XP logs on & logs off repeatedly - HELP !!!

[Maerko]

Hi guys I really need some help. When I boot my PC, XP logs on and logs off
repeatedly.

XP manages to get past the Welcome screen. But as soon as it is about to
paint the icons on the desktop then it logs itself off. And it keeps
logging on and then logging off.

I wonder if this is due to some sort of malware. Or maybe due to me
tweaking the registry too much today.

Can someone please tell me what to look for to track down the cause.

The rest of this posting contains:

(a) steps detailing exactly what happens
(b) the solutions I have tried.


----

EXACTLY WHAT HAPPENS

I am able to boot the same PC hardware but into another XP partition. This
second XP partition is a clone of the "rebooting" partition. Of course it
was cloned some time ago. That way I can read the files on the "rebooting"
partition.

The rebooting partition is XP Pro + SP1 and with all Microsoft patches
applied to it except SP2. It it set to automatically logs on due to an
autologon setting made by TweakUI. There are no Restore Points and the
System Volume Inforamtion folder is empty.

The following the details of what happens. I happened to have XP's "verbose
information messages" set on when the problem occurred:

(1) I boot up the PC and it goes through its hardware checks

(2) XP starts up and gets past the Welcome screen.

(3) A message says "Loading Your Personal Settings ..."

(4) The desktop wallpaper appears (a plain-colored background)

(5) There is a pause for a second or so and then my Kerio firewall splash
screen appears. Normally this screen appears after the desktop icons,
taskbar and notification area appear. But this time none of those items are
painted on to the screen.

(6) Very soon afterwards the XP logoff screen says "Playing Logoff
Sound..." and then "Saving Your Settings ..."

(7) Straight away the system loops to step (3) above where it loads my
settings and the system continues looping. Apart from the first time, there
is now no time to see and desktop wallpaper or Kerio splash screen on each
iteration.

===============

THESE ARE THE SOLUTIONS I HAVE TRIED

(1) I booted to 'Last Known good Configuration' but the result was the same
repeated rebooting.

(2) I next booted and selected "Enable Boot Logging". This went on to boot
XP. The boot process carried on repeatedly rebooting just as before.

(3) I booted to Safe Mode. I saw the Safe Mode desktop background appear.
But then XP rebooted itself repeatedly.

---

Using the other XP system, I could not find the boot log "Ntbtlog.txt". I
think this sometimes happens because I read this:

"Ntbtlog.txt File Not Written When Boot Logging Is Enabled"
http://support.microsoft.com/default.aspx?scid=kb;en-us;275735

I checked all the Startup folders to see if there were any strange programs
in there but there was nothing.

At once point during the rebooting I was hitting the keys at random to try
and interrupt the process and I got the system to stop at the Welcome screen
with user accounts. I was able to sign on as a different user (the
'original' XP administrator account which is normally hidden). I had to use
a password which TweakUi does not know. I got the same rebooting without
any further prompts to enter the password on each iteration.

I am effectively locked out the system. What can I look for to try and get
it working again?

Thanks for any info.

 

[marburg]

XP has a feature that automatically forces a reboot if there is a crash.
You may need to disable this feature (sorry but I don't remember how
exactly-but you should be able to find out by doing a google search) so you
can see the actual crash/error dialog.

Hope that helps to point you in the write direction.

Marburg

Hi guys I really need some help. When I boot my PC, XP logs on and logs off
repeatedly.

XP manages to get past the Welcome screen. But as soon as it is about to
paint the icons on the desktop then it logs itself off. And it keeps
logging on and then logging off.

I wonder if this is due to some sort of malware. Or maybe due to me
tweaking the registry too much today.

Can someone please tell me what to look for to track down the cause.

The rest of this posting contains:

(a) steps detailing exactly what happens
(b) the solutions I have tried.


----

EXACTLY WHAT HAPPENS

I am able to boot the same PC hardware but into another XP partition. This
second XP partition is a clone of the "rebooting" partition. Of course it
was cloned some time ago. That way I can read the files on the "rebooting"
partition.

