I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro plus
latest updates. He has done some maintenance work on the computer defragging,
spyware scan and removal, etc and now the PC won't start beyond the user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an icon for
his user account. When he clicks this icon the computer tries to get to the
desktop but comes right back to the logon screen with no error message
displayed. He reports that the machine did not display the logon screen,
i.e. went straight through to the desktop, until this problem occurred.

The user doesn't think the machine will boot in to safe mode but he's not
sure.

The user will not be back in the office for 48hrs which is when I have an
appointment to examine the machine. If I can boot in to safe mode I will try
running system restore from the command prompt but wondered if anyone else
had any other ideas for resolving this?

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" <Dell (E-Mail Removed)am> wrote in message
news:0A7D1E4C-8043-4BFA-A2AA-(E-Mail Removed)...
> I'm an IT Technician and I support small businesses and home users.
>
> I've got a call from a business user regarding a PC with Win XP Pro plus
> latest updates. He has done some maintenance work on the computer
> defragging,
> spyware scan and removal, etc and now the PC won't start beyond the user
> style (as opposed to CTRL-ALT-DEL) logon screen.
>
> When the computer starts it stops at the logon screen displaying an icon
> for
> his user account. When he clicks this icon the computer tries to get to
> the
> desktop but comes right back to the logon screen with no error message
> displayed. He reports that the machine did not display the logon screen,
> i.e. went straight through to the desktop, until this problem occurred.
>
> The user doesn't think the machine will boot in to safe mode but he's not
> sure.
>
> The user will not be back in the office for 48hrs which is when I have an
> appointment to examine the machine. If I can boot in to safe mode I will
> try
> running system restore from the command prompt but wondered if anyone else
> had any other ideas for resolving this?

Thanks Mark I'll give this a go and post back.

"Mark L. Ferguson" wrote:

> You cannot log on to Windows XP after you remove Wsaupdater.exe:
> http://support.microsoft.com/kb/892893
>
> --
> Please use the Communities guidelines when posting.
> http://www.microsoft.com/wn3/locales...help_en-us.htm
> Use the "Ratings" feature. It helps the new users.
> Mark L. Ferguson MS-MVP
> https://mvp.support.microsoft.com/profile/Mark.Ferguson
>
> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> news:0A7D1E4C-8043-4BFA-A2AA-(E-Mail Removed)...
> > I'm an IT Technician and I support small businesses and home users.
> >
> > I've got a call from a business user regarding a PC with Win XP Pro plus
> > latest updates. He has done some maintenance work on the computer
> > defragging,
> > spyware scan and removal, etc and now the PC won't start beyond the user
> > style (as opposed to CTRL-ALT-DEL) logon screen.
> >
> > When the computer starts it stops at the logon screen displaying an icon
> > for
> > his user account. When he clicks this icon the computer tries to get to
> > the
> > desktop but comes right back to the logon screen with no error message
> > displayed. He reports that the machine did not display the logon screen,
> > i.e. went straight through to the desktop, until this problem occurred.
> >
> > The user doesn't think the machine will boot in to safe mode but he's not
> > sure.
> >
> > The user will not be back in the office for 48hrs which is when I have an
> > appointment to examine the machine. If I can boot in to safe mode I will
> > try
> > running system restore from the command prompt but wondered if anyone else
> > had any other ideas for resolving this?
>

Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery Console to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get past
the logon screen.

