XP shuts down at log in

Windows XP Pro shuts down when any user log in including Admin. It does the same thing in safe mode.
have anybody had experience this problem. does anybody know what could be the issue.


Who is Participating?
TvMptConnect With a Mentor Commented:
To do this, put the Windows CD into the CD-drive and reboot the system. The system should boot up from the CD-rom.

When a windows has started on the laptop, press the R key. This should take you into the recovery console. It will ask you for the Administrator password and then give you a command screen.

Once there, you type

D: press [ENTER]
CD I386 press [ENTER]

This will extract userinit.exe from the CD-rom and put it into the right place on the PC's hard-drive.

You can then reboot the system and should be able to login.
LeeTutorConnect With a Mentor retiredCommented:
Does it actually shut down, or just log off the user and return to the Welcome Screen (assuming you're using the Welcome Screen)?  If it is a logoff, then:  The following page describes how this problem occurs after you have attempted to clean up adware/spyware with a certain version of the data, and also what to do about it:

Unable to logon to Windows after removing BlazeFind using a spyware removal utility?

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

(If that does not work, try CHDIR SYSTEM32)


Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

NOTE    If you don't have a Windows XP CD-ROM, you need to use Windows XP Setup floppy disks to enter the Recovery Console.

 Phase II  -  Fixing a registry entry which causes the Quick Launch issue (not retaining the settings)

Click Start, Run and type REGEDIT. Navigate to:


In the right-pane, change the value of Userinit to "C:\WINDOWS\system32\userinit.exe,"

Type the above value exactly as given, including the comma - exclude the quotes. Also, change the path to userinit.exe appropriately, if Windows is installed in a different drive.

Close Registry Editor and restart Windows.
LeeTutorConnect With a Mentor retiredCommented:
If the above doesn't fix it:  Can you logon in Safe mode with Command Prompt?  If so, you could try a System Restore to before the time this started happening:

HOW TO: Start the System Restore Tool from a Command Prompt in Windows XP

By the way, this sort of occurrence is nearly always the result of viruses, spyware or other malware, so if you can finally get into Windows (or if you can mount the problem hard disk as a secondary drive on a working XP machine) then you should do this:

Some free online virus scanners:




Also try these free programs to rid your system of spyware, trojans, and other malware:

Spybot - Search & Destroy

LavaSoft Ad-aware  

I use BOTH of the above programs on my 3 Windows systems; what one program misses, the other catches.  Also make sure to download the most up-to-date data before you run the programs.

Another very good freeware program for ridding yourself of spyware is this:

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

AbdellahTAuthor Commented:
Your were right about the log off not shutdown.
I tried your solution, but when I run copy userinit.exe wsaupdater.exe it tells me that the file specified in not found. I looked in C:\windows\system32 there is no userinit.exe nor wsaupdater.exe.
any suggestions
LeeTutorConnect With a Mentor retiredCommented:
If you get into Recovery Console by booting to your WinXP installation CD, then you can use the EXPAND command to "unzip" the compressed file USERINIT.EX_ in the I386 folder on the CD into \Windows\System32\ folder.
I don't understand why you awarded points only to TvMpt.  I gave most of the details of your solution in my first comment, and I was only two minutes behind TvMpt in providing the answer to your last question.  Why not split the points?
AbdellahTAuthor Commented:
I am sorry. you deserve some point. how can I correct it?
Thanks, AbdellahT.  Glad you got your problem fixed...  ;0)
AbdellahTAuthor Commented:
After we were able to log in. I ran a full symantec scan. we found this: Trojan.Fakeavalert

do you happen to know anything about this Trojan in relation with the problem?

Where are the techniques Trojans uses to sneak into a computer?

Here's the Symantec information page about it:

Trojan.Fakeavalert   Technical Details
And here's a pretty good informational page from Symantec about the differences among all the various types of malware:

What is the difference between viruses, worms, and Trojans?
AbdellahTAuthor Commented:
Thanks a lot. if they were any more points left I would give them to you.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.