HALP!! Win xp passwords change all by themselves

Doomer

Diamond Member
Dec 5, 1999
3,721
0
0
Locking me out of the computer of course. Both the Admin and the user PW's are changing. I hack back into the Admin account and change the PW's back to what they are suposed to be and then a day or so later, they change again. Gone through this 4 times now. :(

Does this sound like viral behavior or has Windows itself been known to do this?
 

C1

Platinum Member
Feb 21, 2008
2,400
117
106
I never use password, but I do have a similar (but less serious) issue with my power setting for the monitor intermittently getting set to "never".

Maybe try something like this:
- Create a new account and make it administrative
- Delete the problematic account

(Note: Windows requires at least one account to be administrative)

http://www.kellys-korner-xp.com/win_xp_passwords.htm
 
Last edited:

Bubbaleone

Golden Member
Nov 20, 2011
1,803
4
76
Locking me out of the computer of course. Both the Admin and the user PW's are changing. I hack back into the Admin account and change the PW's back to what they are suposed to be and then a day or so later, they change again. Gone through this 4 times now. :(

Does this sound like viral behavior or has Windows itself been known to do this?

In all the years I ran XP I never encountered this problem, but an educated guess says you had better run a thorough scan for malware/virus/rootkit/bootkit, PDQ! Malwarebytes has a good rootkit scanner, and BleepingComputer's Combofix is another good tool, as is Kaspersky's TDSSKiller. You can download all three of those (and more) from bleepingcomputer.com.

.
 

corkyg

Elite Member | Peripherals
Super Moderator
Mar 4, 2000
27,370
240
106
Yeah - you got a good dose of malware.
 

Matt1970

Lifer
Mar 19, 2007
12,320
3
0
Yes! did get one like this once.and the best is to Wipe.

It all depends on how much extra stuff you have installed. If you run Malwarebytes, Spybot, Super Anti-Spyware and then finally Combo Fix you will be in the high 90% range of success.

It can sometimes take a lot longer to install updates and your programs.
 

Ketchup

Elite Member
Sep 1, 2002
14,559
248
106
It all depends on how much extra stuff you have installed. If you run Malwarebytes, Spybot, Super Anti-Spyware and then finally Combo Fix you will be in the high 90% range of success.

It can sometimes take a lot longer to install updates and your programs.

I always take the preference of the customer/friend/relative. Removing some malware can take quite a bit of work, but at Matt said, a clean install of windows, apps,updates, and file restoration ain't no pick-nick either.
 

paul878

Senior member
Jul 31, 2010
874
1
0
I have never seen anything like that, are you sure you don't have a keyboard problem?
 

lxskllr

No Lifer
Nov 30, 2004
60,330
10,739
126
I always take the preference of the customer/friend/relative. Removing some malware can take quite a bit of work, but at Matt said, a clean install of windows, apps,updates, and file restoration ain't no pick-nick either.

Nothing beats the certainty of scorched earth. This particular infection sounds a little more serious than standard, and I'd personally be more comfortable starting over.
 

Ketchup

Elite Member
Sep 1, 2002
14,559
248
106
Nothing beats the certainty of scorched earth. This particular infection sounds a little more serious than standard, and I'd personally be more comfortable starting over.

I'm with ya there. It has been a few years, but when I had serious threats on my own machine, I would do exactly that and start over. Of course, I had pretty much everything backed up. Do other people downloading viruses back up their computer on a regular basis/at all? Of course not!

Doomer, let us know how the virus scans turn out!
 

C1

Platinum Member
Feb 21, 2008
2,400
117
106
I'd do a WIN repair first. If that doesnt work then WIPE the HDD (versus reformat or worse just reinstalling). If you back up files which are going to be reused, then there is no absolute guarantee that the undetectable malware is not resident also on a backed up file.
 

blankslate

Diamond Member
Jun 16, 2008
8,797
572
126
Nothing beats the certainty of scorched earth. This particular infection sounds a little more serious than standard, and I'd personally be more comfortable starting over.
I'd do a WIN repair first. If that doesnt work then WIPE the HDD (versus reformat or worse just reinstalling). If you back up files which are going to be reused, then there is no absolute guarantee that the undetectable malware is not resident also on a backed up file.

I agree with these posters that a wipe and reinstall is probably necessary. Hopefully you have your data on a separate hard drive or that at least the HDD is partitioned so that you can if necessary reinstal without wiping your data.

Additionally after the re-install go into the services and make sure remote desktop (and services that are dependent on it) and remote registry are disabled.

If it's a work PC and they want the services left on... oh well.
 

blankslate

Diamond Member
Jun 16, 2008
8,797
572
126
I always take the preference of the customer/friend/relative. Removing some malware can take quite a bit of work, but at Matt said, a clean install of windows, apps,updates, and file restoration ain't no pick-nick either.