I think that the problem is probably that described in KB892893 as the user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when he
became infected and the last time he scanned the computer was around March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

> You cannot log on to Windows XP after you remove Wsaupdater.exe:
> http://support.microsoft.com/kb/892893
>
> --
> Please use the Communities guidelines when posting.
> http://www.microsoft.com/wn3/locales...help_en-us.htm
> Use the "Ratings" feature. It helps the new users.
> Mark L. Ferguson MS-MVP
> https://mvp.support.microsoft.com/profile/Mark.Ferguson
>
> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> news:0A7D1E4C-8043-4BFA-A2AA-(E-Mail Removed)...
> > I'm an IT Technician and I support small businesses and home users.
> >
> > I've got a call from a business user regarding a PC with Win XP Pro plus
> > latest updates. He has done some maintenance work on the computer
> > defragging,
> > spyware scan and removal, etc and now the PC won't start beyond the user
> > style (as opposed to CTRL-ALT-DEL) logon screen.
> >
> > When the computer starts it stops at the logon screen displaying an icon
> > for
> > his user account. When he clicks this icon the computer tries to get to
> > the
> > desktop but comes right back to the logon screen with no error message
> > displayed. He reports that the machine did not display the logon screen,
> > i.e. went straight through to the desktop, until this problem occurred.
> >
> > The user doesn't think the machine will boot in to safe mode but he's not
> > sure.
> >
> > The user will not be back in the office for 48hrs which is when I have an
> > appointment to examine the machine. If I can boot in to safe mode I will
> > try
> > running system restore from the command prompt but wondered if anyone else
> > had any other ideas for resolving this?
>

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
..
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" <Dell (E-Mail Removed)am> wrote in message
news:F2EE53AE-E873-4F72-8F8A-(E-Mail Removed)...
> Mark,
>
> Thanks for your reply.
>
> I successfully carried out step 1 in KB892893, i.e. Use Recovery Console
> to
> copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get past
> the logon screen.
>
> I think that the problem is probably that described in KB892893 as the
> user
> ran Ad-Aware immediately prior to the problem occurring.
>
> I guess System Restore might be an option but the user isn't sure when he
> became infected and the last time he scanned the computer was around March
> this year.
>
> Any advice you can give would be greatly appreciated,
> Malcolm
>
> "Mark L. Ferguson" wrote:
>
>> You cannot log on to Windows XP after you remove Wsaupdater.exe:
>> http://support.microsoft.com/kb/892893
>>
>> --
>> Please use the Communities guidelines when posting.
>> http://www.microsoft.com/wn3/locales...help_en-us.htm
>> Use the "Ratings" feature. It helps the new users.
>> Mark L. Ferguson MS-MVP
>> https://mvp.support.microsoft.com/profile/Mark.Ferguson
>>
>> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
>> news:0A7D1E4C-8043-4BFA-A2AA-(E-Mail Removed)...
>> > I'm an IT Technician and I support small businesses and home users.
>> >
>> > I've got a call from a business user regarding a PC with Win XP Pro
>> > plus
>> > latest updates. He has done some maintenance work on the computer
>> > defragging,
>> > spyware scan and removal, etc and now the PC won't start beyond the
>> > user
>> > style (as opposed to CTRL-ALT-DEL) logon screen.
>> >
>> > When the computer starts it stops at the logon screen displaying an
>> > icon
>> > for
>> > his user account. When he clicks this icon the computer tries to get to
>> > the
>> > desktop but comes right back to the logon screen with no error message
>> > displayed. He reports that the machine did not display the logon
>> > screen,
>> > i.e. went straight through to the desktop, until this problem occurred.
>> >
>> > The user doesn't think the machine will boot in to safe mode but he's
>> > not
>> > sure.
>> >
>> > The user will not be back in the office for 48hrs which is when I have
>> > an
>> > appointment to examine the machine. If I can boot in to safe mode I
>> > will
>> > try
>> > running system restore from the command prompt but wondered if anyone
>> > else
>> > had any other ideas for resolving this?
>>

Thanks for this Mark.

I'm having problems with replacing winlogon.exe. I've booted in to Recovery
Console from a Win XP CD, when prompted for a windows installation to log in
to I've chosen C:\Windows, entered the Admin password and I'm in Recovery
Console. When I enter the command syntax you've given below I get "The
command is not recognised..."

Am I doing something wrong?

"Mark L. Ferguson" wrote:

> Another file in the process that can be replaced in winlogon.exe
>
> run from a boot to CD and Recovery Console (press 'r' for Repair), the
> command:
>
> (cd drive letter here):/i386/expand.exe (cd drive letter
> here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe
>
> The registry entry for wsaupdater should be:
> expand
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
> .
> 3. In the right pane, right-click userinit, and then click Modify.
> 4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe
>
> The way to access the registry from recovery console is a bit different from
> the normal windows interface, using REG.EXE
>
> How to edit the registry offline using BartPE boot CD:
> http://windowsxp.mvps.org/peboot.htm
> --
> Please use the Communities guidelines when posting.
> http://www.microsoft.com/wn3/locales...help_en-us.htm
> Use the "Ratings" feature. It helps the new users.
> Mark L. Ferguson MS-MVP
> https://mvp.support.microsoft.com/profile/Mark.Ferguson
>
> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> news:F2EE53AE-E873-4F72-8F8A-(E-Mail Removed)...
> > Mark,
> >
> > Thanks for your reply.
> >
> > I successfully carried out step 1 in KB892893, i.e. Use Recovery Console
> > to
> > copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get past
> > the logon screen.
> >
> > I think that the problem is probably that described in KB892893 as the
> > user
> > ran Ad-Aware immediately prior to the problem occurring.
> >
> > I guess System Restore might be an option but the user isn't sure when he
> > became infected and the last time he scanned the computer was around March
> > this year.
> >
> > Any advice you can give would be greatly appreciated,
> > Malcolm
> >
> > "Mark L. Ferguson" wrote:
> >
> >> You cannot log on to Windows XP after you remove Wsaupdater.exe:
> >> http://support.microsoft.com/kb/892893
> >>
> >> --
> >> Please use the Communities guidelines when posting.
> >> http://www.microsoft.com/wn3/locales...help_en-us.htm
> >> Use the "Ratings" feature. It helps the new users.
> >> Mark L. Ferguson MS-MVP
> >> https://mvp.support.microsoft.com/profile/Mark.Ferguson
> >>
> >> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> >> news:0A7D1E4C-8043-4BFA-A2AA-(E-Mail Removed)...
> >> > I'm an IT Technician and I support small businesses and home users.
> >> >
> >> > I've got a call from a business user regarding a PC with Win XP Pro
> >> > plus
> >> > latest updates. He has done some maintenance work on the computer
> >> > defragging,
> >> > spyware scan and removal, etc and now the PC won't start beyond the
> >> > user
> >> > style (as opposed to CTRL-ALT-DEL) logon screen.
> >> >
> >> > When the computer starts it stops at the logon screen displaying an
> >> > icon
> >> > for
> >> > his user account. When he clicks this icon the computer tries to get to
> >> > the
> >> > desktop but comes right back to the logon screen with no error message
> >> > displayed. He reports that the machine did not display the logon
> >> > screen,
> >> > i.e. went straight through to the desktop, until this problem occurred.
> >> >
> >> > The user doesn't think the machine will boot in to safe mode but he's
> >> > not
> >> > sure.
> >> >
> >> > The user will not be back in the office for 48hrs which is when I have
> >> > an
> >> > appointment to examine the machine. If I can boot in to safe mode I
> >> > will
> >> > try
> >> > running system restore from the command prompt but wondered if anyone
> >> > else
> >> > had any other ideas for resolving this?
> >>

Is it possible/advisable to copy winlogon.ex_ directly from the i386 folder
of the CD to C:/Windows/system32?