The rebooting partition is XP Pro + SP1 and with all Microsoft patches
applied to it except SP2. It it set to automatically logs on due to an
autologon setting made by TweakUI. There are no Restore Points and the
System Volume Inforamtion folder is empty.

The following the details of what happens. I happened to have XP's "verbose
information messages" set on when the problem occurred:

(1) I boot up the PC and it goes through its hardware checks

(2) XP starts up and gets past the Welcome screen.

(3) A message says "Loading Your Personal Settings ..."

(4) The desktop wallpaper appears (a plain-colored background)

(5) There is a pause for a second or so and then my Kerio firewall splash
screen appears. Normally this screen appears after the desktop icons,
taskbar and notification area appear. But this time none of those items are
painted on to the screen.

(6) Very soon afterwards the XP logoff screen says "Playing Logoff
Sound..." and then "Saving Your Settings ..."

(7) Straight away the system loops to step (3) above where it loads my
settings and the system continues looping. Apart from the first time, there
is now no time to see and desktop wallpaper or Kerio splash screen on each
iteration.

===============

THESE ARE THE SOLUTIONS I HAVE TRIED

(1) I booted to 'Last Known good Configuration' but the result was the same
repeated rebooting.

(2) I next booted and selected "Enable Boot Logging". This went on to boot
XP. The boot process carried on repeatedly rebooting just as before.

(3) I booted to Safe Mode. I saw the Safe Mode desktop background appear.
But then XP rebooted itself repeatedly.

---

Using the other XP system, I could not find the boot log "Ntbtlog.txt". I
think this sometimes happens because I read this:

"Ntbtlog.txt File Not Written When Boot Logging Is Enabled"
http://support.microsoft.com/default.aspx?scid=kb;en-us;275735

I checked all the Startup folders to see if there were any strange programs
in there but there was nothing.

At once point during the rebooting I was hitting the keys at random to try
and interrupt the process and I got the system to stop at the Welcome screen
with user accounts. I was able to sign on as a different user (the
'original' XP administrator account which is normally hidden). I had to use
a password which TweakUi does not know. I got the same rebooting without
any further prompts to enter the password on each iteration.

I am effectively locked out the system. What can I look for to try and get
it working again?

Thanks for any info.

 

[Gregg Cattanach]

Hi guys I really need some help. When I boot my PC, XP logs on and
logs off repeatedly.

XP manages to get past the Welcome screen. But as soon as it is
about to paint the icons on the desktop then it logs itself off. And
it keeps logging on and then logging off.

I wonder if this is due to some sort of malware. Or maybe due to me
tweaking the registry too much today.

Can someone please tell me what to look for to track down the cause.

The rest of this posting contains:

(a) steps detailing exactly what happens
(b) the solutions I have tried.


----

EXACTLY WHAT HAPPENS

I am able to boot the same PC hardware but into another XP partition.
This second XP partition is a clone of the "rebooting" partition. Of
course it was cloned some time ago. That way I can read the files on
the "rebooting" partition.

The rebooting partition is XP Pro + SP1 and with all Microsoft patches
applied to it except SP2. It it set to automatically logs on due to
an autologon setting made by TweakUI. There are no Restore Points
and the System Volume Inforamtion folder is empty.

The following the details of what happens. I happened to have XP's
"verbose information messages" set on when the problem occurred:

(1) I boot up the PC and it goes through its hardware checks

(2) XP starts up and gets past the Welcome screen.

(3) A message says "Loading Your Personal Settings ..."

(4) The desktop wallpaper appears (a plain-colored background)

(5) There is a pause for a second or so and then my Kerio firewall
splash screen appears. Normally this screen appears after the
desktop icons, taskbar and notification area appear. But this time
none of those items are painted on to the screen.

(6) Very soon afterwards the XP logoff screen says "Playing Logoff
Sound..." and then "Saving Your Settings ..."

(7) Straight away the system loops to step (3) above where it loads
my settings and the system continues looping. Apart from the first
time, there is now no time to see and desktop wallpaper or Kerio
splash screen on each iteration.

