-
October 19th, 2009, 11:06 PM
#1
XP - User Can't Logon
I've got a rather odd problem going on with my home desktop (XP Home).
Desktop only has two accounts, both set to administrator. My account that I always logon with works great, no problems whatsoever. However, anytime I try to logon to the other account from the Welcome screen, it shows the usual text of logging on, flashes the desktop, then immediately logs off, returning to the Welcome screen.
So I checked a few things while googling about:
(1) To my knowledge I haven't been infected with Blazefind. I have no unusual search bars, and my BitDefender + Adaware + Spybot setup has shown things as pretty clean for a while now.
(2) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT
\CurrentVersion\Winlogon is properly set to userinit.exe (as opposed to wpaupdater.exe -- evidently another common cause of the problem).
(3) I deleted the account entirely, then recreated it. Problem continues.
(4) These Events appear every time the problem occurs:
SideBySide, Event 59:
"Resolve Partial Assembly failed for Microsoft.Windows.GdiPlus. Reference error message: Access is denied."
SideBySide, Event 59:
"Generate Activation Context failed for System Default Context. Reference error message: The operation completed successfully."
Again, the main logon I usually use continues to work fine -- It just appears any secondary account I try to create fails to logon now.
Any thoughts? I'm about to run a chkdsk /r next to see if it has any effect.
/edit -- Ok, got some updated details.
Ran chkdsk /r, and sure enough, after that I was able to logon onto the newly created second account. Once. Logged off, then logged back into my main account, then logged out, and tried to log back into the second account a second time. The problem returned.
Weird eh?
Last edited by AngelicKnight; October 20th, 2009 at 12:41 AM.
-
October 21st, 2009, 04:28 AM
#2
I have seen this issue in the past, and it is entirely windows orientated (no virus/malware).
Do you have fast user switching enabled? I will do some research soon but if I remeber rightly it was a permission issue with the account profile and/or windows system folders.
Try renaming the profile using the account that works, then log in with the broken account recreating the profile.
I will get back to you on this one, stay tuned.
"Any intelligent fool can make things bigger and more complex... It takes a touch of genius --- and a lot of courage to move in the opposite direction."
- Albert Einstein
-
October 21st, 2009, 04:38 AM
#3
If it is malware; I found this:
The most common cause of this right now, is running a malware detection progam that deletes a file, but the registry still points at it. This, wsaupdater.exe, seems to be the most widely seen culprit, but it could potentially be other things, too.
Let's test it out.
Boot using your winxp cd.
Enter recovery console.
at the command prompt go to
C:/windows/system32
next type:
Dir *.exe
If you find, it, type
copy userinit.exe wsaupdater.exe
Exit and reboot normally. You should now be able to logon.
Run regedit
Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
In the right pane, you should see
C:\WINDOWS\System32\wsaupdater.exe,
Change it so that it reads:
C:\WINDOWS\System32\userinit.exe
That should solve the problem, if the malware was the one that caused the issue.
The scary thing is since more malware programs are inserting themselves into the winlogon key, this is going to be a moving target.
Source: Here
CTO
"Any intelligent fool can make things bigger and more complex... It takes a touch of genius --- and a lot of courage to move in the opposite direction."
- Albert Einstein
-
October 24th, 2009, 12:23 AM
#4
About that faster user switching -- I've been suspect of it. I disabled all services associated with a while back, since I was only using one account. Since creating a second account, I've tried re-enabling the services. It's entirely possible I missed a service; I'm not 100% what all services must be started to have it fully enabled.
I'll try your suggestion and let you know what I find. Thanks!
-
October 25th, 2009, 05:59 AM
#5
Desktop only has two accounts, both set to administrator.
Hopefully Vista and Windows7 will fix people like you. Shesh...
Captian Obvious to the rescue!!!!!!!!!1!!!!one!!!!
Just revert back to an old restore point.
-
October 25th, 2009, 06:06 AM
#6
Hopefully Vista and Windows7 will fix people like you.
Spec, all these years and you haven't changed one bit my boy. They're both set to admin for troubleshooting purposes. I can tweak permissions later after I've got it fixed.
And don't count on Windows 7 fixing that issue anyway.
Last edited by AngelicKnight; October 25th, 2009 at 06:09 AM.
Similar Threads
-
By cheyenne1212 in forum Miscellaneous Security Discussions
Replies: 7
Last Post: February 1st, 2012, 02:51 PM
-
By ThePreacher in forum Miscellaneous Security Discussions
Replies: 17
Last Post: December 14th, 2006, 09:37 PM
-
By MicroBurn in forum Other Tutorials Forum
Replies: 1
Last Post: March 2nd, 2005, 04:31 PM
-
By Tiger Shark in forum Microsoft Security Discussions
Replies: 5
Last Post: January 14th, 2005, 08:47 PM
-
By -DaRK-RaiDeR- in forum Newbie Security Questions
Replies: 9
Last Post: December 14th, 2002, 08:38 PM
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|