"Mark L. Ferguson" wrote:

> Another file in the process that can be replaced in winlogon.exe
>
> run from a boot to CD and Recovery Console (press 'r' for Repair), the
> command:
>
> (cd drive letter here):/i386/expand.exe (cd drive letter
> here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe
>
> The registry entry for wsaupdater should be:
> expand
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
> .
> 3. In the right pane, right-click userinit, and then click Modify.
> 4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe
>
> The way to access the registry from recovery console is a bit different from
> the normal windows interface, using REG.EXE
>
> How to edit the registry offline using BartPE boot CD:
> http://windowsxp.mvps.org/peboot.htm
> --
> Please use the Communities guidelines when posting.
> http://www.microsoft.com/wn3/locales...help_en-us.htm
> Use the "Ratings" feature. It helps the new users.
> Mark L. Ferguson MS-MVP
> https://mvp.support.microsoft.com/profile/Mark.Ferguson
>
> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> news:F2EE53AE-E873-4F72-8F8A-(E-Mail Removed)...
> > Mark,
> >
> > Thanks for your reply.
> >
> > I successfully carried out step 1 in KB892893, i.e. Use Recovery Console
> > to
> > copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get past
> > the logon screen.
> >
> > I think that the problem is probably that described in KB892893 as the
> > user
> > ran Ad-Aware immediately prior to the problem occurring.
> >
> > I guess System Restore might be an option but the user isn't sure when he
> > became infected and the last time he scanned the computer was around March
> > this year.
> >
> > Any advice you can give would be greatly appreciated,
> > Malcolm
> >
> > "Mark L. Ferguson" wrote:
> >
> >> You cannot log on to Windows XP after you remove Wsaupdater.exe:
> >> http://support.microsoft.com/kb/892893
> >>
> >> --
> >> Please use the Communities guidelines when posting.
> >> http://www.microsoft.com/wn3/locales...help_en-us.htm
> >> Use the "Ratings" feature. It helps the new users.
> >> Mark L. Ferguson MS-MVP
> >> https://mvp.support.microsoft.com/profile/Mark.Ferguson
> >>
> >> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> >> news:0A7D1E4C-8043-4BFA-A2AA-(E-Mail Removed)...
> >> > I'm an IT Technician and I support small businesses and home users.
> >> >
> >> > I've got a call from a business user regarding a PC with Win XP Pro
> >> > plus
> >> > latest updates. He has done some maintenance work on the computer
> >> > defragging,
> >> > spyware scan and removal, etc and now the PC won't start beyond the
> >> > user
> >> > style (as opposed to CTRL-ALT-DEL) logon screen.
> >> >
> >> > When the computer starts it stops at the logon screen displaying an
> >> > icon
> >> > for
> >> > his user account. When he clicks this icon the computer tries to get to
> >> > the
> >> > desktop but comes right back to the logon screen with no error message
> >> > displayed. He reports that the machine did not display the logon
> >> > screen,
> >> > i.e. went straight through to the desktop, until this problem occurred.
> >> >
> >> > The user doesn't think the machine will boot in to safe mode but he's
> >> > not
> >> > sure.
> >> >
> >> > The user will not be back in the office for 48hrs which is when I have
> >> > an
> >> > appointment to examine the machine. If I can boot in to safe mode I
> >> > will
> >> > try
> >> > running system restore from the command prompt but wondered if anyone
> >> > else
> >> > had any other ideas for resolving this?
> >>

winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to explain
why the user can't logon?

"Mark L. Ferguson" wrote:

