# Solved: WinXP Login->logout loop



## FedUpAlready (Mar 4, 2006)

Hi there all you benevolent, knowledgeable ones 

I've searched and found a similar problem to mine elsewhere, but none of their fixes work for me...

My PC was working fine yesterday; I dont remember installing anything. Today, I can't logon unless I boot in safe mode. 

The PC boots up, after the blue welcome screen, it gets to the desktop wallpaper image without icons, plays the startup sound, then flashes back to the blue welcome screen, playing the exit-windows sound. It ends up on the login prompt. (This didn't appear before - I'm the sole user of this PC, and have no password set, so it used to bypass this screen.)

Clicking on my account does a 10 second "loading personal settings"+startup sound -> "Saving your Settings"+exit-windows sound; back to the login screen again.

In Safe Mode, both Administrator and my normal account work. The internet doesn't work (even in Safe Mode with networking) though interestingly, I can still collect emails from my ISP. 

Things I've already tried without success:
-----------------------------------------------

1)
I tried last known good config. No joy. 
Also, System Restore is not available in Safe Mode. Should it be?

2)
I tried a diagnostic startup in msconfig; I can disable everything apart from one service: TrueVector Internet Monitor (Zone Labs, LLC), which I think is part of the Zone Alarm firewall. If I try to disable that, I get "An Access Denied error was returned while attempting to change a service. You may need to log on using an Administrator account to make the specified change." This is silly because I get this both from my account (which has Admin rights) and if I log in using the Administrator account! Of course that may be fine, and all this may be not relevant to the problem I've got...)

3)
I checked HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value: Userinit
Data: C:\Windows\System32\userinit.exe (as it should be.) I even tried copying the userinit.exe from another PC, in case that one was corrupted. I dont have blazefind.exe or wsaupdater.exe there. These are mentioned e.g. 
Here: http://www.lavasofthelp.com/articles/v6/04/06/0901.html 
And here: http://www.ntcompatible.com/thread31505-1.html

-----------------------------------------------
In case this helps diagnose, here's a HijackThis log (done in Safe mode, of course):
Thanks in advance for taking a look for me! :up:

Walt (who is definitely FedUpAlready)
-----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 22:12:41, on 04/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DK
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,[email protected]
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\dell\KD.BAT
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: MultiRes.lnk = C:\Program Files\MultiRes\MultiRes.exe
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher 2006\Scheduler daemon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Mozilla Thunderbird.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe
O4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher 2006\Protector.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - AppInit_DLLs: interceptor.dll,c:\progra~1\google\google~1\goec62~1.dll c:\progra~1\google\google~1\goec62~1.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


----------



## JSntgRvr (Jul 1, 2003)

System Restore should work in Safe Mode, but you must have Administrative rights.

Log out and then back in as an administrator.

Also, check if the The System Restore Service is running:

Open *Administrative Tools* in the Control Panel, click *Computer Management*, and then click *Services and Applications*. Click *Services*, and double-click *System Restore Services *from the list. Verify the service is *started and running*. If not, under *Service status*, click *Start* and change the startup type to *Automatic*.

See if that works.


----------



## FedUpAlready (Mar 4, 2006)

Two more points of information:

1) Embarrasing confession time:
When I right clicked on My Computer->Properties->System Restore, just to check, I sadly discovered that the "Turn off System Restore on all drives" box was ticked. I dont remember switching it off, but I guess I must have done at some point yesterday in my state of stress and confusion.  Im I right in thinking that this means that *all* my restore points have disappeared forever?  
If anyone knows how to turn system restore back on without loosing my previous restore points, that'd be just wonderful.

2) I was wondering if logon was failing because I'd corrupted something to do with my account. I tried logging on as Admin (in safe mode) and creating a new "Temp" account. Reboot; Logon screen; select Temp; Same old login->logout problem, even on the new account, so no joy there.  

Is there another way of diagnosing this problem that might narrow it down more specifically as a boot-up problem or a login problem and/or shed more light on it?

Thanks again.


----------



## JSntgRvr (Jul 1, 2003)

Seems that your registry is corrupted. Do you have a Windows XP CD? You can either perform a repair install, or replace your registry with the original registry backed-up in the computer. Some applications however will lose their functionality.

See the enclosed document for information:


----------



## Mosaic1 (Aug 17, 2001)

Please don't do that. Wait. There's an issue with Spycatcher where it quarantines userinit.exe and that's why you cannot log on in regular mode. If you disable or uninstall Spycatcher, you can then get into Windows again. I have seen this 3 other times.


----------



## dvk01 (Dec 14, 2002)

Yes do what Mosaic 1 says
Boot into safe mode 
open spycatcher, & turn off all protections, then go to spycatcher quarantine & restore anything it fixed

reboot normally & it should work, then post a new HJT log


----------



## FedUpAlready (Mar 4, 2006)

Thanks, Mosaic1 & dvk01, but what with my machine behaving strangely before, and then discovering that I'd lost my restore points, I decided to reformat the drive and reinstalled windows from scratch.

I dont think I'll be reinstalling SkyCatcher, though...  

Thanks again - might as well close this one...


----------



## rosemere (Oct 29, 2006)

I had the same problem, woke up this am and needed a password. After I finally found the info here and REMOVED Spy Catcher we are running normally again. Thanks.


----------



## rosemere (Oct 29, 2006)

I just went into Program Files and SpyCather 2006 is still there in a folder even though I deleted yesterday. Could you advise what I should do now? I went to Add Remove it show there but when I hit remove is says unistall dat does not exist.


----------



## Endicott (Dec 24, 2006)

I had a problem identical to the initial 3/4/2006 post. Machine would boot in safe mode, not in normal or last good configuration. Could not access system restore in safe mode. Received the ""An Access Denied error was returned while attempting to change a service" message on trying to change services. Finally did a repair and although I lost some of my tweaking, at least thnigs are running again. I do not have SpyCatcher installed. I do use Zone Alarm, Spy Sweeper and Windows Defender. Any recent repeats of this situation?


----------



## Endicott (Dec 24, 2006)

"An Access Denied error was returned while attempting to change a service." while trying to use MSCONFIG

Found another thread that suggested a HP printer driver update (PML Security Update pmsvptch.exe v1.0 released on 2006-11-07) was the culprit. I do have a PSC 2410 Photosmart and found the driver "Pml Driver HPZ12" running in local services. I was able to stop it, but it would not let me change the status from automatic to manual.

This solution was posted yesterday. I have not tried it yet as I have not yet found out what affect it might have on the printer.

(http://www.techspot.com/vb/all/windows/t-42578-MSCONFIG-access-denied-error.html):

Don't know if you are still having this problem, but the answer is in disabling the PML Driver HPZ12 service.

1. Go to regedit via start ... run ... regedit
2. Export registry to make a backup (in case something goes wrong!!)
3. navigate to HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Pml Driver HPZ12/Start
4. Right Click and select modify
5. Change value to 4 for disabled (or 3 for manual...I did 4)
6.Restart computer


----------