Yeah but I would stress that a secure-wipe of an infected hard drive and reinstallation of the OS is more likely to be a one time deal

Running scan after scan may just temporarily remove the mal-ware and that there is no guarantee it won't come back. It is almost virtually guaranteed that a wipe and restore will remove the malware.

The only issue after that is making sure not to reintroduce it to the machine again.
 

Ketchup

Elite Member
Sep 1, 2002
14,559
248
106
Yeah but I would stress that a secure-wipe of an infected hard drive and reinstallation of the OS is more likely to be a one time deal

Running scan after scan may just temporarily remove the mal-ware and that there is no guarantee it won't come back. It is almost virtually guaranteed that a wipe and restore will remove the malware.

The only issue after that is making sure not to reintroduce it to the machine again.

I appreciate your take on this, but if the same person takes the computer back, there is no guarantee they won't go back and download the same junk all over again. I have seen them do it, several times.

At my last job there was one girl who let her boyfriend use her laptop, and she would always bring it in with the nastiest viruses I had ever seen. She wanted it wiped clean each time, but she would be back about six months later. My co-worker started bringing his flash drive to work so he could download all the porn before I wiped it.

She wasn't the only one, but the most entertaining anyway.

BTW, this is also when I was able to cement my belief that McAfee doesn't do jack.
 

blankslate

Diamond Member
Jun 16, 2008
8,797
572
126
I appreciate your take on this, but if the same person takes the computer back, there is no guarantee they won't go back and download the same junk all over again. I have seen them do it, several times.

If they're doing that after being informed of the situation then there's nothing really that you can do to stop it.
 

Ketchup

Elite Member
Sep 1, 2002
14,559
248
106
If they're doing that after being informed of the situation then there's nothing really that you can do to stop it.

I agree with that. I didn't agree with this:

Yeah but I would stress that a secure-wipe of an infected hard drive and reinstallation of the OS is more likely to be a one time deal

Hardly a big-enough deal to debate about though, just curious about the turn. Maybe you have never met a person like the one in my example though.
 

Gunbuster

Diamond Member
Oct 9, 1999
6,852
23
81
On a side note this sounds like the dumbest malware ever. Changing the pass would tip off the user.
 

blankslate

Diamond Member
Jun 16, 2008
8,797
572
126
Hardly a big-enough deal to debate about though, just curious about the turn. Maybe you have never met a person like the one in my example though.

It sounds like the person you are describing, if I was supporting their computer use would just nod their head when I told them my suggestion about getting malware off of a machine and then turn around and do the same thing that got them infected before.

Whether it be running their computer without AV, just clicking yes on every pop-up or just downloading and installing programs without a thought as to whether they really want it.

I've been fortunate enough not to have met more than a couple.



As for my opinion about wiping and reloading the OS when a person comes to me for help with a malware infestation, I've done the multiple scan routine and had a few of those customers/friends return later with the another malware infection in short order.

On wipe and reinstalls the one time the person came back was because of their negligence in installing crapware. They didn't admit it first though.

It's situational. If you're working for a company and the policy is something other than just wipe and reinstall (perhaps because of data concerns) or if the person turns out to have no backups of their data that is on the machine, then yeah I understand.

But if it's a one time customer or a friend I'm going to recommend the "nuclear option" more often than not.
If they just want scans then yeah I'll do just that, but going from personal experience I do push for re-install option a bit before just going with scans and removal.

On my personal machine it depends sometimes I'll wipe and reload or I'll run multiple scans and just be satisfied with that.

However, I have a spare machine that I use much much except to install updates. I only use that one for when I do need absolutely secure (at least from my machine) access to the internet. It's a laptop that I keep locked up in a locking computer case which goes inside of a locked footlocker when not in use.
 
Last edited:

Ketchup

Elite Member
Sep 1, 2002
14,559
248
106
On wipe and reinstalls the one time the person came back was because of their negligence in installing crapware. They didn't admit it first though.

Aren't those hilarious? Lost count of how many times that has occurred and I have to try so hard to stop myself from laughing!
 

sm625

Diamond Member
May 6, 2011
8,172
137
106
I hack back into the Admin account and change the PW's back to what they are suposed to be and then a day or so later, they change again. Gone through this 4 times now. :

Do you have a teenage geek on your network? It is possible they just discovered pstools and are using it to pull your leg for a laugh. Have you changed the password or reset the password for all accounts, including the administrator account? Once you set all administrator passwords, they should not be able to remotely access your machine as an administrator.
 

Ichinisan

Lifer
Oct 9, 2002
28,298
1,235
136
Is there a laptop / condensed keyboard in this mix? When num lock gets enabled, your letters might not be coming out as letters.