> Another file in the process that can be replaced in winlogon.exe
>
> run from a boot to CD and Recovery Console (press 'r' for Repair), the
> command:
>
> (cd drive letter here):/i386/expand.exe (cd drive letter
> here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe
>
> The registry entry for wsaupdater should be:
> expand
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
> .
> 3. In the right pane, right-click userinit, and then click Modify.
> 4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe
>
> The way to access the registry from recovery console is a bit different from
> the normal windows interface, using REG.EXE
>
> How to edit the registry offline using BartPE boot CD:
> http://windowsxp.mvps.org/peboot.htm
> --
> Please use the Communities guidelines when posting.
> http://www.microsoft.com/wn3/locales...help_en-us.htm
> Use the "Ratings" feature. It helps the new users.
> Mark L. Ferguson MS-MVP
> https://mvp.support.microsoft.com/profile/Mark.Ferguson
>
> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> news:F2EE53AE-E873-4F72-8F8A-(E-Mail Removed)...
> > Mark,
> >
> > Thanks for your reply.
> >
> > I successfully carried out step 1 in KB892893, i.e. Use Recovery Console
> > to
> > copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get past
> > the logon screen.
> >
> > I think that the problem is probably that described in KB892893 as the
> > user
> > ran Ad-Aware immediately prior to the problem occurring.
> >
> > I guess System Restore might be an option but the user isn't sure when he
> > became infected and the last time he scanned the computer was around March
> > this year.
> >
> > Any advice you can give would be greatly appreciated,
> > Malcolm
> >
> > "Mark L. Ferguson" wrote:
> >
> >> You cannot log on to Windows XP after you remove Wsaupdater.exe:
> >> http://support.microsoft.com/kb/892893
> >>
> >> --
> >> Please use the Communities guidelines when posting.
> >> http://www.microsoft.com/wn3/locales...help_en-us.htm
> >> Use the "Ratings" feature. It helps the new users.
> >> Mark L. Ferguson MS-MVP
> >> https://mvp.support.microsoft.com/profile/Mark.Ferguson
> >>
> >> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> >> news:0A7D1E4C-8043-4BFA-A2AA-(E-Mail Removed)...
> >> > I'm an IT Technician and I support small businesses and home users.
> >> >
> >> > I've got a call from a business user regarding a PC with Win XP Pro
> >> > plus
> >> > latest updates. He has done some maintenance work on the computer
> >> > defragging,
> >> > spyware scan and removal, etc and now the PC won't start beyond the
> >> > user
> >> > style (as opposed to CTRL-ALT-DEL) logon screen.
> >> >
> >> > When the computer starts it stops at the logon screen displaying an
> >> > icon
> >> > for
> >> > his user account. When he clicks this icon the computer tries to get to
> >> > the
> >> > desktop but comes right back to the logon screen with no error message
> >> > displayed. He reports that the machine did not display the logon
> >> > screen,
> >> > i.e. went straight through to the desktop, until this problem occurred.
> >> >
> >> > The user doesn't think the machine will boot in to safe mode but he's
> >> > not
> >> > sure.
> >> >
> >> > The user will not be back in the office for 48hrs which is when I have
> >> > an
> >> > appointment to examine the machine. If I can boot in to safe mode I
> >> > will
> >> > try
> >> > running system restore from the command prompt but wondered if anyone
> >> > else
> >> > had any other ideas for resolving this?
> >>

