WinXP: immediate automatic logoff problem

[sykopath79]

I had a problem on a customer's machine today that I have not yet been able to resolve, so I am turning to the ever-helpful AnandTech community for some assistance. I have seen this issue once before and one of our other technicians had found a fix for it, but in different circumstances.

Here is the problem: when you click on a user name to log in on the Windows XP graphical logon screen, it briefly says "Loading your personal settings", shows the desktop wallpaper for about half a second, then immediately logs back off. Happens in safe mode, too.

Here's what I did to the machine before this started happening:

[*]I removed quite a bit of spyware and a few viruses (mostly spyware-related trojans) from the machine. In the process of doing so, I ran About:Buster which flagged numerous .dll's in the \windows\system32 folder, some of which looked normal but I booted to Recovery Console and removed them since About:Buster had tried to remove them itself.

[*]After doing this, when rebooting, Windows got stuck in a BSOD/autoreboot loop and would not even boot to safe mode. I assumed that one or more of the DLL's I deleted had caused this, so I popped the WinXP disc back in to perform a repair install.

[*]The repair install of WinXP Home w/Service Pack 2 appeared to go normally, but I did notice one thing. During the graphical phase of the install, normally there are two dialogs presented: the first which appears around the "36 minutes remaining" mark & asks for registration name/company, Product Key, time zone, and such; and the second which appears around the "20 minutes remaining" mark & asks for network settings. The second dialog series (network settings) did not appear, the install simply finished & rebooted to the WinXP first time boot wizard (where it asks if you want Automatic Updates, prompts for Activation, etc.)

After this, when Windows would normally allow you to log on, is when I began noticing the automatic logoff problem. A second repair install did not fix the issue.

Ideas? This customer is a pain in the ass and is demanding to have his computer back very rapidly. Is there any way to fix this without a format & reinstall?

 

[talyn00]

Does this only occur on that single account?
Try logging in as the Administrator account and going through the Event Viewer to see if any error events were generated.

 

[sykopath79]

Happened with all accounts. I seem to have narrowed down the cause to a corrupted userinit.exe, though I will have to test this theory in the morning when I'm back at my bench with the customer's machine.

If it works I will post the full solution here.

 

[sykopath79]

I solved the problem, but I forgot to post my solution until I got an e-mail about it from a reader.

The problem stemmed from corruption of the file userinit.exe in the %systemroot%\system32 directory. Userinit.exe apparently triggers several processes when the user logs on, including Explorer.

To allow the system to log on and start Explorer, it was necessary to change a Registry value. In the Registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

change the Userinit value in the right pane from "%SystemRoot%\SYSTEM32\userinit.exe," to "%SystemRoot%\explorer.exe," Note: you must include the comma. "%SystemRoot%" means the location of your Windows directory, usually either C:\WINDOWS or C:\WINNT

You can now log on to the machine and Explorer will load, but you still need a working userinit.exe. I simply copied userinit.exe from a working machine into the %SystemRoot%\SYSTEM32 directory, and then changed the above Registry value back to "%SystemRoot%\SYSTEM32\userinit.exe," after which Windows would log on normally without the automatic logoff problem.