Solved Win7 Logs In, Then Out Suddenly

[MistUnleashed]

Hi Everyone! I've offered to help a family member with a rather peculiar issue with their PC. Let me outline it as simply as I can:

Their PC OS: Win7 Ultimate 32bit

There's 4 users: Dad, Mum, Kid 1, Kid 2 - Dad and Mum have 'admin' accounts, kids have 'standard' accounts

On the welcome screen if you click on any of: Dad, Kid 1 or Kid 2's user accounts, windows logs in the logs out straight away going back to the welcome screen. However if you enter the 'Mum' account a black screen is displayed and an error message shows relating to a dll file (can't remember the exact name - will update this later).

Now if I restart the PC into Safe Mode, I still cannot log into the other 3 accounts but this time I am able to successfully enter the 'Mum' account.

I've searched around and so far i've done the following:

1. Run a Malwarebytes Scan (Deleted a few pieces of malware it found)
2. Gone into regedit and looked under HKLM/Software/.../Winlogon and checked Shell & Userinit values.

What else can I do? Any help is appreciated!

 

[NoelDP]

Check Device Manager for problems.

 

[GokAy]

Hey Mist,
Try:
- sfc scan http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
- clean startup - http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html
- System Restore - http://www.sevenforums.com/tutorials/700-system-restore.html
- check HDD health with manufacturer's tools

If everything fails - consider repair install - http://www.sevenforums.com/tutorials/3413-repair-install.html

 

[MistUnleashed]

Check Device Manager for problems.

Device manager's all clear Noel! No issues at all.

Hey Mist,
Try:
- sfc scan http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
- clean startup - http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html
- System Restore - http://www.sevenforums.com/tutorials/700-system-restore.html
- check HDD health with manufacturer's tools

If everything fails - consider repair install - http://www.sevenforums.com/tutorials/3413-repair-install.html

1. Tried SFC but it keeps saying it found problems but couldn't fix them.
2. Already Done a clean start-up - I couldn't log into the 'Mum' account before (even in safe mode) but after a clean restart I managed to access it in safe mode.
3. No restore points unfortunately!
4. Hard Drive health is fine, I used the manufacturers tools to run diagnostics.

---

I am now going through the Event Viewer as this tends to be good for picking out issues.

It keeps showing a DCOM error '1084' for various services such as 'TermService'

I also notice that between the Log-On and Log-Off events there are 3 McAfee events that occur. Could the problem be with the AV software?

 

[GokAy]

Can be: try uninstalling McAfee.
You can get errors/warnings for services when started in Safe Mode (due to them not being able to start).

in cmd:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >"%userprofile%\desktop\sfcdetails.txt"

Attach the sfcdetails.txt please

 

[GokAy]

By the way:

How did you configure a clean startup when it was not possible to login? msconfig work outside of Windows? I couldn't get it to work from PE. Really wish to learn about this

 

[MistUnleashed]

By the way:

How did you configure a clean startup when it was not possible to login? msconfig work outside of Windows? I couldn't get it to work from PE. Really wish to learn about this

My bad! I put it under the wrong number!

I meant after the first time I ran SFC, then I could access the 'Mum' account in Safe Mode: so AFTER this I did the Clean Start-Up.

Sorry, my bad!

 

[MistUnleashed]

Can be: try uninstalling McAfee.
You can get errors/warnings for services when started in Safe Mode (due to them not being able to start).

in cmd:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >"%userprofile%\desktop\sfcdetails.txt"

Attach the sfcdetails.txt please

Attached the CBS Log.

Please note I've just ran a new SFC to get a fresh log.

 

[GokAy]

Nothing wrong with sfc, usual corruption which is actually not a corruption

Did you try uninstalling McAfee yet?

 

[NoelDP]

There are actually a few problems in the CBS.log

Line 37: 2015-09-09 18:18:09, Error                 CBS    Failed to parse package manifest: \\?\C:\Windows\Servicing\Packages\Package_2_for_KB2846071~31bf3856ad364e35~x86~~9.4.1.0.mum [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
	Line 38: 2015-09-09 18:18:09, Error                 CBS    Failed to resolve package 'Package_2_for_KB2846071~31bf3856ad364e35~x86~~9.4.1.0' [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
	Line 49: 2015-09-09 18:18:09, Error                 CBS    Failed to internally open package. [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
Se

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your reply.

 

[MistUnleashed]

Nothing wrong with sfc, usual corruption which is actually not a corruption

Did you try uninstalling McAfee yet?

Not yet, will do that and let you know what happens. Could it honestly just be the AV software not letting me log into any account but the Mum's account?