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" <Dell (E-Mail Removed)am> wrote in message
news:C78DA62F-22EB-423C-BC8F-(E-Mail Removed)...
> winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.
>
> I'm going to try editing the registry key but this doesn't appear to
> explain
> why the user can't logon?
>
> "Mark L. Ferguson" wrote:
>
>> Another file in the process that can be replaced in winlogon.exe
>>
>> run from a boot to CD and Recovery Console (press 'r' for Repair), the
>> command:
>>
>> (cd drive letter here):/i386/expand.exe (cd drive letter
>> here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe
>>
>> The registry entry for wsaupdater should be:
>> expand
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
>> .
>> 3. In the right pane, right-click userinit, and then click Modify.
>> 4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe
>>
>> The way to access the registry from recovery console is a bit different
>> from
>> the normal windows interface, using REG.EXE
>>
>> How to edit the registry offline using BartPE boot CD:
>> http://windowsxp.mvps.org/peboot.htm
>> --
>> Please use the Communities guidelines when posting.
>> http://www.microsoft.com/wn3/locales...help_en-us.htm
>> Use the "Ratings" feature. It helps the new users.
>> Mark L. Ferguson MS-MVP
>> https://mvp.support.microsoft.com/profile/Mark.Ferguson
>>
>> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
>> news:F2EE53AE-E873-4F72-8F8A-(E-Mail Removed)...
>> > Mark,
>> >
>> > Thanks for your reply.
>> >
>> > I successfully carried out step 1 in KB892893, i.e. Use Recovery
>> > Console
>> > to
>> > copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
>> > past
>> > the logon screen.
>> >
>> > I think that the problem is probably that described in KB892893 as the
>> > user
>> > ran Ad-Aware immediately prior to the problem occurring.
>> >
>> > I guess System Restore might be an option but the user isn't sure when
>> > he
>> > became infected and the last time he scanned the computer was around
>> > March
>> > this year.
>> >
>> > Any advice you can give would be greatly appreciated,
>> > Malcolm
>> >
>> > "Mark L. Ferguson" wrote:
>> >
>> >> You cannot log on to Windows XP after you remove Wsaupdater.exe:
>> >> http://support.microsoft.com/kb/892893
>> >>
>> >> --
>> >> Please use the Communities guidelines when posting.
>> >> http://www.microsoft.com/wn3/locales...help_en-us.htm
>> >> Use the "Ratings" feature. It helps the new users.
>> >> Mark L. Ferguson MS-MVP
>> >> https://mvp.support.microsoft.com/profile/Mark.Ferguson
>> >>
>> >> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
>> >> news:0A7D1E4C-8043-4BFA-A2AA-(E-Mail Removed)...
>> >> > I'm an IT Technician and I support small businesses and home users.
>> >> >
>> >> > I've got a call from a business user regarding a PC with Win XP Pro
>> >> > plus
>> >> > latest updates. He has done some maintenance work on the computer
>> >> > defragging,
>> >> > spyware scan and removal, etc and now the PC won't start beyond the
>> >> > user
>> >> > style (as opposed to CTRL-ALT-DEL) logon screen.
>> >> >
>> >> > When the computer starts it stops at the logon screen displaying an
>> >> > icon
>> >> > for
>> >> > his user account. When he clicks this icon the computer tries to get
>> >> > to
>> >> > the
>> >> > desktop but comes right back to the logon screen with no error
>> >> > message
>> >> > displayed. He reports that the machine did not display the logon
>> >> > screen,
>> >> > i.e. went straight through to the desktop, until this problem
>> >> > occurred.
>> >> >
>> >> > The user doesn't think the machine will boot in to safe mode but
>> >> > he's
>> >> > not
>> >> > sure.
>> >> >
>> >> > The user will not be back in the office for 48hrs which is when I
>> >> > have
>> >> > an
>> >> > appointment to examine the machine. If I can boot in to safe mode I
>> >> > will
>> >> > try
>> >> > running system restore from the command prompt but wondered if
>> >> > anyone
>> >> > else
>> >> > had any other ideas for resolving this?
>> >>

Thanks again.

Is there any info on how I can create a new user (presumably from the
command line) from Recovery Console after LOGON?


"Mark L. Ferguson" wrote:

> If this also fails, you are probably going to have to logon as default
> "Administrator" to see if a new user can be created.
>
> From the recovery console, type:
> LOGON
>
> 811151 - How to Copy User Data to a New User Profile:
> http://support.microsoft.com/default...b;en-us;811151
>
> --
> Please use the Communities guidelines when posting.
> http://www.microsoft.com/wn3/locales...help_en-us.htm
> Use the "Ratings" feature. It helps the new users.
> Mark L. Ferguson MS-MVP
> https://mvp.support.microsoft.com/profile/Mark.Ferguson
>
> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> news:C78DA62F-22EB-423C-BC8F-(E-Mail Removed)...
> > winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.
> >
> > I'm going to try editing the registry key but this doesn't appear to
> > explain
> > why the user can't logon?
> >
> > "Mark L. Ferguson" wrote:
> >
> >> Another file in the process that can be replaced in winlogon.exe
> >>
> >> run from a boot to CD and Recovery Console (press 'r' for Repair), the
> >> command:
> >>
> >> (cd drive letter here):/i386/expand.exe (cd drive letter
> >> here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe
> >>
> >> The registry entry for wsaupdater should be:
> >> expand
> >> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
> >> .
> >> 3. In the right pane, right-click userinit, and then click Modify.
> >> 4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe
> >>
> >> The way to access the registry from recovery console is a bit different
> >> from
> >> the normal windows interface, using REG.EXE
> >>
> >> How to edit the registry offline using BartPE boot CD:
> >> http://windowsxp.mvps.org/peboot.htm
> >> --
> >> Please use the Communities guidelines when posting.
> >> http://www.microsoft.com/wn3/locales...help_en-us.htm
> >> Use the "Ratings" feature. It helps the new users.
> >> Mark L. Ferguson MS-MVP
> >> https://mvp.support.microsoft.com/profile/Mark.Ferguson
> >>
> >> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> >> news:F2EE53AE-E873-4F72-8F8A-(E-Mail Removed)...
> >> > Mark,
> >> >
> >> > Thanks for your reply.
> >> >
> >> > I successfully carried out step 1 in KB892893, i.e. Use Recovery
> >> > Console
> >> > to
> >> > copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
> >> > past
> >> > the logon screen.
> >> >
> >> > I think that the problem is probably that described in KB892893 as the
> >> > user
> >> > ran Ad-Aware immediately prior to the problem occurring.
> >> >
> >> > I guess System Restore might be an option but the user isn't sure when
> >> > he
> >> > became infected and the last time he scanned the computer was around
> >> > March
> >> > this year.
> >> >
> >> > Any advice you can give would be greatly appreciated,
> >> > Malcolm
> >> >
> >> > "Mark L. Ferguson" wrote:
> >> >
> >> >> You cannot log on to Windows XP after you remove Wsaupdater.exe:
> >> >> http://support.microsoft.com/kb/892893
> >> >>
> >> >> --
> >> >> Please use the Communities guidelines when posting.
> >> >> http://www.microsoft.com/wn3/locales...help_en-us.htm
> >> >> Use the "Ratings" feature. It helps the new users.
> >> >> Mark L. Ferguson MS-MVP
> >> >> https://mvp.support.microsoft.com/profile/Mark.Ferguson
> >> >>
> >> >> "Dell Boy" <Dell (E-Mail Removed)am> wrote in message
> >> >> news:0A7D1E4C-8043-4BFA-A2AA-(E-Mail Removed)...
> >> >> > I'm an IT Technician and I support small businesses and home users.
> >> >> >
> >> >> > I've got a call from a business user regarding a PC with Win XP Pro
> >> >> > plus
> >> >> > latest updates. He has done some maintenance work on the computer
> >> >> > defragging,
> >> >> > spyware scan and removal, etc and now the PC won't start beyond the
> >> >> > user
> >> >> > style (as opposed to CTRL-ALT-DEL) logon screen.
> >> >> >
> >> >> > When the computer starts it stops at the logon screen displaying an
> >> >> > icon
> >> >> > for
> >> >> > his user account. When he clicks this icon the computer tries to get
> >> >> > to
> >> >> > the
> >> >> > desktop but comes right back to the logon screen with no error
> >> >> > message
> >> >> > displayed. He reports that the machine did not display the logon
> >> >> > screen,
> >> >> > i.e. went straight through to the desktop, until this problem
> >> >> > occurred.
> >> >> >
> >> >> > The user doesn't think the machine will boot in to safe mode but
> >> >> > he's
> >> >> > not
> >> >> > sure.
> >> >> >
> >> >> > The user will not be back in the office for 48hrs which is when I
> >> >> > have
> >> >> > an
> >> >> > appointment to examine the machine. If I can boot in to safe mode I
> >> >> > will
> >> >> > try
> >> >> > running system restore from the command prompt but wondered if
> >> >> > anyone
> >> >> > else
> >> >> > had any other ideas for resolving this?
> >> >>
>