I lost admin password and couldn't fix, now both gone

[karlsnooks]

You are foot-dragging.

Run a full scan with the Microsoft Standalone Sweeper.

Once again, here's the procedure I use. If you don't have a spare usb stick then go get a 4gb stick at the local store.

AFter you have run the full scan with MS Standalone System Sweeper then we can proceed.

============================================
PUT SYSTEM SWEEPER ON A USB STICK


System Sweeper, https://connect.microsoft.com/systemsweeper, allows you to start an infected PC and perform an offline scan to identify and remove viruses, rootkits and other advanced malware. System Sweeper is a free standalone, bootable malware and virus remover from Microsoft.

Safety Scanner, Microsoft Safety Scanner - Antivirus | Remove Spyware, Malware, Viruses Free, is free, downloadable, provides on-demand scanning and helps remove viruses, spyware, and other malicious software. It works with your existing antivirus software.

If the target computer has a working internet connection, then you may prefer to use the Safety Scanner.


Download System Sweeper (about 576 kB):
https://connect.microsoft.com/systemsweeper

Insert 256 MB or larger USB stick into a usb port.

Run the downloaded program--mssstool64.exe or mssstool32.exe

Choose the option to install to USB.
Caution: The install program will format the usb stick.

The install program will download about 200 mB more.

After the install is finished, leave the stick in the usb slot.

Run the program you downloaded once again.

This 2nd run, and any subsequent runs, will download the very latest anti-virus definitions (about 60 mB).

To keep System Sweeper up-to-date, simply reinsert the usb stick and run the installation program again.

The initial, full scan by System Sweeper can easily take a couple of hours, but subsequent quick scans will take only a few minutes.

Remember, your computer is being very thoroughly checked for all types of malware.

The results of System Sweeper will be in:
\Windows\Standalone System Sweeper\Support as a file with a LOG extension. You can view this file with Notepad.


==========================================

 

[karlsnooks]

Here's my opinion on another matter:

Anyone who gives you infected software is NOT your friend. That person, for whatever reason, is your enemy.

 

[beachinmoney]

By the way, here are the things it took out of registry. I tried to explain to him that you can't just take things like that out of the registry. They are things that need to stay to make programs run correctly. Here is a list of the registry things it deleted. There are too many. If you can and are able to scan any of them quickly and see anything obvious to you that I need back will you and tell me how????

Okay, well, that's gone now as I deleted the program!!! I am going to attach some things and then PM you as I have a few questions and things that I can trace.

 

[beachinmoney]

Here's my opinion on another matter:

Anyone who gives you infected software is NOT your friend. That person, for whatever reason, is your enemy.

This is what I am getting ready to PM you about....

 

[karlsnooks]

let me know what the MS Standalone System Sweeper found.

 

[beachinmoney]

I have the sweeper. I just wanted to make sure it didn't sweep everything but now I see that my downloads are in a different place. I am going to re-read the directions and stick the thing in now!

 

[beachinmoney]

Putting in sweeper now and then coloring my hair and sitting in the massage chair with a glass of wine. None for my boyfriend!

Shut down all antivirus and firewalls while running???

 

[karlsnooks]

Follow the directions for the Standalone System Sweeper and have no fear.

While the sweeper is running you will not be connected to the internet.

You will be booting from the USB stick you prepared by following the directions.

You will be running from the USB stick. You will not be running from your harddisk.

The Standalone system sweeper will truly clean your computer of all malware and virus.

Immediatedly, after running the system sweeper let me know. Certain programs need to NOT be started and certain programs need to be removed before you connect to the internet again.

Let system sweeper remove any programs which are detected as infected.

 

[beachinmoney]

Karlsnooks, I started trying to recover passwords and looking for my USB with the stand alone Sweeper on it. It must have upped and walked away. Just as I sat down to do another one my door bell rang and it was my cousin and her three kids. Talk about unexpected guest. I need to know anyways what need to not be connected and what needs to not be started. My MagicJack and all are connected to this computer. My other computer is on a shelve below my TV as I use it for watching TV on Hulu and that's all I have here. Your probably not around tonight it being a Friday and everything but if you are. Before I get ready to do this I have two more questions. One, my password reset disks that I created, how the heck do you get those to work??? I also was going to do the Hive tutorial 2 that Bob2 gave me the first part of this posting. I had just enabled the systems admin instead because it takes hours to do the simplest thing because files won't open or permissions are locked etc... so I wondered if I do the tutorial to change the passwords that Bob2 did maybe I will get them done correctly and if so will it unlock my locked files? IF not do you know how to do that. It would sure save time going from one computer to the next. Also when I try to start up and boot to the DVD drive or something it wants a password. Sometimes it will take mine, mostly it won't. I thought that is why I had the systems Administrator because that was suppose to help. Sometimes it will take me 4 hours just to figure out how to get around it and read somewhere on the forum what to do next!

Thanks, and once again you have been so incredibly wonderful in all the help that you are providing me with. When I get back to work do you take contributions???

 

[karlsnooks]

Firs things first.

Run the Microsoft Standalone System Sweeper full can.

 

[beachinmoney]

HI, I am going to but like I said, I don't know what to turn off, well here, this is the quote from you, Follow the directions for the Standalone System Sweeper and have no fear.

While the sweeper is running you will not be connected to the internet.

You will be booting from the USB stick you prepared by following the directions.

You will be running from the USB stick. You will not be running from your harddisk.

The Standalone system sweeper will truly clean your computer of all malware and virus.

