Can't log in due to winlogon.exe error

When I logged in my computer in office a few days ago, an error window appeared after I entered the user name and password. The error message was below:

SAS Windows: winlogon.exe-Application Error the instruction at "0x000000" referenced memory at 0x0116e000" the memory Could not be read

after clicking OK or cancel, the computer down.
The same situation happened in safe mode.

I have tried to fixed the system by reinstallation. But it just doesn't work.
During my installation, a SYSOCMGR.EXE error happened. After clicking OK or CANCEL, the setup procedure continued. But before the setup was almost completed (remaining time less than 1 min and during deleting tmp files), a SETUP.EXE error appeared. And the installation was over.

What drives me mad is that I have over 1G encrypted important data on the partition E:. I just can't access those data now!

Anyone can give some suggestion?

 

Xodarap--There are several possible causes.
You might first try a scan with a spyware detector to eliminate that possibility
AdAware
http://www.lavasoft.de/support/download/
SpybotS&D
http://www.safer-networking.org/
I would suggest AdAware in this case since one of the possible spyware problems is VX2 and AA have a special remover for it.
Post back if spyware is not the problem.

 

spyware doesn't seem to be the problem

I tried to boot the system with an bootable utility CD, and scanned the computer with three antivirus software, i.e. Panda Antivirus, Kingsoft Antivirus (one Chinese Software) and AdAware.

Kingsoft Antivirus found one virus Win32.Troj.PutrityScan.b.52161 and removed it successfully.

However the problem remains when I log in Winxp.
I reinstalled the system in fixing mode once more, the same errors mentioned above happened.

The point is that I need the users information in the old system to open the encrypted files. Or else I can just format c: and reinstall winxp.

Does anyone know what files in system directories may include the user information, expecially the private key information for users?

 

Similar problem due to spyware

Have you tried booting with and without your network connected? I had a spyware problem that I never could resolve, even with spybot and others. I eventually loaded a second copy of XP which allowed me to move my files to "my documents" on the clean copy, then burn them to CD. I then reinstalled XP with formatting to zap everything and reloaded my files and applications. Simply reinstalling XP never solved the problem until I did the reformat. I had professional help to walk me through the process, but it was relatively simple, though time-consuming. Good luck!

 

I like copterchiefs recommendation of pulling the nettap, but since you said it still happens in safe mode, i fear it will yield no fruit. worth a shot, tho.

Xodarap- if pulling the tap doesnt work, I'd recommend giving microsoft a call on this one. You should be able to recover the machine, or at least recover the data.

You said its encrypted data, Im assuming you used EFS for that. I don't have enough information to know if its going to be possible to recover the data (it may or may not be possible depending on how you setup EFS)

informational overview of EFS and recovery procedures
http://www.microsoft.com/technet/prodtechnol/winxppro/support/dataprot.mspx

 

thanks to copter and Joe.

I did encrypte the data by EFS. According to the documents of Microsoft, such data is not recoverable without data recovery angent or private key. Unfortunately, I didn't have much idea about EFS before, so I did nothing as precaution.

I guess the only way to save my data is to recover the original Winxp system. Maybe microsoft can do this. But I am afraid they won't help me.

Anyway, thank you all for your kindness.