Windows XP - immediately logs user off after logon

[Ric_]

I was asked to have a look at a laptop by somebody as a favour. This laptop is used by the guys kid and I'm pretty sure he's picked up a load of malware or a virus.

 

The laptop is running XP Pro and it boots up OK and presents you with the Welcome screen. Selecting the user then pops up the loading user settings message and then immediately displays the saving settings and logging off messages

 

I've run ClamAV across it (from Knoppix) and deleted a load of adware. I've also used an offline registry editor to check the Winlogon keys for dodgy entries. It still doesn't work!

 

It's really go t me stumped now this but curiosity has got the better of me and I don't just want to wipe it and start again.

[SYNACK]

Use the UBCD4Win and the spyware tools from that to give it another good clean as ClamAV misses lots then boot into safemode command prompt and run an "SFC /scannow" on it.

[Ric_]

Use the UBCD4Win and the spyware tools from that to give it another good clean as ClamAV misses lots then boot into safemode command prompt and run an "SFC /scannow" on it.

 

Forgot to mention that Safe Mode with Command Promt exhibits the same behaviour!

[mac_shinobi]

Microsoft: Windows XP Pro - Log in Logs straight back Out

 

Logic Nest · Windows XP Login Logout Loop (Virus)

 

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32

(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

 

 

Windows XP logs in then logs off : logs, off, windows, xp

Edited March 6, 2009 by mac_shinobi

[ninjabeaver]

Malbytes Anti-Malware fixes a shedload of stuff like that, even if you have to slave the drive onto another system.

 

Malwarebytes.org

[Ric_]

@mac_shinobi: I've checked for that registry entry using an offline registry editor and the entry hasn't been changed.

[Michael]

I would say definitely a profile related issue. Logon using the local administrator account, copy documents, favourites etc, delete the user and re-create the user, which will create a new profile.

 

It may or it may not be spyware related in my experience...

[Ric_]

I would say definitely a profile related issue. Logon using the local administrator account, copy documents, favourites etc, delete the user and re-create the user, which will create a new profile.

 

It may or it may not be spyware related in my experience...

 

Did I forget to mention that the exact same thing happens with the Adminstrator account?

[chippo]

Backup and reinstall Windows, probably quicker than trying to repair!

[plexer]

Has something gone wrong with the activation of it?

 

Ben

[Michael]

That is very strange then Ric_, not seen that happen before. Maybe time to call it a day and extract the hard drive and copy documents etc.. then re-install as new. I can't see how else you can resolve this if you cannot logon as the local administrator!

[Ric_]

Backup and reinstall Windows, probably quicker than trying to repair!

 

Probably but, like I said, curisity has got the better of me and I want to know what has happened.

[mac_shinobi]

I came across this a few years ago will look into it further and find the article I was after later on and will post back.

[RabbieBurns]

I have seen this before.

 

Boot from a xp cd (or equivelent) and copy the files from c:\windows\repair to c:\windows\system32

[mac_shinobi]

How to fix the Log On/Log Off Loop in Windows XP | eHow.com

 

As per that above guide you need to replace the userinit.exe file and the other exe file and double check the registry entries are typed correctly ( no typos etc )

[Ric_]

Copying the userinit.exe file back again fixed the problem... should have tried that before

[Michael]

Just to add to this, I had a customer yesterday with the exact same problem.

 

In the end I had to extract the hard drive and install it as a slave drive, then load up the Registry hive using this guide. Interestingly when navigating to the

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

 

The Userinit entry was there, but the value was completely blank! It clearly creates the same problem as removal of the spyware itself.

 

I then entered the value:

C:\WINDOWS\system32\userinit.exe,

 

and then unloaded the hive which solved the problem. Interesingly Microsoft themselves don't seem to document this technique.