[SalesForce] INVALID_LOGIN: Invalid username, password, security token; or user locked out. using C#

I imported the Partner v26 WSDL into a Visual Studio 2012 console application as a Web Service Reference (not a WCF service reference).

Then with a bit of painful cutting and pasting from the PDF I brought the C# example code in from the SOAP API developers guide pg 27 referenced by Jordan in his answer. It looks like their example is designed for use with the Enterprise WSDL as it has a Contact object in the querySample() method. So I hacked that section out to get it compiling.

I named the Web reference "SforceService", so the only other change I needed to make was to change the using Walkthrough.sforce; to using ConsoleApplication1.SforceService;.

I was able to run the sample code and establish a Salesforce session with a username and password (no security token as the IP had been trusted in the org).

Do you want me to try and zip up the console application project and share a link?

string username = "XXX@YYY.com";
string password = "password";
// Create a service object
SforceService binding = new SforceService();
// Timeout after a minute
binding.Timeout = 60000;
// Try logging in
LoginResult lr;
try
{
    lr = binding.login(username, password);
}
// ApiFault is a proxy stub generated from the WSDL contract when
// the web service was imported
catch (SoapException e)
{
    // Write the fault code to the console
    Console.WriteLine(e.Code);
    // Write the fault message to the console
    Console.WriteLine("An unexpected error has occurred: " + e.Message);
    // Write the stack trace to the console
    Console.WriteLine(e.StackTrace);
    // Return False to indicate that the login was not successful
    return false;
}
// Check if the password has expired
if (lr.passwordExpired)
{
    Console.WriteLine("An error has occurred. Your password has expired.");
    return false;
}
/** Once the client application has logged in successfully, it will use
* the results of the login call to reset the endpoint of the service
* to the virtual server instance that is servicing your organization
*/
// Save old authentication end point URL
String authEndPoint = binding.Url;
// Set returned service endpoint URL
binding.Url = lr.serverUrl;
/** The sample client application now has an instance of the SforceService
 * that is pointing to the correct endpoint. Next, the sample client
 * application sets a persistent SOAP header (to be included on all
 * subsequent calls that are made with SforceService) that contains the
 * valid sessionId for our login credentials. To do this, the sample
 * client application creates a new SessionHeader object and persist it to
 * the SforceService. Add the session ID returned from the login to the
 * session header
 */
binding.SessionHeaderValue = new SessionHeader();
binding.SessionHeaderValue.sessionId = lr.sessionId;

Note that the LoginScopeHeader is not required. According to the linked documentation it:

Specifies your organization ID so that you can authenticate Self-Service users for your organization using the existing login().

Resetting Values to null

To reset a field value to null, you add the field name to the fieldsToNull array in the sObject. You cannot set required fields (nillable is false) to null.

Source: https://www.salesforce.com/us/developer/docs/api/Content/sforce_api_calls_update.htm