My PC cannot go past the Log in screen. As soon as I log in, the pc accepts
the password and then immediately logs off again. There is no way for me to
also run any diagnostic program as well to determine the cause.
This actually happens frighteningly often. Iâve encountered it at least
once, and will describe what caused it and what I did to recover.
HoweverâŠ
There are potentially several reasons that this might happen. My specific
example might be an interesting example thatâll help you diagnose your problem
⊠or it might not help at all.
In which case, I have a different suggestion which is what I really recommend
anyway.
]]>
The most common cause for immediate logout on login is that your machine was infected with a virus. And that âwasâ might very well be exactly accurate, because what seems to happen is this:
-
A system file used during login is infected with a virus.
-
Your anti-virus program detects this and removes or quarantines the file so that it can no longer be used.
-
The next time you login, the file required to complete your login is missing (having been removed or quarantined) and you canât login.
Technically, your machine might no longer be infected, but that doesnât matter since you canât login.
There are two approaches to dealing with this problem.
The first and the one that I actually recommend is to reinstall Windows. In a case like this, you may be able to do a ârepairâ reinstall â meaning that Windows will repair itself and replace missing files. This does require that you have your installation media from which to run the reinstall. (Itâs unclear if an OEMâs ârecovery diskâ will work in a situation like this, but if itâs all you have itâs worth a shot.)
Since viruses can be so difficult to eradicate these days, having a good backup and doing a reformat and reinstall is perhaps a painful approach, but is the path most certain to eradicate the problem.
Those are what I recommend.
Now, hereâs what I didâŠ
I fired up a recovery console (also on the Windows installation media), and identified the missing file by comparing the contents of c:\windows and c:\windows\system32 to the same folders on another, working copy of the same version of Windows.
In my case, the missing file was winlogon.exe, and since I was indeed working with two machines that had identical copies of Windows I simply used a USB drive to copy the missing file from the working system. Having done so, I rebooted, successfully logged in, and began a sequence of running the System File Checker, to locate and repair any other missing files, and of course multiple anti-malware scans.
For the record, you can probably do the same without the recovery console using a Linux live CD, such as Ubuntu, Knoppix or others. All you need is something thatâll let you boot from CD, view the hard drive and copy files to it.
You may also be able to do it using your installation media instead of an identically configured system. Once youâve identified the missing file (and that would be the trick without a system to compare to), you may be able to copy the file from the installation media. Since files are typically compressed on the original media (winlogon.ex_ instead of winlogon.exe, for example) you might need to run the recovery console so that you can run the âexpandâ utility to decompress the file.
Ultimately, though, that immediate logout scenario can be a difficult one to identify and clear up. By far the best approach is to be prepared with regular backups and your Windows installation media.
Actually, the best approach is not to let your machine get infected in the first place, of course.
Iâve never seen the problem that Leo identified, but his explanation and remedy, like all his advice, were very coherent and logical.
If it happened to me, I surely would have been lost because I get confused regarding the similar-sounding terms such as ârecovery disk and recovery console.â Iâve been very lucky, I suppose ⊠Iâve never needed to use either one.
I just hope that if I ever have to use any of these repair/recovery/diagnostic utilities, that theyâll give a clear and thorough warning if something Iâm about to try is data-destructive.
In this case, I might have suspected there was something wrong with the user account and I might have tried to log-in as the Administrator to create another account. On the other hand, if the problem file was at the system level (i.e., not account-specific), then I guess I wouldnât succeed at trying to access the Administrator account either.
Thanks, Leo. Great explanation as always, sir.
Been there, done that! I have had this issue off and one for years. (Knock on wood) It has been a long time, since it has happened to me.
In all honesty, the âsymptomsâ may not be due to an infection, just that the âboot command systemâ has been corrupted, for several reasons. The probably of an infection is very high, though.
Must admit, since the last time this happened, I re-formatted my hard drive and installed Windows XP Pro under the NTFS mode and havenât had any trouble since. That doesnât mean that it couldnât happen, just that NTFS mode is a more solid operating system.
One factor that I have made note of in my experience, is that I have had the biggest problems when I had my computer initially operating with Windows 98SE and then upgrade to Windows XP Pro. It was this combination of operating systems that seem to cause me the issue of not being able to âlog onâ. I would look for the culprit and usually found that several of my boot commands were âmissingâ and these boot commands were from Windows 98SE, the whole basis of my operating system.
Again, since only re-installing Windows XP Pro in the NTFS mode, I havenât had any problems, logging in or any real issues to date.
I totally agree with Tony, excellent explanation Leo, as always.
There is one more possible cause if you are on a corporate network (rather than a single, home PC).
Years ago, back in the dawn of computing, we used to do the same thing to friends who left their computer logged on and un-attended. On a network (or mainframe session) there is often some sort of âstartupâ file equivalent to the DOS Autoexec.bat.
So we would edit their login file and add the âlogoffâ command. So their computer would get part of the way through the boot process then shut down. Sure, it was a very âscript-kiddieâ sort of thing to do but it was good for a giggle. Usually you would have to get an administrator to clean up the problem. Which also meant having to explain why you left your computer unattended.
I would go to safe mode login as adminstrator go to usser account and then delete my login password and then reboot normally to windows and then run antivirus full system scan [ which i could have doen it in a safe mode too ]
the 2th thing i would do is to run sfc/scannow in case some system files are missing or corrupt because virus infection [ like mr. leo suggest]
so i would roll out reinstalling windows at first
Check out this method as well which talks about having an infected userinit.exe file which is used at login to get things started such as your network connection and starting the Windows shell.
http://www.onlinecomputertips.com/windows/wq88.html
Seen the problem and booting from the Dell Win XP recovery CD and running a ârepairâ (NOT the âConsoleâ repair) took care of the problem.
I had the same problem after I was trying to manually get rid of a root kit. I guess I deleted the wrong file. I couldnât even get into safe mode. I reformatted and reinstalled windows from my backups. Only time was lost. Can I backup the win login file and use it if I need to a year later? I mean does it ever change?
10-Apr-2011