XP logs user off immediately when the user tries to log in - can't get to any desktop
System boots to the Welcome screen. As soon as user clicks on any account, the text next to the icon says "Logging in", and a second later changes to "Saving Data" and "Logging out", and then returns to the Welcome screen. This also occurs in Safe Mode and Safe Mode with Command Prompt.
Blazefind (mal-ware) adds a file "wsaupdater.exe" to %systemroot %\system32\ directory and then makes a registry change to point the registry to "wsaupdater.exe" instead of "userinit.exe", a file needed to log into user accounts. It does not erase "userinit.exe", merely causes the system to ignore it and use its own adware file instead. When a customer uses certain adware removal programs in an attempt to clean the system, the wsupdater.exe file is identified and removed but the registry is still set to use it. Without the userinit-replacement present, the above symptoms manifest.
Resolution :
Enter the Recovery Console by choosing 'R' at the Welcome to Setup screen. at the prompt, type
CD \ >> <ENTER>
CD C:\WINDOWS\SYSTEM32 >> <ENTER>
COPY USERINIT.EXE WSAUPDATER.EXE >> <ENTER>
EXIT >> <ENTER>
The computer should be able to turn on normally if not, try the snapshot(system restore) method. if the system has turned on fine try the below mentioned step.
Start >> Run >> Regedt32
HKEY_LOCAL_MACHINE >> SOFTWARE >> MICROSOFT >> WINDOWS NT >> CURRENTVERSION >> WINLOGON
Look for "UserInit" in the right side. It should have a value of "C:\WINDOWS\system32\wsaupdater.exe," (there is a comma at the end of the value). Double-click on "UserInit" and carefully change its value to "C:\WINDOWS\system32\userinit.exe," Click OK.
Exit Registry Editor.
Restart the Computer.