Computer Won't Start, Returns To Logon Screen

Thanks again.

Is there any info on how I can create a new user (presumably from the
command line) from Recovery Console after LOGON?


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?

Thanks again.

Is there any info on how I can create a new user (presumably from the
command line) from Recovery Console after LOGON?


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?

Thanks again.

Is there any info on how I can create a new user (presumably from the
command line) from Recovery Console after LOGON?


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?

Mark,

The problem was that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon had no data value.

I edited the registry offline as per your link:

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm

and that resolved the problem.

Many thanks, couldn't have done it without your help.


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?

Mark,

The problem was that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon had no data value.

I edited the registry offline as per your link:

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm

and that resolved the problem.

Many thanks, couldn't have done it without your help.


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?

Mark,

The problem was that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon had no data value.

I edited the registry offline as per your link:

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm

and that resolved the problem.

Many thanks, couldn't have done it without your help.


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?

Mark,

The problem was that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon had no data value.

I edited the registry offline as per your link:

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm

and that resolved the problem.

Many thanks, couldn't have done it without your help.


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?

Mark,

The problem was that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon had no data value.

I edited the registry offline as per your link:

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm

and that resolved the problem.

Many thanks, couldn't have done it without your help.


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?

Mark,

The problem was that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon had no data value.

I edited the registry offline as per your link:

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm

and that resolved the problem.

Many thanks, couldn't have done it without your help.


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?

Mark,

The problem was that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon had no data value.

I edited the registry offline as per your link:

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm

and that resolved the problem.

Many thanks, couldn't have done it without your help.


"Mark L. Ferguson" wrote:

If this also fails, you are probably going to have to logon as default
"Administrator" to see if a new user can be created.

From the recovery console, type:
LOGON

811151 - How to Copy User Data to a New User Profile:
http://support.microsoft.com/default...b;en-us;811151

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
winlogon.exe and wsaupdater.exe are both present in C:/Windows/System32.

I'm going to try editing the registry key but this doesn't appear to
explain
why the user can't logon?

"Mark L. Ferguson" wrote:

Another file in the process that can be replaced in winlogon.exe

run from a boot to CD and Recovery Console (press 'r' for Repair), the
command:

(cd drive letter here):/i386/expand.exe (cd drive letter
here):/i386/winlogon.ex_ %windir%/system32/winlogon.exe

The registry entry for wsaupdater should be:
expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
.
3. In the right pane, right-click userinit, and then click Modify.
4. Replace wsaupdater.exe (or perhaps something else) with userinit.exe

The way to access the registry from recovery console is a bit different
from
the normal windows interface, using REG.EXE

How to edit the registry offline using BartPE boot CD:
http://windowsxp.mvps.org/peboot.htm
--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
Mark,

Thanks for your reply.

I successfully carried out step 1 in KB892893, i.e. Use Recovery
Console
to
copy Userinit.exe to Wsaupdater.exe, but the machine still cannot get
past
the logon screen.

I think that the problem is probably that described in KB892893 as the
user
ran Ad-Aware immediately prior to the problem occurring.

I guess System Restore might be an option but the user isn't sure when
he
became infected and the last time he scanned the computer was around
March
this year.

Any advice you can give would be greatly appreciated,
Malcolm

"Mark L. Ferguson" wrote:

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

--
Please use the Communities guidelines when posting.
http://www.microsoft.com/wn3/locales...help_en-us.htm
Use the "Ratings" feature. It helps the new users.
Mark L. Ferguson MS-MVP
https://mvp.support.microsoft.com/profile/Mark.Ferguson

"Dell Boy" Dell am wrote in message
...
I'm an IT Technician and I support small businesses and home users.

I've got a call from a business user regarding a PC with Win XP Pro
plus
latest updates. He has done some maintenance work on the computer
defragging,
spyware scan and removal, etc and now the PC won't start beyond the
user
style (as opposed to CTRL-ALT-DEL) logon screen.

When the computer starts it stops at the logon screen displaying an
icon
for
his user account. When he clicks this icon the computer tries to get
to
the
desktop but comes right back to the logon screen with no error
message
displayed. He reports that the machine did not display the logon
screen,
i.e. went straight through to the desktop, until this problem
occurred.

The user doesn't think the machine will boot in to safe mode but
he's
not
sure.

The user will not be back in the office for 48hrs which is when I
have
an
appointment to examine the machine. If I can boot in to safe mode I
will
try
running system restore from the command prompt but wondered if
anyone
else
had any other ideas for resolving this?