===============

THESE ARE THE SOLUTIONS I HAVE TRIED

(1) I booted to 'Last Known good Configuration' but the result was
the same repeated rebooting.

(2) I next booted and selected "Enable Boot Logging". This went on
to boot XP. The boot process carried on repeatedly rebooting just as
before.

(3) I booted to Safe Mode. I saw the Safe Mode desktop background
appear. But then XP rebooted itself repeatedly.

---

Using the other XP system, I could not find the boot log
"Ntbtlog.txt". I think this sometimes happens because I read this:

"Ntbtlog.txt File Not Written When Boot Logging Is Enabled"
http://support.microsoft.com/default.aspx?scid=kb;en-us;275735

I checked all the Startup folders to see if there were any strange
programs in there but there was nothing.

At once point during the rebooting I was hitting the keys at random
to try and interrupt the process and I got the system to stop at the
Welcome screen with user accounts. I was able to sign on as a
different user (the 'original' XP administrator account which is
normally hidden). I had to use a password which TweakUi does not
know. I got the same rebooting without any further prompts to enter
the password on each iteration.

I am effectively locked out the system. What can I look for to try
and get it working again?

Thanks for any info.

Here's one possible solution and this fixed my machine when I had this same
problem:

You may have had some spyware "blazefind" removed by Ad-aware. Ad-aware
doesn't fix a
registry entry that points to a key file needed to boot up. Try this:

Assuming blazefind hosed your registry, the below is how I fixed it.

Blazefind changes the following registry-key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon
"Userinit" = "C:\WINNT\system32\userinit.exe,"

to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon
"Userinit" = "C:\WINNT\system32\wsaupdater.exe,"

Using Lavasoft Adaware to get rid of the pest, this removes all the
blazefind files including the file wsaupdater.exe.

The next time you tried to logon the system needs to to run
wsaupdater.exe which it can't find. Therefore: FAILED LOGON -> LOGOFF

The workaround to let you get logged on is to
copy userinit.exe to wsaupdater.exe. It's as simple as that....

If this was your problem, this will fix it. Blazefind will be gone.

Here's how to do this with a system that won't boot up.
Boot using the WindowsXP DC and go to the Recovery Console. Execute this
command:

copy C:\Windows\System32\userinit.exe C:\Windows\System32\wsaupdater.exe

(this is one line separated by a space, assuming the partition where
windows is installed is C:, and assuming blazefind caused this)

Good luck

The core of this is to get to the WinXP Recovery Console by booting with the
WindowsXP CD, then do this:
copy C:\Windows\System32\userinit.exe C:\Windows\System32\wsaupdater.exe

If that lets you log on, then you can go back and restore that registry
entry to it's original value (back to userinit.exe) , and delete the program
'wsaupdater.exe'.

HTH.

Gregg C.

 

[Maerko]

You may have had some spyware "blazefind" removed by Ad-aware.
Ad-aware doesn't fix a registry entry that points to a key
file needed to boot up.

-- snip --

The next time you tried to logon the system needs to to run
wsaupdater.exe which it can't find. Therefore: FAILED LOGON
-> LOGOFF

The workaround to let you get logged on is to copy
userinit.exe to wsaupdater.exe. It's as simple as that....

Greg, unfortunately your solution has not worked for me.

I created a dummy wasupdater.exe in C:windows\system32\ based on
userinit.exe. But it didn't help.

By the way, it was easier for me to boot to my old XP system and
then do the file copying on my old partition.

----

Very recently I used some registry cleaners and registry tweakers
(like X-Setup Pro with it's 1,700 settings! http://www.x-
setup.net/product/). Maybe one of those tools has made my registry
now look for a non-existent program on bootup.

IF this is true then it makes me ask these questions:

(1) Is there a way to get rebooting XP system to stop its boot
sequence and to put up an error message when it can't find a
particular program?

(2) Is there a registry editor which I can run on my *old* XP
partition and then edit the registry in the *other* failing
partition?

