Computer logs off straight after logging in
2009-05-13 15:52 by Craig Atkins (0 comments)
- Windows shows list of users
- Customer selects his username
- Windows starts to log in - shows 'Loading your personal settings...' text
- Then it starts to log out - shows 'Logging out' text
- Windows shows list of users again
Unfortunately, the customer had already tried partially cleaning up the machine so I couldn't easily see what virus it may have been. However, I do know that he'd tried a clean-up himself with AVG 8.5. This had picked up a lot of different viral files, and then he'd chosen to automatically heal them or move them to the virus vault.
After this virus removal process, the log in/log out symptoms displayed above started.
Our steps to cure the problem
Firstly we removed the hard disk drive, hooked it up onto another machine and gave it a full virus scan. This found a lot of infected files and these were removed
Result: Did not fix problem
Next, we tried a repair installation of Windows. This is where you boot from the Windows CD, choose to Install Windows and then select the option to repair the installation that is corrupted. In effect, this re-installs Windows back on top of itself whilst keeping your documents and settings intact. (For more information on repair installs, please see: http://michaelstevenstech.com/XPrepairinstall.htm)
Result: Did not fix problem
The next thing to check was the actual files used in the login process. These include winlogon.exe, userinit.exe and explorer.exe
An examination on the hard disk drive for those files resulted in the discovery that userinit.exe was missing!
This will clearly cause login problems, so the next step was to restore the file from a Windows CD. To do this, boot from your Windows CD and on the first screen press 'R' for the recovery console. Choose your Windows installation when prompted (usually 1) and then enter your administrator password (if unsure, leave it blank - if that doesn't work then you'll need to look at resetting your administrator account password).
You should then have a command prompt something like this:
C:\Windows>
You need to navigate to your CD drive. To do this, you need to know which drive letter your CD drive has. The easiest way is trial and error. To change to your CD drive, you type:
d:
If your CD drive is not d: then try e:, f: or g:. When you have the right drive, you will know as the command:
dir
should give you a directory listing like:
21/03/2009 00:15 <DIR> .
21/03/2009 00:15 <DIR> ..
14/04/2008 13:00 110 AUTORUN.INF
21/03/2009 00:14 <DIR> DOCS
21/03/2009 00:14 <DIR> DOTNETFX
21/03/2009 00:15 <DIR> I386
14/04/2008 13:00 34,652 README.HTM
14/04/2008 13:00 1,314,816 SETUP.EXE
14/04/2008 13:00 85,792 SETUPXP.HTM
21/03/2009 00:15 <DIR> SUPPORT
21/03/2009 00:15 <DIR> VALUEADD
14/04/2008 13:00 10 WIN51
14/04/2008 13:00 10 WIN51IC
14/04/2008 13:00 10 WIN51IC.SP3
7 File(s) 1,435,400 bytes
7 Dir(s) 51,141,550,080 bytes free
Once you're on the CD drive, type:
CD i386
Then type:
expand userinit.ex_ c:\windows\system32\
You should see a message saying something like:
1 file expanded successfully
This means you've extracted that file from the CD drive and put it into the system folder on your hard disk drive.
Eject the Windows CD and re-boot the computer
We did the above, and then lo and behold we could then log-in again!
Result: Success, we can now log in!
We then proceeded to download and install MalwareBytes, scan & clean the system (another 94 infected/dubious files) and then the machine was updated and ready to return
Summary
If you have problems logging in or out of the computer like the following:
- The system logs in and then logs you straight out
- If you only have one user your system will load up, flash the desktop and then take you to a blue screen with your username and login icon/picture. You will be logged out automatically if you log-in.
- Safe mode does not work - same problems
Then it's worth checking the userinit.exe file - it may have been removed by malware, or by an over zealous antivirus program.
If it has been removed, follow the steps above to restore it again.


Add a comment