Computer Won't Start, Returns To Logon Screen

[Dell Boy]

I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro plus
latest updates. He has done some maintenance work on the computer defragging,
spyware scan and removal, etc and now the PC won't start beyond the user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an icon for
his user account. When he clicks this icon the computer tries to get to the
desktop but comes right back to the logon screen with no error message
displayed. He reports that the machine did not display the logon screen,
i.e. went straight through to the desktop, until this problem occurred.

The user doesn't think the machine will boot in to safe mode but he's not
sure.

The user will not be back in the office for 48hrs which is when I have an
appointment to examine the machine. If I can boot in to safe mode I will try
running system restore from the command prompt but wondered if anyone else
had any other ideas for resolving this?

 

[Mark L. Ferguson]

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales/help/help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

 

[Dell Boy]

Thanks Mark I'll give this a go and post back.

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales/help/help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

 

[Dell Boy]

Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery Console to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get past
the logon screen.

I think that the problem is probably that described in KB892893 as the user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when he
became infected and the last time he scanned the computer was around March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

 

[Mark L. Ferguson]

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
..
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales/help/help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

 

[Dell Boy]

Thanks for this Mark.

I'm having problems with replacing winlogon.exe. I've booted in to Recovery
Console from a Win XP CD, when prompted for a windows installation to log in
to I've chosen C:\Windows, entered the Admin password and I'm in Recovery
Console. When I enter the command syntax you've given below I get "The
command is not recognised..."

Am I doing something wrong?

 

[Dell Boy]

Is it possible/advisable to copy winlogon.ex_ directly from the i386 folder
of the CD to C:/Windows/system32?

 

[Dell Boy]

winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to explain
why the user can't logon?

 

[Mark L. Ferguson]

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default.aspx?scid=kb;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales/help/help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

 

[Dell Boy]

Thanks again.

Is there any info on how I can create a new user (presumably from the
command line) from Recovery Console after LOGON?

 

[Dell Boy]

Mark,

The problem was that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon had no data value.

I edited the registry offline as per your link:

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm

and that resolved the problem.

Many thanks, couldn't have done it without your help.