(3) Is there a tool which tells you what programs are called to run
at startup (like 'StartUpList' or 'HijackThis') but not for the same
partition that the program runs in but for *another* XP partition?


Maybe someone here can advise?

 

[Richard]

Some people said things, and then:-
Maerko added

(2) Is there a registry editor which I can run on my *old* XP
partition and then edit the registry in the *other* failing partition?

I just checked properties in my shortcut to the standard regedit and the
Start In Directory box is pointed at windows. If you pointed it at your
other drive...?

 

[Kelly]

Editing the Registry for "other" Users
http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm

 

[Murtaza]

Did you playing with "Services Console" as in Control Panel>Admin
Toos>Services????

 

[Maerko]

Murtaza, yes I have been making some changes there. I have made
(and un-made) so many that I can't tell you which ones I might
have changed very recently.

Do you have any suspected services?

(I know that I must not turn off RPC.)

Maerko

 

[George Valkov]

Cool!

Editing the Registry for "other" Users
http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm

 

[Maerko]

Editing the Registry for "other" Users
http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm

[original detailed posting follws at end of this posting]




Kelly, I have a few questions for you or one of your knowledgeable
colleagues.

(1) Is the log which the Event Viewer normally displays available to me if
I am booted in to another XP partition?

Do you know where the files are stored which I would need to go and look at?

(2) The link you gave me steered me to this Microsoft article called
"Dumpel.exe: Dump Event Log".

http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/dumpel-
o.asp

However the article assumed I am able to get on to my system and can instal
"Dumpel.exe" there by running its normal installation routine. I can't do
that. But if I knew what to do I could move various files into the right
places. Do you have any info?

(3) Is there a little routine or program I can insert somewhere (again from
putside the failing XP partition) which will stop the boot process and give
me a command line window or even the explorer desktop?

This would permit me to have a look around and maybe set up programs like
Dumpel.exe mentioned above.



------------ ORIGINAL POSTING ----------

 

[Murtaza]

I was also doing the same thing ...setting some services to Automatic or
Maunaul or even Disabled. But when i restarted my system caught into this
Log-In-Log-Off Loop?

But thanks to System Restore it saved me. I just boot my system in Safe Mode
& Restore it to earlier point. But as you do not have any Restore point, so
its difficult for you.

I can only give you suggestions about whats went wrong but not now coz i am
not at home right now. If you can provide me your email address?

Regards,
Murtaza

 

[George Valkov]

(1) Is the log which the Event Viewer normally displays available to me if
I am booted in to another XP partition?

Yes, it is available to You. In even viewer select
Open Log File...
Browse to
?:\WINDOWS\system32\config
You should see this files:
[Event log]
AppEvent.Evt
SecEvent.Evt
SysEvent.Evt
[Registry hive - DON"T modify those with CAPITAL letters!]
default
SAM
SECURITY
software
system
userdiff

Do you know where the files are stored which I would need to go and look

at?

I already answered that. Just remember to choose the correct "Log Type:".

(2) The link you gave me steered me to this Microsoft article called
"Dumpel.exe: Dump Event Log".

http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/dumpel-
o.asp

However the article assumed I am able to get on to my system and can instal
"Dumpel.exe" there by running its normal installation routine. I can't do
that. But if I knew what to do I could move various files into the right
places. Do you have any info?

(3) Is there a little routine or program I can insert somewhere (again from
putside the failing XP partition) which will stop the boot process and give
me a command line window or even the explorer desktop?

This would permit me to have a look around and maybe set up programs like
Dumpel.exe mentioned above.

You can insert whatever You like in the "Run" folder; "RunOnce" and
"RunOnceEx" folders.
1. Load the "software" hive - in my case as:
HKEY_LOCAL_MACHINE\XP_SOFTWARE
2. Take a look at here
[HKEY_LOCAL_MACHINE\XP_SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
3. You may want to remove unwanted programs.
4. New --> String Value. The data is full or short path that the system will
search for the program to run.

