Serious Logon problem

[Jason]

Hello everyone,

I am having a similar issue to one that is being discussed
in a recent thread.

When I start my machine with Windows XP Home, I get to the
profile screen that asks which profile I want to log onto.
I choose any of the four that I have and attempt to logon.
XP tells me it is loading personal settings. It then
flashes the wallpaper of the profile, and immediately goes
to the log off, closing connection screen. At which point
you are back where you atarted. Total time elapsed is no
more than 10 - 15 seconds.

Any ideas how I can get past this? Safe Mode start-up (f8)
does not seem to be working, unless I am doing something
incorrectly (pressing f8 all the way through the startup
and then again after logging into a profile).

Any ideas as to what could cause this? Windows itself?
Possibly a worm type virus?

Any information would help.

Thanks.

Jason

 

[Carey Frisch [MVP]]

How to Perform a Windows XP Repair Install
http://www.michaelstevenstech.com/XPrepairinstall.htm

[Courtesy of MS-MVP Michael Stevens]

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

----------------------------------------------------------------------

:

| Hello everyone,
|
| I am having a similar issue to one that is being discussed
| in a recent thread.
|
| When I start my machine with Windows XP Home, I get to the
| profile screen that asks which profile I want to log onto.
| I choose any of the four that I have and attempt to logon.
| XP tells me it is loading personal settings. It then
| flashes the wallpaper of the profile, and immediately goes
| to the log off, closing connection screen. At which point
| you are back where you atarted. Total time elapsed is no
| more than 10 - 15 seconds.
|
| Any ideas how I can get past this? Safe Mode start-up (f8)
| does not seem to be working, unless I am doing something
| incorrectly (pressing f8 all the way through the startup
| and then again after logging into a profile).
|
| Any ideas as to what could cause this? Windows itself?
| Possibly a worm type virus?
|
| Any information would help.
|
| Thanks.
|
| Jason

 

[Clayton]

Jason
I might have been the person who posted the same type of
thread.
As Carey has posted the info for the Repair Install, I
will say that this does work...
However I had to go that one step further and follow the
instructions for the Crashed XP...
http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot
_toot.htm
One thing I did in advance was to backup the Restore
Points folder contents to an alternative location before
starting.
After which when it was all done and said I did reproduce
an active OS however I had some problems running the new
V5 Windows Update site and even hit the TechNet chat line
to see if they could help resolve this.
The problem was that once my system was restored to a
point that was acceptable, once trying to hit the update
site, it would not load the update exe for the V5 website.
I ended up having to (after several hours of
troubleshooting) restoring it via Ghost, which way back
when I loaded this syetm I had also Ghosted it. Once I re-
Ghosted the OS everything ran fine as per the Win Update
site, I dared not try to push the restore point after the
fact....

 

[Larry Samuels]

Hi Jason,

Sounds like you recently removed BlazeFind.
Thanks go to Rick Rogers, MVP for the following instructions:

Did you run a spyware removal program lately? The userinit value may have
been corrupted by the removal of blazefind. It adds wsaupdater.exe to the
logon value in the system registry, sometimes appending it, sometimes
replacing it. Running Adaware or other cleaners detects and removes
wsaupdater.exe, but doesn't correct the registry damage. If this is the
case, then you may need to load the registry hive from another installation
and change it. This is the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Userinit string value should be:

C:\WINDOWS\system32\userinit.exe,

On the damaged installations it's one of these:

C:\WINDOWS\system32\wsaupdater.exe,
C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wsaupdater.exe,

Another "quickie" method of resolution is to load the Recovery Console (see
below), copy userinit.exe as wsaupdater.exe from the command prompt, then
restart normally. Once in, go and change the registry value back to what
it's supposed to be and delete the copied file.

HOW TO: Install and Use the Recovery Console in Windows XP [Q307654]
http://support.microsoft.com/?kbid=307654

This can also be done by using the 6 disk boot floppy set mentioned in the
above article, as it loads enough of the Recovery Console so that you can
copy the file. This is particularly useful if you have an OEM installation
that includes only a Restore CD, or no disk at all.



--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Expert Zone -
Unofficial FAQ for Windows Server 2003 at
http://pelos.us/SERVER.htm

 

[Dr_Sam]

I am having the same problem. If you get a solution,
please let me know what it is!
Thanks,
Sam

 

[Larry Samuels]

Thanks go to Rick Rogers, MVP for the following instructions:

Did you run a spyware removal program lately? The userinit value may have
been corrupted by the removal of blazefind. It adds wsaupdater.exe to the
logon value in the system registry, sometimes appending it, sometimes
replacing it. Running Adaware or other cleaners detects and removes
wsaupdater.exe, but doesn't correct the registry damage. If this is the
case, then you may need to load the registry hive from another installation
and change it. This is the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Userinit string value should be:

C:\WINDOWS\system32\userinit.exe,

On the damaged installations it's one of these:

C:\WINDOWS\system32\wsaupdater.exe,
C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wsaupdater.exe,

Another "quickie" method of resolution is to load the Recovery Console (see
below), copy userinit.exe as wsaupdater.exe from the command prompt, then
restart normally. Once in, go and change the registry value back to what
it's supposed to be and delete the copied file.

HOW TO: Install and Use the Recovery Console in Windows XP [Q307654]
http://support.microsoft.com/?kbid=307654

This can also be done by using the 6 disk boot floppy set mentioned in the
above article, as it loads enough of the Recovery Console so that you can
copy the file. This is particularly useful if you have an OEM installation
that includes only a Restore CD, or no disk at all.



--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Expert Zone -
Unofficial FAQ for Windows Server 2003 at
http://pelos.us/SERVER.htm