C:\WINDOWS\System32\wsaupdater.exe
4. Change it so that it reads: C:\WINDOWS\System32\userinit.exe
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 
LVL 59

Expert Comment

by:LeeTutor
ID: 26127208
nordtorp, your "another problem" is the same as what I already gave...
0
 

Author Comment

by:w2009
ID: 26127243
I used erd commander to regedit and found not key as userinit at the location specified.
and file as userinit.exe is also not at the specified locations.

what should i do in this suitation.

0
 
LVL 11

Expert Comment

by:nordtorp
ID: 26127245
I know, I were a slow poster. I did not see your post when I started commenting.
0
 

Author Comment

by:w2009
ID: 26127251
Are you gonna support me here.
0
 
LVL 11

Expert Comment

by:nordtorp
ID: 26127260
Sorry, did you find wsaupdater.exe on your computer?
0
 

Author Comment

by:w2009
ID: 26127272
i deleted the registry key using erd commander, and follow your steps.

then i did below steps:
4. Type: dir wsaup*  
Yes i found

5. Do you see a wsaupdater.exe? Continue

6. Type copy userinit.exe wsaupdater.exe,  
done and overwrite the existing file and restarted.

no change it just logoff again
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 26127281
Did you include the comma in the regedit key value: "C:\WINDOWS\system32\userinit.exe,"?  Did you try the EXPAND command for userinit.ex_  ?
0
 

Author Comment

by:w2009
ID: 26127328
I added the comma now. it did not logoff but did not login.
0
 

Author Comment

by:w2009
ID: 26127335
the HDD is showing beasy.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 26135131
"beasy"?  Maybe you mean "busy".  I would bet that you ave other virus/trojan/malware problems on your computer.  You might have to mount the hard drive in another computer and run antimalware programs.  This could be a problem with viruses/trojans/spyware or other malware. Some free online virus scanners:

http://housecall.antivirus.com 

http://www.pcpitstop.com/antivirus/default.asp 

http://www.pandasoftware.com/activescan/com/activescan_principal.htm 

Also try these free programs to rid your system of spyware, trojans, and other malware:

http://www.superantispyware.com/
SuperAntiSpyware

http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=nl.e415
Malwarebytes' Anti-Malware 1.30
0
 

Expert Comment

by:nrybak
ID: 26138603
Lee,Tutor.  thank you very much, this worked and we are now back into the system and editing the registry.
0
 

Author Comment

by:w2009
ID: 26139183
No i am not the same account
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 26139220
Then have you tried what nrybak did to see if it worked for you?
0
 

Accepted Solution

by:
w2009 earned 0 total points
ID: 26139302
No it did not work for me. finally i have to format the PC.

I did the following:

1. Connected externally and scanned for Viruses and malware
2. Edit the registry in winlogon, using ERD Commander
3. Went through the windows Repair console, copy userinit.exe wsaupdater.exe

I will close the question

Thanks to all for support and sure will try later.
0

Featured Post

Cyber Threats to Small Businesses (Part 2)

The evolving cybersecurity landscape presents SMBs with a host of new threats to their clients, their data, and their bottom line. In part 2 of this blog series, learn three quick processes Webroot’s CISO, Gary Hayslip, recommends to help small businesses beat modern threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
Ransomware - Defeated! Client opened the wrong email and was attacked by Ransomware. I was able to use file recovery utilities to find shadow copies of the encrypted files and make a complete recovery.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question