Me being stupid = damaged winlogon.exe (no logon)

C

cellophane-noodles

Weaksauce
Joined
Aug 4, 2006
Messages
80
So, I had just download pskill. And I decided to test it. I started closing the svchost processes using the regular task manager. (There are like 4, you know, and you can kill the first three but not the last.) So I had killed like 1, and then the second one I killed gave some error, some process had been unexpectedly terminated. A popup box counted down from 60 till the system restarted. Well, I checked what process it was. it was winlogon.exe. So I was like, I'll just kill it with pskill, let's see if it works. And it killed it. Then I got a bsod (I couldn't read what it said, but that's a seperate issue.) So then I was like, whatever, I'll just restart. And everything went fine, right through selected the user. Then it just hangs, showing the background, all processes normally loaded. Except if I go and see which user the processes are run under, they all have a blank there, including the SYSTEM processes. So for some reason winlogon is not correctly logging on the user. Safe mode does work, fortunately, but system restore did nothing. Help me! This isn't even my computer (it's my parents), and I need to fix it asap.

thanks!
 
I went googling for a while and didn't find much.

Next time you fool around do your homework first, the system won't function with winlogon.exe forcibly killed. There's reasons to want to kill winlogon but thats not important now.

The only thing I can try to offer is is maybe that utility you downloaded as a memory, and things you haphazardly killed, for whatever reason, are now marked as 'kill everytime.'

What I'd do is go into safe mode and browse around that program for any sign of a history of some sort.
 
Yeah, I don't think it is repeatedly killing winlogon.exe. If there was damage to the file, is there a way to restore the file (w/o formatting)? Would preforming a repair w/ the xp disc solve the problem?


Edit: Are files that are normally in the C:\ folder supposed to show up in safe mode? Cause if not, this is really weird. I had the file pskill.exe in the C:\ folder. I did a quick search for it, and it's not there anymore, it's in the prefetch folder. (or would system restore mess it up somehow?)
 
Well, the best way to replace the winlogon.exe file, assuming of course that's it's damaged, is to simply use a live boot cd like a Linux distro or ERD Commander (by Winternals, everyone should have this software), and replace the winlogon.exe file.

Really though, that shouldn't be the problem. The only time I've had issues with that file is when people try to patch it to get rid of certain annoying windows features....but anyway, find someone that has a restore disk, boot to the command line, and copy the file over. That should work too, assuming it's winlogon.exe

Anyway, boot into safe mode and run eventmgr. It'll give you a ton of error info that is extremely useful in diagnosing problems. Just poke around in the error logs until you see something that is generating errors each time you try to logon normally. If you find something, write it down and post it.
 
Umm... how do I run eventmgr? I don't think I have it.

And if I just replace winlogon.exe w/ the old one could I break anything more than it already is?
 
If you click Start, then Run, and type in "eventvwr" without the quotes, it'll pull up the error logs. Sometimes there is good info there, like maybe it's a particular piece of software and not the winlogon.exe that is broken. Ya never know.

And no, you can't break it more by restoring the winlogon.exe file to it's original state. It doesn't contain anything itself, it just manages the whole authentication process and whatnot.

::EDIT:: I'm an asshole. I said "eventmgr" when I meant to say "eventvwr" My mistake.
 
You must log in or register to reply here.
Back
Top