Windows XP - immediately logs user off after logon

I was asked to have a look at a laptop by somebody as a favour. This laptop is used by the guys kid and I'm pretty sure he's picked up a load of malware or a virus.

The laptop is running XP Pro and it boots up OK and presents you with the Welcome screen. Selecting the user then pops up the loading user settings message and then immediately displays the saving settings and logging off messages :rolleyes:

I've run ClamAV across it (from Knoppix) and deleted a load of adware. I've also used an offline registry editor to check the Winlogon keys for dodgy entries. It still doesn't work!

It's really go t me stumped now this but curiosity has got the better of me and I don't just want to wipe it and start again.

Use the UBCD4Win and the spyware tools from that to give it another good clean as ClamAV misses lots then boot into safemode command prompt and run an "SFC /scannow" on it.

Quote:

---

Originally Posted by SYNACK

Use the UBCD4Win and the spyware tools from that to give it another good clean as ClamAV misses lots then boot into safemode command prompt and run an "SFC /scannow" on it.

---

Forgot to mention that Safe Mode with Command Promt exhibits the same behaviour!

Microsoft: Windows XP Pro - Log in Logs straight back Out

Logic Nest · Windows XP Login Logout Loop (Virus)

Quote:

---

Originally Posted by above url

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

---

Windows XP logs in then logs off : logs, off, windows, xp

Malbytes Anti-Malware fixes a shedload of stuff like that, even if you have to slave the drive onto another system.

Malwarebytes.org

@mac_shinobi: I've checked for that registry entry using an offline registry editor and the entry hasn't been changed.

I would say definitely a profile related issue. Logon using the local administrator account, copy documents, favourites etc, delete the user and re-create the user, which will create a new profile.

It may or it may not be spyware related in my experience... :)

Quote:

---

Originally Posted by Michael

I would say definitely a profile related issue. Logon using the local administrator account, copy documents, favourites etc, delete the user and re-create the user, which will create a new profile.

It may or it may not be spyware related in my experience... :)

---

Did I forget to mention that the exact same thing happens with the Adminstrator account?

Backup and reinstall Windows, probably quicker than trying to repair!

Has something gone wrong with the activation of it?

Ben

That is very strange then Ric_, not seen that happen before. Maybe time to call it a day and extract the hard drive and copy documents etc.. then re-install as new. I can't see how else you can resolve this if you cannot logon as the local administrator!

Quote:

---

Originally Posted by chippo

Backup and reinstall Windows, probably quicker than trying to repair!

---

Probably but, like I said, curisity has got the better of me and I want to know what has happened.

I came across this a few years ago will look into it further and find the article I was after later on and will post back.

I have seen this before.

Boot from a xp cd (or equivelent) and copy the files from c:\windows\repair to c:\windows\system32

How to fix the Log On/Log Off Loop in Windows XP | eHow.com

As per that above guide you need to replace the userinit.exe file and the other exe file and double check the registry entries are typed correctly ( no typos etc )