Immediatedly, after running the system sweeper let me know. Certain programs need to NOT be started and certain programs need to be removed before you connect to the internet again.

Let system sweeper remove any programs which are detected as infected.

Once I am done with it and I boot up I will be on the internet immediately and I don't want to run things I am not suppose to to answer you with it. Remember I did it once before and I did not get a log file or anything. I also did it yesterday and nothing happened either.....

 

[beachinmoney]

Sweeper is sweeping happily!

Just to let you know that the stand alone swipper has been running for about an hour now. I also have read some other stuff and I think I figured out how to fix a few other things.

 

[beachinmoney]

Hi, well, it is done. I just got home. It ran for almost 5 hours. I got two sever alerts. Both of them are Java related and one keygen alert. For a cracker. Must have been the one that that nice young man put on my system. What do I do now?? What do I do to turn off or not run things you said. I have not pushed the fix button yet. I will look and see what you said. I don't remember!!!

 

[beachinmoney]

Here's what Sweeper said

1. Exploit Java/CVE-2010-0840.AK Severe, Status, Active
2. TrojanDownloader:Jave/openConnection.JQ Servere, Status, Active
3

this is the medium risk one it says Hacktool:Win32/Keygen Avanquest.PowerDesk Professional.v8.2.0.18.Incl.keymaker-Core\Avanquest.PowerDesk.Professional.......

I choose to quarantine the keygen because I want to see where it came from and I removed the other two obviously!

FYI, it ran for 5:23 and 43 seconds!!! I didn't know what to do so I x'ed out of the program and then I f12 and chose to boot from hard drive. Then I got a message saying: Partition start:1a00000 Secs:48e57000 was changed out of protect...

then it proceeded to load til it got to 100%. I figured that wasn't such a good thing so I F8 when it was at 100% and chose to start in safemode, I thought about it and since I lighted my hair yesterday, that's the only excuse I can come up with I booted in safe mode with networking. Then realizing that you did not want me to get on the internet I have not logged in or anything. I am awaiting what to do at this point.

 

[karlsnooks]

The System Sweeper must be run to the end and never interrupted.

Yes, the system sweeper will take a long time.

Start it before you go to bed and maybe the sweeper will be finished when you get up.

The System Sweeper must be run to the end.

 

[beachinmoney]

It did run til the end. That is why I wanted to know what to do. You had said that certain things should not be turned on. Anyways. I looked up the viruses and then I ran the updated downloads from Microsoft that they suggested running based on the viruses. The computer is currently up and running and I am doing another MSE scan. I think everything is gone. I am going to put the copy of what I had on there here and the links that I went to to download the updates. I am very tired. I stayed up all night again to do everything and research.

That's some pretty scary stuff. I learned a lot. It may not be completely over but here's what I really want to know. Who is sitting around watching and waiting and knows when someone does something like turns their firewall off or doesn't have an encrypted WPK router or something like that.

The first thing that alerted me to the problem was when I noticed that I wasn't getting my Windows updates. AVAST sure doesn't seem all that great as it did not find these things. Windows Defender got turned off when I installed MSE. I couldn't figure that one out. What do you recommend using along with MSE? I will keep the ccleaner and run it every so often, once a week okay do you think? I am rambling. I am tired. Just want to see the out come of the scan I am doing now.

When I wake up I will come and see if you want me to do other things. Then I am going to backup the computer again. Get rid of the old back up. Then I am going to go in and "Take Ownership" of my locked files. I am going to get rid of any active administrator account. I saw a tutorial that I can do to switch users fast so that I have an enabled administrator and everyone will have a password reset disc. By the way. I tried to use that and couldn't figure out what to do after putting the disk in.

After that I really need to find and update drivers. Then, when everything feels stable I will spend some time cleaning up this laptop. It's and HDX 18T. Then I am going to install Windows 7 Professional on both computers. There are features available that make things easier if you get into trouble. I have a lot to do still.

 

[beachinmoney]

Oh, scan just finished it said nothing. However when I logged back on there were two things that were medium threats and they are quarantined. I tried to delete them and couldn't figure out how so I set my options in advance to delete quarantined items after one day. Is that the best thing to do?

 

[beachinmoney]

The System Sweeper must be run to the end and never interrupted.

Yes, the system sweeper will take a long time.

Start it before you go to bed and maybe the sweeper will be finished when you get up.

The System Sweeper must be run to the end.

Just to further clarify. I re-read my post and I can see where you thought I didn't let it run all the way through. NO, it went all the way and posted those viruses. At that point though was when I didn't know how to get out of the program and how to do it so as not to start the system because you told me that certain things needed to not run after the scan was done. So when I booted to safe mode that is when at first the sweeper screen gave me the error mode about not being protected anymore then it proceeded to load the protection and went through a series of %'s til it hit 100%. It wasn't until after that that I chose to boot in safe mode. after changing the boot sequence so that the sweeper wouldn't reload again. Does that make more sense?

 

[beachinmoney]

Ummmm, is this where I perform a systems restore...

Hi, I just was going into my Documents to pull up my boyfriends resume and here are then kinds of things that are in there now,

I wonder if you will even be able to open that cause it did the weird thing that it does now. It put a character in place of the first letter that I named it. Ahhhhh, what is going on?

 

[beachinmoney]

Okay so after I found all of those weird files I found this, SystemConfigurationCheck_Report.htm. I ran a search in Google and it came up that my SQL didn't install correctly. Is that what all those weird files are. I'm not touching a thing until I hear from you. I am shutting it down and that is that.