WinXP Home logs off while user attempts logon

[andyshriver]

I am working on some friends' Dell Dimension 2350 loaded with Win XP Home. These folks aren't that computer-savvy, as it appears as though they only have SP1 installed. To compound matters, it seems that one of the offspring bypassed a malware warning from (I believe) McAfee Antivirus, and the unit immediately (as I understand it) shut down. Every subsequent attempt to log on, regardless of user profile, ends the same way: the desired user's icon is clicked, the system appears to begin the logon process, and then the system immediately begins logging off, saving settings, etc. I set up a dual-boot scenario, but every attempt at virus detection, including the MS Malicious Software Detection Tool, bore no fruit. Does ANYONE have any recommendations? Please bear in mind that the typical "format and reinstall Windows" recommendation is NO option. I thank you all in advance for your input.

 

[linney]

Some things for you to look at.

Logon - Logoff loop, also caused by BlazeFind

http://www.winxptutor.com/wsaremove.htm

http://www.paulscomputerservice.net/index.php?body=./os/autoLogoff.php

Log in Logs straight back Out
Thread779-924408

logs you on loads personal settings then logs you off?
Thread779-919265

A second reason can be security policy settings:

http://www.exodus-dev.com/techtips/windows_xp_pro_login_problems.htm

HOW TO: Install and Use the Recovery Console for Windows XP (Q307654)

http://support.microsoft.com/support/kb/articles/q307/6/54.asp

Try running ChkDsk /r from the Recovery Console.

An easy to follow recovery console description when unable to start computer due to corrupt registry.

http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot_toot.htm

This is a layman's version of Q307545 in simple language.

Removing adware & spyware
FAQ608-4650

 

[satrow]

Hmm, have you tried to boot into Safe Mode and clean it yet?

If you can get to the Run menu in normal mode, type 'shutdown -a' and click ok, that may stop it shutting down so you can fix it.

OK, after a quick Google, it sounds a lot like Sasser/Msblast/W32 Blaster - see

http://www.sophos.com/support/disinfection/blastera.html

 

[barny2006]

you may have a nasty virus called gaelicum.exe accompanied by dl.exe.
the only anti-virus software that i have seen to be able to remove these is vcleaner.exe, a single purpose killer from avg, and the other one nod32. nod32 is expensive but vcleaner.exe is free. you can get vcleaner.exe from here:

http://www.grisoft.com/doc/112/lng/us/tpl/tpl01

 

[andyshriver]

I thank you all for your input - sorry to have not replied sooner. I am running vcleaner right now (thank you, barny2006), but, should that not eradicate the problem, I will opt for more labor intensive methods such as those specified in linney's post. To clarify, the machine exhibits the same behavior in Safe Mode as in Normal startup mode, so getting to the Run menu is impossible. Incidentally, I am running vcleaner from a parallel installation (dual-booting WinXP). I do not know if this will work, but I thought I should mention it. Thanks again for everone's input - I'll keep you all posted.