Computer logs off straight after logging in

2009-05-13 15:52 by Craig Atkins (0 comments)

I had a customer's machine in yesterday which was exhibiting symptoms as follows:
  • Windows shows list of users
  • Customer selects his username
  • Windows starts to log in - shows 'Loading your personal settings...' text
  • Then it starts to log out - shows 'Logging out' text
  • Windows shows list of users again

Unfortunately, the customer had already tried partially cleaning up the machine so I couldn't easily see what virus it may have been. However, I do know that he'd tried a clean-up himself with AVG 8.5. This had picked up a lot of different viral files, and then he'd chosen to automatically heal them or move them to the virus vault.

After this virus removal process, the log in/log out symptoms displayed above started.

Our steps to cure the problem 

Firstly we removed the hard disk drive, hooked it up onto another machine and gave it a full virus scan. This found a lot of infected files and these were removed

Result: Did not fix problem 

Next, we tried a repair installation of Windows. This is where you boot from the Windows CD, choose to Install Windows and then select the option to repair the installation that is corrupted. In effect, this re-installs Windows back on top of itself whilst keeping your documents and settings intact. (For more information on repair installs, please see: http://michaelstevenstech.com/XPrepairinstall.htm)

Result: Did not fix problem 

The next thing to check was the actual files used in the login process. These include winlogon.exe, userinit.exe and explorer.exe
An examination on the hard disk drive for those files resulted in the discovery that userinit.exe was missing!
This will clearly cause login problems, so the next step was to restore the file from a Windows CD. To do this, boot from your Windows CD and on the first screen press 'R' for the recovery console. Choose your Windows installation when prompted (usually 1) and then enter your administrator password (if unsure, leave it blank - if that doesn't work then you'll need to look at resetting your administrator account password).
You should then have a command prompt something like this:
C:\Windows>  

You need to navigate to your CD drive. To do this, you need to know which drive letter your CD drive has. The easiest way is trial and error. To change to your CD drive, you type:
d: 

If your CD drive is not d: then try e:, f: or g:. When you have the right drive, you will know as the command:
dir 
should give you a directory listing like:

21/03/2009  00:15    <DIR>          .
21/03/2009  00:15    <DIR>          ..
14/04/2008  13:00               110 AUTORUN.INF
21/03/2009  00:14    <DIR>          DOCS
21/03/2009  00:14    <DIR>          DOTNETFX
21/03/2009  00:15    <DIR>          I386
14/04/2008  13:00            34,652 README.HTM
14/04/2008  13:00         1,314,816 SETUP.EXE
14/04/2008  13:00            85,792 SETUPXP.HTM
21/03/2009  00:15    <DIR>          SUPPORT
21/03/2009  00:15    <DIR>          VALUEADD
14/04/2008  13:00                10 WIN51
14/04/2008  13:00                10 WIN51IC
14/04/2008  13:00                10 WIN51IC.SP3

               7 File(s)      1,435,400 bytes
               7 Dir(s)  51,141,550,080 bytes free

 

Once you're on the CD drive, type:
CD i386

Then type:
expand userinit.ex_ c:\windows\system32\

You should see a message saying something like:
1 file expanded successfully

This means you've extracted that file from the CD drive and put it into the system folder on your hard disk drive.
Eject the Windows CD and re-boot the computer

We did the above, and then lo and behold we could then log-in again!

Result: Success, we can now log in! 

We then proceeded to download and install MalwareBytes, scan & clean the system (another 94 infected/dubious files) and then the machine was updated and ready to return

Summary 

If you have problems logging in or out of the computer like the following:

  • The system logs in and then logs you straight out
  • If you only have one user your system will load up, flash the desktop and then take you to a blue screen with your username and login icon/picture. You will be logged out automatically if you log-in.
  • Safe mode does not work - same problems

Then it's worth checking the userinit.exe file - it may have been removed by malware, or by an over zealous antivirus program.
If it has been removed, follow the steps above to restore it again. 

Share/Save/Bookmark

Go back

Add a comment

*
*
Please add 4 and 7.*