XP reboots at user logon

[G0AOZ]

Dell Dimension 4600 XP Home SP2 which was in a very sorry state, loaded up to the gills with viruses and trojans, etc., and wouldn't boot at all. Ordinarily I'd have told the user with a machine in that state to just wipe it and start with a fresh XP installation. But there are numerous programmes installed for which they no longer have the installation disks! Anyhow, eventually got it cleaned out, and ended up running an over-the-top XP repair which finally got it going. However, still got problems...

If the machine is booted up and left at the logon screen (without selecting a user) for more than about 7 or 8 seconds, the machine completely reboots. Quickly entering one of the user accounts produces normal operation of the computer. No errors appear in the Event log and no BSOD can be invoked when it crashes.

I have run tests on the hard disk, memory and run a pretty intensive burn-in test within Windows. No failures, and nothing seems to be getting too hot etc. Tried changing the PSU for a known good one with higher Wattage output.

There is currently no screensaver set in Display properties, power settings for Monitor, Hard drive, and Standby are all set to "never", and hibernation is switched off.

Any clues as to what might be provoking this reboot?

ROGER - G0AOZ.

 

[linney]

Have you turned off the automatically restart options via System Properties to see if you get a BSOD?

Also check any "Information" line that mentions "savedump" in the Event Viewer and you should find reference to "recovered from a bug check". This is the Stop Error that caused your problem, that's if it is a Stop Error in the first place.

Any scheduled tasks or scripts set to run if machine is idle?

Maybe it is not as clean as you think and something is still lurking in there. Have you tried some of these?

Spybot - Search & Destroy

http://www.safer-networking.org/en/spybotsd/index.html

Ad-Aware 2008 7.1.0.8

http://www.download.com/Ad-Aware-2008/3000-8022_4-10045910.html?hhTest

Removing adware & spyware
faq608-4650


Windows Defender

http://www.microsoft.com/athome/security/spyware/software/default.mspx

HijackThis Tutorial and download

http://www.pchell.com/support/hijackthistutorial.shtml

I see lots of recommendations here for programs like -

SuperAntispyware

http://superantispyware.com/

Malwarebytes' Anti-Malware

http://www.malwarebytes.org/mbam.php

 

[G0AOZ]

Thanks Linney.

Automatic restart already turned off.

Been through all the "information" lines in Event Viewer, but nothing relating to "savedump".

No tasks shown in Scheduler at all.

Well, it's always possible something is still lurking in there, but I've already run the ones mentioned above, and the hard disk has been separately put through four different AV programmes, plus Panda on-line scanner.

It behaves in exactly the same way in Safe mode, and also makes no difference if I select traditional or Welcome screen logon with or without Fast User Switching.

And incidentally, if after having selected the user profile at logon you don't type the password in fast enough, it'll reboot on you!

What seems strange is that the machine behaves absolutely normally once you're past the logon point.


ROGER - G0AOZ.

 

[wolluf]

Roger - I saw something very similar (and with a similar background) a couple of years ago - unfortunately I can't remember if I resolved it or left them with a workround! (like setting machine to automatically logon to most used account, so it at least won't reboot on initial logon.) I'm pretty sure I ran the repair reinstall again - but as mentioned, can't say if this resolved it or not.

 

[linney]

You have a very impatient machine there, as well as a bit buggy. Have you tried creating another user to see if the same thing happens to that.

Along the lines of "Wolluf's" post, have you tried, for what it is worth, making users press Ctrl+Alt+Del before being allowed to login. This is set via Group Policy or using Control userpasswords2 from the Start Run box. Interestingly enough this secure login is to prevent programs that mimic login in order to steal password information. I wonder if you have something like that on this machine? Have you checked for any rootkit type of infection?

 

[G0AOZ]

Yes, I did make a new user - didn't make any difference. The problem occurs BEFORE the user actually selects his or her profile. In other words, let the system boot up and sit at the logon screen and don't touch keyboard or mouse, and after about 8 seconds the machine completely reboots all on its own!

You're right about it being a bit buggy, in fact I'm surprised it even works at all after what I've cleaned out of it!

The other strange thing that happened was after the XP Repair it asked to be Activated. Ok, probably not that unusual. As things still didn't seem right I re-ran SP2, and on booting up it asked to be Activated again. Later I installed SP3 as well, and again it wanted Activation!

Anyhow, user was desperate to get it back so I've knocked out the other users who are apparently no longer required. I'll not be surprised to see this machine back in the workshop at some time...

Thanks for your thoughts and suggestions Linney and Wolluf.

ROGER - G0AOZ.

 

[wahnula]

It's like the old Vaudeville schtick:

Man: (to doctor) Doc, it hurts when I do this.
Doctor: Don't do that.



Using TweakUI, set up Auto-logon. To suppress Auto-logon, press the shift key during startup.

Just out of curiosity, does it exhibit the same behavior when a user logs off and just lets the logon screen sit there?

Tony

Users helping Users...

 

[archwayguy]

Did you open MSCONFIG or the registry and look at what is loading on startup? There are some services or "services" (read as malware) that will load on startup before login.

 

[G0AOZ]

With apologies to Wahnula...

Man: (to PC doctor) Doc, it's a real pain to load Windows.
Doctor: Don't use Windows.



Ok about TweakUI. Knocked out the unwanted users now so it rolls straight in. Dunno about a user logging off and leaving at the logon screen. I'm afraid when I was trying to sort it out I was too impatient to let sit there for too long!

Yes, I did very carefully scrutinise MSCONFIG, but nothing out of the ordinary after the machine was cleaned up.

Thanks again for your thoughts guys...

ROGER - G0AOZ.