You may want to install a service manually? Create:
[HKEY_LOCAL_MACHINE\XP_SYSTEM\ControlSet001\Services\MyService]
Note: There may be smore than one folders with name like
ControlSet001
ControlSet002
...
You may need the make changes to all of them. Unless You know which exactly
will be mounted as
CurrentControlSet

You need:
String Value - "DisplayName"
DWORD Value - "ErrorControl"
String Value - "ImagePath"
DWORD Value - "Start"
DWORD Value - "Type"



George Valkov
---------------------------------------------------------

 

[Maerko]

Yes, it is available to You. In even viewer select
Open Log File...
Browse to
?:\WINDOWS\system32\config

George, thanks for a useful reply. I launched the Event Viewer > Action >
Open Log File. I navigated to the bad "rebooting" partition and found those
event files you listed.

Making sure I used the right "LOg Type", the messages I got was that "The
Event Log File Is Corrupted".

Seems odd that they are all corrupted. If I use Win Expl to broswe to the
?:\WINDOWS\system32\config folder then I can see these files have no backup
(no AppEvent.bak, no SecEvent.bak, no SysEvent.bak).

You should see this files:
[Event log]
AppEvent.Evt
SecEvent.Evt
SysEvent.Evt
[Registry hive - DON"T modify those with CAPITAL letters!]
default
SAM
SECURITY
software
system
userdiff

Do you know where the files are stored which I would need to
go and look at?

I already answered that. Just remember to choose the correct
"Log Type:".

(2) The link you gave me steered me to this Microsoft article
called "Dumpel.exe: Dump Event Log".


http://www.microsoft.com/windows2000/techinfo/reskit/tools/exist
ing/dumpel-o.asp

However the article assumed I am able to get on to my system
and can instal "Dumpel.exe" there by running its normal
installation routine. I can't do that. But if I knew what to
do I could move various files into the right places. Do you
have any info?

(3) Is there a little routine or program I can insert
somewhere (again from putside the failing XP partition) which
will stop the boot process and give me a command line window
or even the explorer desktop?

This would permit me to have a look around and maybe set up
programs like Dumpel.exe mentioned above.

George this next step you suggest seems a bit tricky for a novice like me.

I would have to use the link Kelly gave to Doug's site
http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm
and I get the bad feeling from the NOTE on the web page that unless I know
what I am doing I might mess up the registry of by second XP partition which
I am having to use at the moment.

So I would ask you if there is there a program or DLL which pauses the
system and displays something like a userconsole or input screen.

Then I guess I could can replace one of the boot-time files (probably in the
system32 folder) which XP normally executes when XP boots. So when XP does
execute it then the boot sequence will pause at that point. And depending
where I am maybe I can try and fix things.

REMEMBER that during the automatic rebooting I get past the logon screen and
my desktop wallpaper gets painted (nut not the icons) and my firewall
launched its splash screen. So I figure the boot sequence gets quite
advanced. If only I can get to the desktop then I could launch TaskManager
to run Explorer.

The trouble is that I don't know of any such prgram/DLL and and I don't know
what normal program/DLL to replace with it in the system32 folder.

You can insert whatever You like in the "Run" folder; "RunOnce"
and "RunOnceEx" folders.

1. Load the "software" hive - in my case as:
HKEY_LOCAL_MACHINE\XP_SOFTWARE

2. Take a look at here
[HKEY_LOCAL_MACHINE\XP_SOFTWARE\Microsoft\Windows\CurrentVersion
\Run]

3. You may want to remove unwanted programs.

4. New --> String Value. The data is full or short path that
the system will search for the program to run.

You may want to install a service manually? Create:
[HKEY_LOCAL_MACHINE\XP_SYSTEM\ControlSet001\Services\MyService]
Note: There may be smore than one folders with name like
ControlSet001
ControlSet002
...
You may need the make changes to all of them. Unless You know
which exactly will be mounted as
CurrentControlSet

You need:
String Value - "DisplayName"
DWORD Value - "ErrorControl"
String Value - "ImagePath"
DWORD Value - "Start"
DWORD Value - "Type"



George Valkov

------------ ORIGINAL POSTING ----------

 

[Maerko]

I was also doing the same thing ...setting some services to
Automatic or Maunaul or even Disabled. But when i restarted my
system caught into this Log-In-Log-Off Loop?

