help with XP Recovery Console

[STang57]

how do i copy userinit.exe from the XP cd to replace the file on the hard drive? i searched online a little bit and tried "e:\i386\userinit.ex_ userinit.exe" but it says access is denied. i believe i need this file to gain access to my computer again. when i type the password to login it instantly logs me back off! im trying everything i can before i result to reformat. i cant imagine losing my whole 130gb or files. thanks

 

[lansalot]

You don't need to lose your files if you reinstall, just don't format during it.

Got another PC? That would be the easiest way to expand the file.

The recovery console should allow you to expand the file off the CD - that would work.

Also, check some joker hasn't managed to put a call to logoff.exe in your startup folder or something.

 

[Slikkster]

You don't quite have the process down correctly to get this fixed. Read the following webpage in the logon/off loop section:

http://www.winxptutor.com/wsaremove.htm

 

[Smilin]

Originally posted by: STang57
how do i copy userinit.exe from the XP cd to replace the file on the hard drive? i searched online a little bit and tried "e:\i386\userinit.ex_ userinit.exe" but it says access is denied. i believe i need this file to gain access to my computer again. when i type the password to login it instantly logs me back off! im trying everything i can before i result to reformat. i cant imagine losing my whole 130gb or files. thanks

Do NOT reformat. Even if you completely need to reload windows (which you don't!!!!) just use a parallel install or inplace upgrade and preserve all your data.

Also
Ok, with that said...

When you get that logon loop it's usually because Winlogon (the process that launches userinit.exe) can't find it. It's not because it's not there in most cases, rather you've had a drive letter shift by adding or removing a drive or several other scenarios. The net result is the userinit registry key is pointing to the wrong location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

The default is: "C:\Windows\system32\userinit.exe,"

You can confirm if this is the problem simply by looking for userinit in your system32 folder while you're in recovery console. If it exists, this is your problem.

The simplest solution to this problem is when your computer is networked. You simply fire up regedit on another computer, remotely connect to the bad registry and change the value to simply say, "userinit.exe," (that's userinit.exe with no path and a comma at the end). This way winlogon will look in it's own local location for userinit and it just so happens both files are in the same folder.

More complicated solutions include:
backing up these files:
C:\windows\system32\config\system
C:\windows\system32\config\software
Then moving copies of them over from the C:\Windows\Repair folder.
This will let you boot long enough to manually load the software file with regedit (see load hive in regedit help for details) and make the appropriate change. You can then unload the software hive, boot back to recovery console and drop things back in place.

I've been making a lot of assumptions in this post but I'm going to make one more: The reason you got this way is your mounteddevices key has shifted drive letters in it. Query the microsoft KB for "mounteddevices" and possibly "userinit.exe" and you should find two or three articles covering this issue as well as how to fix a boot drive letter shift.

 

[STang57]

please bear with me as i am trying to understand all this...


lansalot,
1. how do i reinstall w/o reformat and keep my files? i dont remember seeing this option when i use the XP cd.
2. i cant check to see if there is "logoff.exe" in my startup folder because i cant login at all

slikkster,
i looked over the link. i didnt have the quick launch issue or search assistant toolbar before this happened. i did try what did apply to me but still no fix.

smilin,
1. how do i do an inplace upgrade?
2. im pretty sure it is pointed in the right direction. my windows is installed in C:\windows which means if i did remove drives it wouldnt affect the drive letter the OS is installed.
3. i was able to access the registry remotely but when i tried to expand the keys i got and error.


please reply with more solutions if possible. im willing to do anything to keep from losing my files.

 

[Slikkster]

It doesn't really matter if "it applies to you". Try the fix anyway:

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

 

[STang57]

i did the COPY USERINIT.EXE WSAUPDATER.EXE and it said "1 file(s) copied." after i rebooted i couldnt continue on and finish Phase II because i still cant log in

 

[Slikkster]

Did you copy the file to the system32 folder?

