Hi BOAC. Sorry, been busy for a while..
I am assuming that you are not logging onto a domain with group policies.
Always happy to be proved wrong, means I learn something, but I maintain that there is no all users ntuser.dat. I used to earn a living doing mass deployments of Windows desktops fully customised so I have a great deal of experience with user profiles and have yet to see NTUSER.DAT for all users. NTUSER.POL (group policies for all users) but not NTUSER.DAT.
It is possible to manually create a profile with the settings you want and then copy it to all users, which will then create NTUSER.DAT in the all users directory, but even then, this is simply merged with your HKCU when loaded. You can then modify any key you have permissions to which is why "all users" software settings should be stored in HKLM where you would not normally have permission to change them.
You can check easily enough.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist
This key shows you every file loaded in the registry - where each hive has been loaded from. You can also simply browse c
documents and settings\all users ensuring that you are not hiding system and hidden files (Tools->Folder Options->View).
Anyway, it's a moot point as the only places that stuff loads from the registry, ignoring services and drivers, is HKCU and HKLM.
As I've said a couple of times before, Hijackthis is the best tool I know for showing everything that loads and where from. The other key point is, despite what others have said, that only devices and services load before you log on. The load behaviour is clearly shown in the technet article, and more simply in the Wiki, in my previous posts.
So, back to your problem. It is strange behaviour and Mr Optimistic seems to have the best bet so far. Something loading after you log in (and therefore probably loaded from HKCU, HKLM or a startup group) that is interfering with other applications loading. Most likely some sort of malware protection.
Hope this helps
Cheers
Simon