Auto log off - virus?

[Julian]

I have a problem on one of my friend's XP machine. Windows logs off
imediately ofter logging on any user, even the Administrator and even in
Safe Mode. Any clues? Julian.

 

[Ramesh, MS-MVP]

Hi,

You cannot log on to Windows XP after you remove Wsaupdater.exe:
http://support.microsoft.com/kb/892893

How to edit the registry offline using BartPE boot CD ?:
http://windowsxp.mvps.org/peboot.htm

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


I have a problem on one of my friend's XP machine. Windows logs off
imediately ofter logging on any user, even the Administrator and even in
Safe Mode. Any clues? Julian.

 

[Julian]

I did that with UBCD4Win (a BartPE clone) and also did a virus scan from
BartPE environment, but still the same results: cannot logon under any
account.

 

[Ramesh, MS-MVP]

Checked the Userinit registry value as mentioned in the links I posted?
Also make sure that the userinit.exe file is present in the System32 folder.

Other Possibilities
------------------

Unable to Log on if the Boot Partition Drive Letter Has Changed:
http://support.microsoft.com/kb/249321/

How to restore the system/boot drive letter in Windows:
http://support.microsoft.com/kb/q223188/

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


I did that with UBCD4Win (a BartPE clone) and also did a virus scan from
BartPE environment, but still the same results: cannot logon under any
account.

 

[Julian]

Did both and rechecked. They're still there, but users keep logging off.

C:\WINDOWS\system32\userinit.exe, and userint.exe in System 32

Does the uppercase matter?

 

[Ramesh, MS-MVP]

Does the uppercase matter?

Nope.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


Did both and rechecked. They're still there, but users keep logging off.

C:\WINDOWS\system32\userinit.exe, and userint.exe in System 32

Does the uppercase matter?

 

[WTC]

Did both and rechecked. They're still there, but users
keep logging off.

The problem may be an incorrect system drive letter. With a networked
machine, open the registry and connect to the problematic machine and
navigate to:

[MACHINE_NAME\HKLM\SYSTEM\MountedDevices]

and delete all values that look like this:

\DosDevices\C
\DosDevices\D
\DosDevices\E
and so on

When finished, make sure you disconnect the networked machine from the
registry. There are other ways to gain access to the registry if you cannot
connect to the problematic machine via networked Registry. Please let me
know if you need information on how to gain access to the Registry if you
cannot by a networked registry.

How to restore the system/boot drive letter in Windows
http://support.microsoft.com/?kbid=223188