But thanks to System Restore it saved me. I just boot my system
in Safe Mode & Restore it to earlier point. But as you do not
have any Restore point, so its difficult for you.

I can only give you suggestions about whats went wrong but not
now coz i am not at home right now. If you can provide me your
email address?

Remeber that I can not boot to Safe Mode without the system rebooting.
Seems as if my problem lies elsewhere than yours did.

Can you post your thoughts on this to this newsgroup?



(I hate giving spammers even half a chance of getting my email address!)

 

[George Valkov]

George, thanks for a useful reply. I launched the Event Viewer > Action >
Open Log File. I navigated to the bad "rebooting" partition and found those
event files you listed.

Making sure I used the right "LOg Type", the messages I got was that "The
Event Log File Is Corrupted".

Try this:
Plan A
Delete the broken event log files and try to start the dead system. May be
it will create nwe files for You.
Plan B
On Your working system clear all event logs. Now save the empty files
overwriting those from the dead system and try to start it. May be it will
then log some events in it and You can analyze it.

Seems odd that they are all corrupted. If I use Win Expl to broswe to the
?:\WINDOWS\system32\config folder then I can see these files have no backup
(no AppEvent.bak, no SecEvent.bak, no SysEvent.bak).

No, they don't have a backup. At least not in this folder.

George this next step you suggest seems a bit tricky for a novice like me.

I would have to use the link Kelly gave to Doug's site
http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm
and I get the bad feeling from the NOTE on the web page that unless I know
what I am doing I might mess up the registry of by second XP partition which
I am having to use at the moment.

Are You afraid from this?
You are not making any changes to the working system.
You are editing the registry of the dead system.
In fact this is nothing but a file. Simply make a backup of the file.

So I would ask you if there is there a program or DLL which pauses the
system and displays something like a userconsole or input screen.

I am not sure if You can bring up an interactive application - that means
something that has a window and can be controlled by the user. I haven't
ever done this by my self - not before the user logon.

I can modify the registry to run application of my choice as a
non-interactive process - it will be executed before the logon and can log
data or perform other tasks.

I created MyService.reg and emergency.bat files - attached to this letter.
Copy the emergency.bat file is the Windows directory of the dead system.
Load the system hive as HKEY_LOCAL_MACHINE\XP_SYSTEM
and import the MyService.reg file.

The service will attemp to execute emergency.bat as interactive process, but
the window will not be visible until the logon process.
emergency.bat will attempt to execute:
Task Manager - Explorer Window - Command Prompt
and start logging the running processe to
%SystemDrive%\emergency.log
You can edit it to execute other applications.

Then I guess I could can replace one of the boot-time files (probably in the
system32 folder) which XP normally executes when XP boots.

Try to replace explorer.exe and Winlogon.exe from the working system.

So when XP does
execute it then the boot sequence will pause at that point. And depending
where I am maybe I can try and fix things.

I'm not quite sure If You can pause the boot process, but You can run some
application during it - I described it before - MyService.reg

REMEMBER that during the automatic rebooting I get past the logon screen and
my desktop wallpaper gets painted (nut not the icons) and my firewall
launched its splash screen. So I figure the boot sequence gets quite
advanced. If only I can get to the desktop then I could launch TaskManager
to run Explorer.

Try this:
SHIFT key - if You hold it while the system is logging on, Windows will
bypass executing all applications from the Run group.
You can also use it to bypass the automatic logon.
Hit Ctrl+Alt+Del twice to bring the Logon dialog and logon as Administrator.

The trouble is that I don't know of any such prgram/DLL and and I don't know
what normal program/DLL to replace with it in the system32 folder.

Try improvising with running custom command lines as a service from the
emergency.bat file.

Good Luck!