XP - User Can't Logon

I've got a rather odd problem going on with my home desktop (XP Home).

Desktop only has two accounts, both set to administrator. My account that I always logon with works great, no problems whatsoever. However, anytime I try to logon to the other account from the Welcome screen, it shows the usual text of logging on, flashes the desktop, then immediately logs off, returning to the Welcome screen.

So I checked a few things while googling about:

(1) To my knowledge I haven't been infected with Blazefind. I have no unusual search bars, and my BitDefender + Adaware + Spybot setup has shown things as pretty clean for a while now.

(2) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT
\CurrentVersion\Winlogon is properly set to userinit.exe (as opposed to wpaupdater.exe -- evidently another common cause of the problem).

(3) I deleted the account entirely, then recreated it. Problem continues.

(4) These Events appear every time the problem occurs:

SideBySide, Event 59:

"Resolve Partial Assembly failed for Microsoft.Windows.GdiPlus. Reference error message: Access is denied."

SideBySide, Event 59:

"Generate Activation Context failed for System Default Context. Reference error message: The operation completed successfully."

Again, the main logon I usually use continues to work fine -- It just appears any secondary account I try to create fails to logon now.

Any thoughts? I'm about to run a chkdsk /r next to see if it has any effect.


/edit -- Ok, got some updated details.

Ran chkdsk /r, and sure enough, after that I was able to logon onto the newly created second account. Once. Logged off, then logged back into my main account, then logged out, and tried to log back into the second account a second time. The problem returned.

Weird eh?

I have seen this issue in the past, and it is entirely windows orientated (no virus/malware).

Do you have fast user switching enabled? I will do some research soon but if I remeber rightly it was a permission issue with the account profile and/or windows system folders.

Try renaming the profile using the account that works, then log in with the broken account recreating the profile.

I will get back to you on this one, stay tuned.

If it is malware; I found this:

The most common cause of this right now, is running a malware detection progam that deletes a file, but the registry still points at it. This, wsaupdater.exe, seems to be the most widely seen culprit, but it could potentially be other things, too.

Let's test it out.

Boot using your winxp cd.
Enter recovery console.
at the command prompt go to

C:/windows/system32

next type:
Dir *.exe

If you find, it, type

copy userinit.exe wsaupdater.exe

Exit and reboot normally. You should now be able to logon.

Run regedit

Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

In the right pane, you should see

C:\WINDOWS\System32\wsaupdater.exe,

Change it so that it reads:

C:\WINDOWS\System32\userinit.exe

That should solve the problem, if the malware was the one that caused the issue.

The scary thing is since more malware programs are inserting themselves into the winlogon key, this is going to be a moving target.

Source: Here


CTO

About that faster user switching -- I've been suspect of it. I disabled all services associated with a while back, since I was only using one account. Since creating a second account, I've tried re-enabling the services. It's entirely possible I missed a service; I'm not 100% what all services must be started to have it fully enabled.

I'll try your suggestion and let you know what I find. Thanks!

Quote:

---

Desktop only has two accounts, both set to administrator.

---

Hopefully Vista and Windows7 will fix people like you. Shesh...

Captian Obvious to the rescue!!!!!!!!!1!!!!one!!!!

Just revert back to an old restore point.

Quote:

---

Hopefully Vista and Windows7 will fix people like you.

---

Spec, all these years and you haven't changed one bit my boy. They're both set to admin for troubleshooting purposes. I can tweak permissions later after I've got it fixed.

And don't count on Windows 7 fixing that issue anyway.