Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Locked out of all user accounts


  • Please log in to reply
No replies to this topic

#1 snipes420

snipes420

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:41 PM

Posted 17 February 2010 - 01:23 PM

Hi, First time here but big fan.

I have a computer someone brought to me that looked to have some spyware on it and after removing some of the onstartup reg entries it rebooted with some kind of account restrictions.

OS: Windows XP Professional

It keeps saying there is a password but there wasn't any set up before I tried removing the spyware.
I have tried all safe modes and they all still ask for the unknown passwords.
I tried running the nt password changer to set known passwords but that didnt work. It still says the password is wrong.
I used a Winternals ERD Commander cd to perform a system file check and it found that the atapi.sys was corrupted so it fixed it. (more like infected)

I cannot get to any kind of prompt to run any more scans/removal tools.

I have come across about a dozen of this type of infection and unfortunatly the most common way we had to fix it was a backup and then a clean install of the OS. Has anyone actually seen this and found how to correct it?

BC AdBot (Login to Remove)

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users