There are actually a few problems in the CBS.log

Line 37: 2015-09-09 18:18:09, Error                 CBS    Failed to parse package manifest: \\?\C:\Windows\Servicing\Packages\Package_2_for_KB2846071~31bf3856ad364e35~x86~~9.4.1.0.mum [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
    Line 38: 2015-09-09 18:18:09, Error                 CBS    Failed to resolve package 'Package_2_for_KB2846071~31bf3856ad364e35~x86~~9.4.1.0' [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
    Line 49: 2015-09-09 18:18:09, Error                 CBS    Failed to internally open package. [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
Se

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your reply.

I will attach my results as soon as it finishes installing. Thanks for your help with this!

 

[NoelDP]

Nothing wrong with sfc, usual corruption which is actually not a corruption

Did you try uninstalling McAfee yet?

Not yet, will do that and let you know what happens. Could it honestly just be the AV software not letting me log into any account but the Mum's account?

McAfee can have many unforeseen side-effects.
Once you've uninstalled it, you must run their cleanup tool as well...
Download the McAfee removal tool from:

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Click Save, and save the file to a folder on your computer.
Navigate to the folder where you saved the file.
right-click on MCPR.exe and select 'Run as Administrator' to run the removal tool.

when complete, reboot.
After the reboot, open an Elevated Command Prompt, and run the following command

NETSH WINSOCK RESET

You'll be advised to reboot - do so.

 

[MistUnleashed]

Nothing wrong with sfc, usual corruption which is actually not a corruption

Did you try uninstalling McAfee yet?

Not yet, will do that and let you know what happens. Could it honestly just be the AV software not letting me log into any account but the Mum's account?

McAfee can have many unforeseen side-effects.
Once you've uninstalled it, you must run their cleanup tool as well...
Download the McAfee removal tool from:

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Click Save, and save the file to a folder on your computer.
Navigate to the folder where you saved the file.
right-click on MCPR.exe and select 'Run as Administrator' to run the removal tool.

when complete, reboot.
After the reboot, open an Elevated Command Prompt, and run the following command

NETSH WINSOCK RESET

You'll be advised to reboot - do so.

Wow so a few things happened. First I updated the graphics driver (I thought this was causing the issue) - Successfully updated but still couldn't log on. Then I uninstalled McAfee and used the Removal tool you gave me Noel.

Also, sorry Noel but I ran CCleaner after the Windows Update you sent me and it deleted the log!

I restarted and Voila! I could log into both the Mum and Dad account fine and it wasn't logging out again, but this is only half of the problem fixed.

I still could not log into the Kid 1 and Kid 2 accounts.

I have noticed that Mum and Dad are both 'Administrator' accounts and the kids are 'Standard' accounts. What on earth is going on?

Thanks Guys

 

[GokAy]

Maybe the Winlogon registry key permissions got broken?
- Open registry and browse to HKLM\Software\Microsoft\Windows NT\CurrentVersion
- Right click Winlogon and Permissions.
- See if Users group has Read rights. (System, Admins and TrusterInstaller are all Full Control).

 

[MistUnleashed]

Maybe the Winlogon registry key permissions got broken?
- Open registry and browse to HKLM\Software\Microsoft\Windows NT\CurrentVersion
- Right click Winlogon and Permissions.
- See if Users group has Read rights. (System, Admins and TrusterInstaller are all Full Control).

1 Second, i'll try this now.

 

[MistUnleashed]

Maybe the Winlogon registry key permissions got broken?
- Open registry and browse to HKLM\Software\Microsoft\Windows NT\CurrentVersion
- Right click Winlogon and Permissions.
- See if Users group has Read rights. (System, Admins and TrusterInstaller are all Full Control).

Yes i've just checked, the Users group does have Read rights and the other 3 have Full Control.

For the meantime i've changed the Kid accounts to 'Administrator' and I can access them so the problem is definitely to do with the 'Standard' User Accounts.

Any ideas?

 

[GokAy]

Also check userinit permissions C:\Windows\System32\userinit.exe
Same users but all have "Read & Execute" and "Read" rights while TrustedInstaller is "Full Control".

Explorer.exe has same permissions, located under Windows.

 

[MistUnleashed]

Also check userinit permissions C:\Windows\System32\userinit.exe
Same users but all have "Read & Execute" and "Read" rights while TrustedInstaller is "Full Control".

Explorer.exe has same permissions, located under Windows.

Checked them both, all is fine.

Anything else I could try?

 

[GokAy]

It is certainly a permission/rights issue somewhere since same account logs in fine once given admin rights.

Can you try creating a new standard user account? Lets see if the issue persists with a new account.

 

[MistUnleashed]

It is certainly a permission/rights issue somewhere since same account logs in fine once given admin rights.

Can you try creating a new standard user account? Lets see if the issue persists with a new account.

Yes the issue still persists with this new account. So you're probably right saying its a permissions issue.