 

[dclive]

Originally posted by: STang57
i did the COPY USERINIT.EXE WSAUPDATER.EXE and it said "1 file(s) copied." after i rebooted i couldnt continue on and finish Phase II because i still cant log in

Try Smilin's fix. Ensure the registry shows only "userinit.exe," and doesn't have other stuff in there.

 

[STang57]

Originally posted by: Slikkster
Did you copy the file to the system32 folder?

yes

Originally posted by: dclive
Try Smilin's fix. Ensure the registry shows only "userinit.exe," and doesn't have other stuff in there.

how do i check the registry? the only way i know is Start -> Run -> Regedit. i cant do that since i cant log in. any other methods?

 

[dclive]

As he posted:

The simplest solution to this problem is when your computer is networked. You simply fire up regedit on another computer, remotely connect to the bad registry and change the value to simply say, "userinit.exe," (that's userinit.exe with no path and a comma at the end). This way winlogon will look in it's own local location for userinit and it just so happens both files are in the same folder.

I suggest doing that, and checking what the winlogon value is.

 

[Slikkster]

That would be a simple solution, save for the fact that most people don't have networked computers. But, if it's an option, give it a shot.

By the way, after you copied the wsaupdater file, did you try booting up in SAFE MODE vs normal mode? That's part of the deal. Try SAFE MODE.

You can also try the BartPE bootable CD to access your system. You have to be able to create one, of course, but since you're accessing the forums here, sounds like you might have access to another XP.

http://www.nu2.nu/pebuilder/

 

[dclive]

Originally posted by: Slikkster
That would be a simple solution, save for the fact that most people don't have networked computers. But, if it's an option, give it a shot.

By the way, after you copied the wsaupdater file, did you try booting up in SAFE MODE vs normal mode? That's part of the deal. Try SAFE MODE.

You can also try the BartPE bootable CD to access your system. You have to be able to create one, of course, but since you're accessing the forums here, sounds like you might have access to another XP.

http://www.nu2.nu/pebuilder/

The BartPE CD is an excellent suggestion - I highly recommend it.

Bear in mind that far more malware than just the wsaupdater junk will screw with the winlogon key.... it's wise to check the key itself and see what exactly is there.

 

[Slikkster]

Originally posted by: dclive

Bear in mind that far more malware than just the wsaupdater junk will screw with the winlogon key.... it's wise to check the key itself and see what exactly is there.

I would agree...it's just the Wsaupdater is the one that seems to crop up the most when these errors occur.

 

[dclive]

Originally posted by: STang57

Originally posted by: Slikkster
Did you copy the file to the system32 folder?

yes

Originally posted by: dclive
Try Smilin's fix. Ensure the registry shows only "userinit.exe," and doesn't have other stuff in there.

how do i check the registry? the only way i know is Start -> Run -> Regedit. i cant do that since i cant log in. any other methods?

It's been a few days - is this issue now resolved?

 

[Borg20001]

how do i check the registry? the only way i know is Start -> Run -> Regedit. i cant do that since i cant log in. any other methods?

I have had a similar problem and am still not thru it, but there might be a backdoor you can use to get into Regedit.

When you system is trying to install WinXP, I think you can hit either CTRL F10 or Shift F10 and it opens a command window from which you can type in Regedit and what ever file you want to open up with REgedit to view.

 

[dclive]

Originally posted by: Borg20001

how do i check the registry? the only way i know is Start -> Run -> Regedit. i cant do that since i cant log in. any other methods?

I have had a similar problem and am still not thru it, but there might be a backdoor you can use to get into Regedit.

When you system is trying to install WinXP, I think you can hit either CTRL F10 or Shift F10 and it opens a command window from which you can type in Regedit and what ever file you want to open up with REgedit to view.

Warning, though, that if you DID do this, you'd want to install Windows to a *different* location.

Another workaround would be to take Bart's PE Boot disk, swap the registry keys around (backup c:\windows\system32\config\*.*, and then put sam/software/security/system files into c:\windows\system32\config, then reboot into XP) and then from there you can do all kinds of things...