+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 17
Windows Thread, Windows XP - immediately logs user off after logon in Technical; I was asked to have a look at a laptop by somebody as a favour. This laptop is used by ...
  1. #1

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,592
    Thank Post
    109
    Thanked 770 Times in 598 Posts
    Rep Power
    183

    Windows XP - immediately logs user off after logon

    I was asked to have a look at a laptop by somebody as a favour. This laptop is used by the guys kid and I'm pretty sure he's picked up a load of malware or a virus.

    The laptop is running XP Pro and it boots up OK and presents you with the Welcome screen. Selecting the user then pops up the loading user settings message and then immediately displays the saving settings and logging off messages

    I've run ClamAV across it (from Knoppix) and deleted a load of adware. I've also used an offline registry editor to check the Winlogon keys for dodgy entries. It still doesn't work!

    It's really go t me stumped now this but curiosity has got the better of me and I don't just want to wipe it and start again.

  2. #2

    SYNACK's Avatar
    Join Date
    Oct 2007
    Posts
    11,239
    Thank Post
    882
    Thanked 2,742 Times in 2,316 Posts
    Blog Entries
    11
    Rep Power
    784
    Use the UBCD4Win and the spyware tools from that to give it another good clean as ClamAV misses lots then boot into safemode command prompt and run an "SFC /scannow" on it.

  3. #3

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,592
    Thank Post
    109
    Thanked 770 Times in 598 Posts
    Rep Power
    183
    Quote Originally Posted by SYNACK View Post
    Use the UBCD4Win and the spyware tools from that to give it another good clean as ClamAV misses lots then boot into safemode command prompt and run an "SFC /scannow" on it.
    Forgot to mention that Safe Mode with Command Promt exhibits the same behaviour!

  4. #4

    mac_shinobi's Avatar
    Join Date
    Aug 2005
    Posts
    9,897
    Thank Post
    3,419
    Thanked 1,081 Times in 997 Posts
    Rep Power
    369
    Microsoft: Windows XP Pro - Log in Logs straight back Out

    Logic Nest · Windows XP Login Logout Loop (Virus)

    Quote Originally Posted by above url
    Logon - Logoff loop, also caused by BlazeFind
    Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.
    Here is the solution to the logon - logoff issue in Windows XP.
    Enter the Recovery Console
    Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)
    Type the following command and press Enter.
    CD SYSTEM32
    (If that does not work, try CHDIR SYSTEM32)
    COPY USERINIT.EXE WSAUPDATER.EXE
    Quit Recovery Console by typing EXIT and restart Windows.
    You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)
    Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.



    Windows XP logs in then logs off : logs, off, windows, xp
    Last edited by mac_shinobi; 6th March 2009 at 09:11 AM.

  5. #5
    ninjabeaver's Avatar
    Join Date
    Jun 2005
    Location
    Norfolk
    Posts
    1,090
    Thank Post
    183
    Thanked 100 Times in 88 Posts
    Rep Power
    46
    Malbytes Anti-Malware fixes a shedload of stuff like that, even if you have to slave the drive onto another system.

    Malwarebytes.org

  6. #6

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,592
    Thank Post
    109
    Thanked 770 Times in 598 Posts
    Rep Power
    183
    @mac_shinobi: I've checked for that registry entry using an offline registry editor and the entry hasn't been changed.

  7. #7

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,265
    Thank Post
    242
    Thanked 1,575 Times in 1,254 Posts
    Rep Power
    341
    I would say definitely a profile related issue. Logon using the local administrator account, copy documents, favourites etc, delete the user and re-create the user, which will create a new profile.

    It may or it may not be spyware related in my experience...

  8. #8

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,592
    Thank Post
    109
    Thanked 770 Times in 598 Posts
    Rep Power
    183
    Quote Originally Posted by Michael View Post
    I would say definitely a profile related issue. Logon using the local administrator account, copy documents, favourites etc, delete the user and re-create the user, which will create a new profile.

    It may or it may not be spyware related in my experience...
    Did I forget to mention that the exact same thing happens with the Adminstrator account?

  9. #9

    Join Date
    May 2007
    Location
    Birmingham
    Posts
    40
    Thank Post
    1
    Thanked 5 Times in 4 Posts
    Rep Power
    16
    Backup and reinstall Windows, probably quicker than trying to repair!

  10. #10

    plexer's Avatar
    Join Date
    Dec 2005
    Location
    Norfolk
    Posts
    13,573
    Thank Post
    721
    Thanked 1,683 Times in 1,498 Posts
    Rep Power
    432
    Has something gone wrong with the activation of it?

    Ben

  11. #11

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,265
    Thank Post
    242
    Thanked 1,575 Times in 1,254 Posts
    Rep Power
    341
    That is very strange then Ric_, not seen that happen before. Maybe time to call it a day and extract the hard drive and copy documents etc.. then re-install as new. I can't see how else you can resolve this if you cannot logon as the local administrator!

  12. #12

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,592
    Thank Post
    109
    Thanked 770 Times in 598 Posts
    Rep Power
    183
    Quote Originally Posted by chippo View Post
    Backup and reinstall Windows, probably quicker than trying to repair!
    Probably but, like I said, curisity has got the better of me and I want to know what has happened.

  13. #13

    mac_shinobi's Avatar
    Join Date
    Aug 2005
    Posts
    9,897
    Thank Post
    3,419
    Thanked 1,081 Times in 997 Posts
    Rep Power
    369
    I came across this a few years ago will look into it further and find the article I was after later on and will post back.

  14. #14

    RabbieBurns's Avatar
    Join Date
    Apr 2008
    Location
    Sydney
    Posts
    5,531
    Thank Post
    1,341
    Thanked 470 Times in 307 Posts
    Blog Entries
    6
    Rep Power
    200
    I have seen this before.

    Boot from a xp cd (or equivelent) and copy the files from c:\windows\repair to c:\windows\system32

  15. #15

    mac_shinobi's Avatar
    Join Date
    Aug 2005
    Posts
    9,897
    Thank Post
    3,419
    Thanked 1,081 Times in 997 Posts
    Rep Power
    369
    How to fix the Log On/Log Off Loop in Windows XP | eHow.com

    As per that above guide you need to replace the userinit.exe file and the other exe file and double check the registry entries are typed correctly ( no typos etc )

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Office installs when a new user logs on
    By Maximus in forum Wireless Networks
    Replies: 7
    Last Post: 11th July 2008, 10:54 AM
  2. Ranger - Asks for a driver every time a user logs on
    By FN-GM in forum Network and Classroom Management
    Replies: 14
    Last Post: 8th December 2007, 02:41 PM
  3. NSS 9 - tutor PCs need setup for every user that logs on.
    By Halfmad in forum Network and Classroom Management
    Replies: 4
    Last Post: 23rd August 2007, 03:16 PM
  4. Intermittant error when user logs into SIMS
    By Gatt in forum MIS Systems
    Replies: 6
    Last Post: 14th February 2007, 05:52 PM
  5. Replies: 7
    Last Post: 30th November 2006, 06:57 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •