Link to home
Start Free TrialLog in
Avatar of detimes2

asked on

Windows XP keeps logging off

I have a problem with my computer running Windows XP.  I had adaware installed on my computer.  I turned on my computer one day and it would try to log in, I would see the desktop picture briefly and then immediately says that it's saving my settings and takes me back to the login screen.  I fixed the problem by going to the console recovery and copying a new userinit from another computer. Everything was working great.

 Recently, I updated my adaware program to the adaware SE, everything was working fine but then when I shut it down and tried to turn on the computer, it is doing the same thing and logging me off.  I tried to use the console recovery as before but with no luck.  Any suggestions?
Avatar of SheharyaarSaahil
Flag of United Arab Emirates image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of detimes2


Yes, I copied the userinit.exe from a working XP machine.  Went to the machine not able to log on and copied the userinit.exe to the system32 folder.  Then I deleted the wsupdater and copied the userinit.ext to wsupdater.  I cannot get to the registry editor to change it as it still won't log on.
Thanks for your help
then may be the problem is not asupdater this time :-?
have you tried starting system in safemode to login with Administrator or in last known good configuration ??
No, I haven't.  I will give it a try.  Is there a virus that also logs the computer off.  Seems like the blaster did something to that effect
No blaste doesn't do such things.... im sure its just a corrupted\missing registry problem :)
You try with safemode, if safemode works, then create a new user from Control Panel>User Account, and restart to login with the new user, once you will confirm that new user is orking, move the data from the old user to the new one!
How to copy data from a corrupted user profile to a new profile;EN-US;811151

If safemode fails also, then use Bart's PE CD from here >>
use it to get into the OS, and either correct the userinit value in regedit or use System restore to roll back the system when it was working fine.... im sure it should sort out this issue :)
> Windows XP keeps logging off

If you find out why, do lemme know.  Happens a lot to me. (but not lately)

>  Is there a virus that also logs the computer off

No. Or rather, I suggest looking elsewhere first.

Here's my list of things that can be implicated, but first an observation.  With XP there are less BSODs.  This does not mean that there are all those problems being corrected, what it means that the error-handlings have changed, and when it leads to a logoff, or a simple case of thinking you are only running one program and suddenly you just get presented the main window screen and nothing left on taskbar to indicate formerly running program, this does not necessarily mean introduction of new malware, it can be use of 'valid' tool that can be subject to displaying inappropriate behavior.

PowerSave and recovery options
Antivirus updates
Software backdates
Screen resolution
Software registration
Defrag & screen saver

Most of time I think it is a tool design that could include a form of popup requesting your agree or disagree, it may give you choice, then again may not.  Most likely it has scheduled some event, (such as popup) that it 'knows' you 'want', as such it has a presumed period that you can identify.  The problem is that the new program being called up is in some way incompatible with the program that is running.  Which program is at fault is rather pointless in defining, a collision is a collision, incompatibilities remain incompatible, unless you want to point fault at the OS for being so, um, uninformative about why it logged you off or killed your program.

The top two on my list were A/Vs, the first a freebie that came with computer. It kept wanting me to get an update (which of course would need a subscription by now), and those times would be subject to greater possibility of failure.  Another was a new suite of products from A/V, that just kept asking for me to 'register' to make it valid. This continued on after it removed itself after my trial period (for a purchased product including valid license).  I identified it by association with problems that only happened at midnight.  Sometimes I get the popup, sometimes the crash. Always the same time.  Then after awhile the window slid.  Such as happening exactly 30m before, or 30m after midnight.  I noticed that both the successful popup generation and the alternative of successful crash migrated to the same minute. Later on, it slid another hour, leading me to comment that Symantec can't tell time.  There was another issue of spyware that came built into computer.

My resolution was to to dispense with all the identified products, bought a new version of the OS, reformat and install OS, and the problems are nearly all gone.  There may be something left in the OS that causes it to crash itself (as it ever has) or in my preferred programs, but the uptime is now rather stable, comparatively.  I run UPS, and experience high frequency of brief problems.  I get occassional beeps that seemed strange, thought it came from disk drive until one day it happened before powerup and I realized it was the ups.

So for a last rec: recheck all of your configuration options for handlings of detected problems.  I get more success, wherever I can configure to 'never' check or handle failure (such as to reboot for error, shutdown for error, wait 15 minutes then ...   <- I disable all that stuff and get better results).  

You also should make sure your VGA driver has best updates and include in testing whether or not any autosaving is enabled
> Recently, I updated my adaware program to the adaware SE, everything was working fine but then when I shut it down and tried to turn on the computer, it is doing the same thing and logging me off

There ya go. A btw, the culprit is 90% the last change performed. I vote to trash any all culprits, no matter their desireability. I prefer multiboot options to help that. And don't forget the XP CD has an option to repair recover (after beginning install).
This problem is very likely caused by BlazeFind. Overwriting the wsaupdater.exe in system32 has not worked for a lot of professionals.Now, i found this post that DEFINITELY solved the problem for me.It involved modify the registry hive.My Userinit Key in my registry was changed to C:\recycled\svchost.exe; crazy isnt it. Here's the post:

 Second NOTE: Most of these steps assume that Windows is installed to C:\windows. If your installation is not in C:\windows, then please change the paths in my instructions to where your installation is. OK, I just had a customer that had this problem and here is how I resolved it. I limited the steps some to (hopefully) make it easier. First things first get to recovery console using previous methods provided. If you are unsure of how to get to recovery console look at the previous methods of resolving this problem and they explain it. OK, now that we are at recovery console, we need to replace the software hive with a previous good backup. It should look something like this: C:\windows>cd system32\config C:\windows\system32\config>ren software software.old This renames the current software hive to software.old C:\windows\system32\config>copy C:\windows\repair\software It should say "1 file(s) copied" NOTE: After the next step you will want to remove the cd, then boot into safe mode. If you do not boot into safe mode in Windows XP it may prompt you to reactivate and you may not be able to get into Windows. C:\windows\system32\config>exit Now hit the F8 key and boot into safe mode. Logon to the administrator account when you reach the welcome screen. Hopefully you will be able to logon. Now we need to edit your old registry to change the path to the userinit.exe file: open regedit.exe Highlight HKEY_LOCAL_MACHINE (note: this is important, if you do not highlight this the next step will not work) goto file - load hive... Now select your old registry file which should be in C:\windows\system32\config\software.old It will ask you what to name it, if you don't understand, just type "test". Now navigate to the following: HKEY_LOCAL_MACHINE\\microsoft\windows nt\currentversion\winlogon. Look at what the userinit value is. On my customer's machine it was %system32%\userinit.exe which is invalid. NOTE: If you can, post what your value is when you look at this. Next change the value to read C:\windows\system32\userinit.exe Now close the registry editor, and we need to go back to recovery console to put your original registry back which should look like this: C:\windows>cd system32\config C:\windows\system32\config>del software C:\windows\system32\config>ren software.old software C:\windows\system32\config>exit This (in theory) should get you back into Windows. Please post here what your results are so that we can have some good feedback on the solution. My theory is that Adaware SE is fixing the wsaupdater.exe problem, but it is setting the value in the registry to %system32%\userinit.exe which does not work on all systems. Let me know if this helps.