How to fix the Log on Log Off Immediately Issue
By Lee Brannon
How to fix the Log on Log Off Immediately Issue
Warning:
The recommended solution to this problem is a set of tools and
instructions provided on another site.
Part of the solution involves the erasing of system files and an
automated registry change. GizGadMo is not affiliated with the site in any
manner and GizGadMo makes no guarantee or warranty concerning the use of this
information.
Recently I was given a laptop with Windows XP Professional that had a peculiar
problem. As soon as the user logged
in with any account on the machine it automatically logged them back off. The same issue occurred when booting
to safe mode. Running a recovery CD
and doing a system repair did not clear the problem either.
There was simply no way to login to Windows and fix the problem.
Attempts to manage the computer remotely with Computer Management after joining
one of my systems to the same workgroup failed also,
A search on the net revealed hundreds of people with the same issue and
unfortunately hundreds of blogs and chat board post with bad information. The few post I found with realistic
suggestions explained the issue as a registry modification.
Apparently there are certain spyware programs that change a registry entry to
point to a different file than one that is suppose to be read on login. This can cause the problem and it
can be compounded by the fact that an antivirus or antispyware program will
catch the phoney file and remove it, but not correct the registry entry.
This is a complicated problem. You can’t login. That means that you cannot reload a recovery point. It also means that you can’t run
Anti virus and Anti spyware programs since most need to be run from within
Windows. Worse still regedit does
not run from the command prompt of a standard Windows XP recovery console so
there is just no easy way to get the problem fixed.
It may be possible to correct the problem by completely reinstalling Windows XP,
but that would mean data loss, documents, pictures etc. would be gone or have to be restored from a backup
Those of you smart enough and lucky enough to have an imaging backup system like Livestate (Symantec Backup Exec
System Recovery) could do a complete image restore, but the average home and
business computer does not have such a system installed.
So, how do you fix it?
Several sites recommended downloading various boot CD’s (almost all for a fee)
These downloads were usually linux based boot up CD’s from an ISO image that you
had to burn. You could
then run an included registry
editor or use some form of DOS like editor to manually correct the issue. This involves making some HKEY
changes in the registry to point to the correct file (provided that the correct
file is still there). Then if you
are able to login you must immediately obtain some anti-spyware that will remove
the cause of the problem, install it and clean your machine. This last part may
be harder than you think since none of these solutions have a way for you to
identify exactly what was infecting your machine.
I was in the process of setting up a CD and going through this long complicated
process when I discovered a blog site that had a specific simplified answer to
the problem. The blog
entitled “Thinking in Pixels” is written by Dan Fischbauch and his specific
instructions are simplified and broken down into easy to follow detail steps. There are seven short “pages” or
blocks. The page list shows 11, but
that’s because pages 8 through 11 contain the old manual instructions he had
posted previously. The instructions
are very good and broken down into several short blocks or steps, but
unfortunately they are so simplified that the “general idea” of what the steps
are for are not there.
“General Idea” - Overview of process: In general, you are going to create
two CD’s from ISO images. (Instructions for doing this are available as a link
in the steps if you have not done it before. Downloading and burning the ISO
images should only take a few minutes if you are on a high speed connection.)
The first CD is used to boot up your computer to a point where you can run his
removal tools, which are on the second CD. This bootup process is going to bring
up a Vista install screen. Ignore the fact that it says Vista, Also keep in mind that you are not installing Vista, you are just using this to get to the command prompt of the
computer. The second CD is going to
erase some files that may be corrupted
or infected and then replace them.
It will then edit the registry.
During this process it will prompt you to select the usernames for a
couple of profiles to fix. Once
this is done it will load and run an anti spyware program to remove the cause of
the problem. I was happy to see
that the program it uses is Spybot Search and Destroy. A program that I often use already.
Note: The Spybot Search and Destroy scan is going to take a long time. It
will scan every file on your system. Let it run completely. When it starts up go pop some popcorn and
watch a movie.
Once you have completed the scan you should be able to reboot your computer and
load it into Safe Mode. The
instructions at this point recommend that you login using safe mode and install
an anti spyware program and scan the machine again. The instructions Dan has
provided include links to about a dozen very good anti virus and anti spyware
programs.
Once all of this is done your normal login should work. .
The Laptop that was brought to me? Cleaned easy and smooth. Works great now. The Spybot program found and removed
a program called Smitfraud-C. Doing
a google search on the name will net you mutiple thousands of people asking for
help on how to get rid of it. A second scan using Malwarebytes (now that I could
login) found two other problems,
Multiple instances of Tojan.Zlob and one Adware.PopCap.
To get Dan’s blog page of instructions entitled “Fix
Windows XP Log On/Log Off Loop” go to
http://thinkinginpixels.com/quick-fixes/fix-windows-xp-log-onlog-off-loop/
Warning:
The recommended solution to this problem is a set of tools and
instructions provided on another site.
Part of the solution involves the erasing of system files and an
automated registry change. GizGadMo is not affiliated with the site in any
manner and GizGadMo makes no guarantee or warranty concerning the use of this
information.
Got questions? Drop a message into
the forum or send me an email through the contact page.
