Results 1 to 6 of 6

Thread: XP - User Can't Logon

  1. #1

    XP - User Can't Logon

    I've got a rather odd problem going on with my home desktop (XP Home).

    Desktop only has two accounts, both set to administrator. My account that I always logon with works great, no problems whatsoever. However, anytime I try to logon to the other account from the Welcome screen, it shows the usual text of logging on, flashes the desktop, then immediately logs off, returning to the Welcome screen.

    So I checked a few things while googling about:

    (1) To my knowledge I haven't been infected with Blazefind. I have no unusual search bars, and my BitDefender + Adaware + Spybot setup has shown things as pretty clean for a while now.

    (2) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT
    \CurrentVersion\Winlogon is properly set to userinit.exe (as opposed to wpaupdater.exe -- evidently another common cause of the problem).

    (3) I deleted the account entirely, then recreated it. Problem continues.

    (4) These Events appear every time the problem occurs:

    SideBySide, Event 59:

    "Resolve Partial Assembly failed for Microsoft.Windows.GdiPlus. Reference error message: Access is denied."

    SideBySide, Event 59:

    "Generate Activation Context failed for System Default Context. Reference error message: The operation completed successfully."

    Again, the main logon I usually use continues to work fine -- It just appears any secondary account I try to create fails to logon now.

    Any thoughts? I'm about to run a chkdsk /r next to see if it has any effect.


    /edit -- Ok, got some updated details.

    Ran chkdsk /r, and sure enough, after that I was able to logon onto the newly created second account. Once. Logged off, then logged back into my main account, then logged out, and tried to log back into the second account a second time. The problem returned.

    Weird eh?
    Last edited by AngelicKnight; October 20th, 2009 at 12:41 AM.

  2. #2
    Keeping The Balance CybertecOne's Avatar
    Join Date
    Aug 2004
    Location
    Australia
    Posts
    660
    I have seen this issue in the past, and it is entirely windows orientated (no virus/malware).

    Do you have fast user switching enabled? I will do some research soon but if I remeber rightly it was a permission issue with the account profile and/or windows system folders.

    Try renaming the profile using the account that works, then log in with the broken account recreating the profile.

    I will get back to you on this one, stay tuned.
    "Any intelligent fool can make things bigger and more complex... It takes a touch of genius --- and a lot of courage to move in the opposite direction."
    - Albert Einstein

  3. #3
    Keeping The Balance CybertecOne's Avatar
    Join Date
    Aug 2004
    Location
    Australia
    Posts
    660
    If it is malware; I found this:

    The most common cause of this right now, is running a malware detection progam that deletes a file, but the registry still points at it. This, wsaupdater.exe, seems to be the most widely seen culprit, but it could potentially be other things, too.

    Let's test it out.

    Boot using your winxp cd.
    Enter recovery console.
    at the command prompt go to

    C:/windows/system32

    next type:
    Dir *.exe

    If you find, it, type

    copy userinit.exe wsaupdater.exe

    Exit and reboot normally. You should now be able to logon.

    Run regedit

    Navigate to
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

    In the right pane, you should see

    C:\WINDOWS\System32\wsaupdater.exe,

    Change it so that it reads:

    C:\WINDOWS\System32\userinit.exe

    That should solve the problem, if the malware was the one that caused the issue.

    The scary thing is since more malware programs are inserting themselves into the winlogon key, this is going to be a moving target.

    Source: Here


    CTO
    "Any intelligent fool can make things bigger and more complex... It takes a touch of genius --- and a lot of courage to move in the opposite direction."
    - Albert Einstein

  4. #4
    About that faster user switching -- I've been suspect of it. I disabled all services associated with a while back, since I was only using one account. Since creating a second account, I've tried re-enabling the services. It's entirely possible I missed a service; I'm not 100% what all services must be started to have it fully enabled.

    I'll try your suggestion and let you know what I find. Thanks!

  5. #5
    Banned
    Join Date
    Jan 2008
    Posts
    605
    Desktop only has two accounts, both set to administrator.
    Hopefully Vista and Windows7 will fix people like you. Shesh...

    Captian Obvious to the rescue!!!!!!!!!1!!!!one!!!!

    Just revert back to an old restore point.

  6. #6
    Hopefully Vista and Windows7 will fix people like you.
    Spec, all these years and you haven't changed one bit my boy. They're both set to admin for troubleshooting purposes. I can tweak permissions later after I've got it fixed.

    And don't count on Windows 7 fixing that issue anyway.
    Last edited by AngelicKnight; October 25th, 2009 at 06:09 AM.

Similar Threads

  1. Windows Error Messages
    By cheyenne1212 in forum Miscellaneous Security Discussions
    Replies: 7
    Last Post: February 1st, 2012, 02:51 PM
  2. Port List
    By ThePreacher in forum Miscellaneous Security Discussions
    Replies: 17
    Last Post: December 14th, 2006, 09:37 PM
  3. Basic IRC use and administration
    By MicroBurn in forum Other Tutorials Forum
    Replies: 1
    Last Post: March 2nd, 2005, 04:31 PM
  4. Network Security made easy?
    By Tiger Shark in forum Microsoft Security Discussions
    Replies: 5
    Last Post: January 14th, 2005, 08:47 PM
  5. Newbies, list of many words definitions.
    By -DaRK-RaiDeR- in forum Newbie Security Questions
    Replies: 9
    Last Post: December 14th, 2002, 08:38 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •