I lost admin password and couldn't fix, now both gone

[karlsnooks]

baeachinmoney,

The results of System Sweeper will be in:
\Windows\Standalone System Sweeper\Support as one or more files with a LOG extension which you can view with Notepad.


Would you please include these log files as attachment to your next post?

This will enable me to make an accurate recommendation.

 

[beachinmoney]

here they are....

]I might even be able to do this right by now. View attachment MPLog-08062011-075139.logView attachment msssWrapper.log

 

[karlsnooks]

the next time you run the system sweeper, Remove and thing the sweeper finds. Do not quarantine. Remove them. The only person who would quarantine would be a secruity analyst.


Now the very highest priority is to 100% uninstall ALL anti-virus, anti-malware, anti-spyware software on your computer except for:
MalwareBytes (if installed),
Microsoft Security Essentials.

If Microsoft Security Essentials (MSE) is not installed, then download and install Microsoft Security Essentials.

Do not install any other anti-virus software of any kind.

Do not let anyone else near your computer.

Password protect your user account.

Remove all other user accounts from the computer. The infections and other files present on your computer indicate that some one has comprimised your system.

If you only have the one user account on your computer, then change the password.

Someone has comprimised your computer..

After installing MSE, then once again I'll need the startup.txt and the install.txt files.

I very strongly recommend uninstalling all programs from your computer that you do not use.

When you uninstall, first disconnect from the Internet. The uninstaller software will want to go to the Internet and for no reasons that are good for you.

I'll be close to the computer for the next few hours so will be able to reply promptly.

Here's the procedure again for the startup and install txt files.

LIST OF STARTUP AND INSTALLED PROGRAMS USING CCLEANER


STARTUP PROGRAMS
CCleaner | Tools icon | Startup button | click on Save to text file button (bottom right side)

Using the PAPER CLIP icon in the top panel of a Message Reply window, attach the startup.txt file generated by CCleaner.

INSTALLED PROGRAMS
CCleaner | Tools icon | Uninstall button | click on Save to text file button (bottom right side)

Using the PAPER CLIP icon in the top panel of a Message Reply window, attach the install.txt file generated by CCleaner.

 

[beachinmoney]

I thought I had uninstalled all the other antiviruses but I use the computers uninstall and I am going to use Revo this time. I will do that now and then I will run ccleaner and yes MSE is all that is there. Except the Windows Denfender is there but it is not turned on. I looked up how to get rid of it but everything said that you can't uninstall it. I am going to do these and then go back to sleep. Have to start fresh tomorrow. Thanks again. I can see that someone has compromised my system and it had to be the guy who installed the crack software because I kept seeing weird things going on. Remember that is what prompted me to change all my passwords and try and lock everyone out through my network too. Problem is the damage had been done and I ended up locking myself out because through all the panisk something that I did changed my password and then when I went to try and get back in I'm pretty sure I know which step I messed up on when unlocking the passwords. Here goes though, I want to turn this guy in who is now making a living installing IObits and Advanced System Security with a cracked key on his clients computer. I stored to a disk the proof of his crack keygen and the files and correspondence between us. I noticed in all of my files though that there wre still traces of Avira and AVG and some others. If I had done through Revo those would have been cleaned up. It was stupid of me to quarantine those sweeper viruses but I honestly didn't think there could be anything left after all the scanning and wanted to see what it was. They should be gone today. Now that I know how to check. Well, I am getting busy.

 

[karlsnooks]

Don't worry about Windows Defender. Removal of all anti-stuff, installation of MSE will correctly configure both Windows Defender and Windows Firewall.

When the removal and installation of MSE is complete, send a copy of the startup.txt an install.txt files in your post.

 

[beachinmoney]

Okay scans are running..

One thing I know that I did wrong when I went into recover my password, or I think I may have, is not change the magniify.exe back to cmd.exe. How can I know for sure and how can I do it now so that I can actually go in and "take ownership" of my files when this boots back up. I am not going to do all that tonight but I would like to make sure that the magnify.exe is changed back to cmd.exe. I keep getting must be a trusted installer to do this. I know you can go into property's and change that but I don't want to unless I know for sure but I also don't even think it will let me with so many locked files. It would sure be quicker doing things if I could cmd something. I can't even do it from the default administrator. That's what leads me to believe that I missed that step. That could be causing all these weird files to show up in places to couldn't it?

 

[karlsnooks]

Don't worry about Windows Defender. Removal of all anti-stuff, installation of MSE will correctly configure both Windows Defender and Windows Firewall.

When the removal and installation of MSE is complete, send a copy of the startup.txt an install.txt files in your post.

Still awaiting the startup.txt and install.txt

 

[beachinmoney]

Sorry I thought that you had gone to bed. I just started malware. I will stop it and post it for you. One minute. Some files showed up as being installed that aren't and after ccleaner that deleted them. I want to get rid of my Administrator. I can't find the magnify.exe file to change it back to the cmd.exe file. I think that might be some of the problem. I did fix I think the password issue. Now when I log in I don't get the error message about having logged in under a different name. But I still need to fix this other issue as I can not use command prompt. I searched and read everywhere and the only answers I got were to go to system 32 folder and delete and rename magnify.exe back to cmd.exe. Well, for one thing there are three of them and for another I don't have the permissions. It says it must be a trusted installer.View attachment startup.txt

View attachment install.txt

Okay, I just opened all my files and almost all of them have the lock on them. I thought that if you changed your password with the password reset USB that you would not be locked out. I thought that only happened when you kept trying to access them and couldn't log in. I read this and so I don't get it. I did find this software and wondered if you think it might do any good or if you have heard of it. It is called TeraCopy, it's at download.cnet.com/TeraCopy/3000-2248_4-10671835.html.

It doesn't look like I have all those weird files in my Document anymore. Yeah, just checked none of them are there anymore. But every single file I have is locked. Every single document. This is not good. Lance has an interview today and I need to get him his resume. I don't have a backup because I just did it!

 

[karlsnooks]

First:

Delete ALL anti-virus, anti-spyware, anti-malware, firewall, security, software from your computer UNLESS it's from Microsoft.

Then send me a copy of the startup.txt file again.

 

[beachinmoney]

The only thing that is on my system right now is MSE, Windows firewall, Malwarebytes, I will delete. The eset, or however you spell it isn't on there it's just a file or it might be in my download files. I just pulled them up. They are not where they are suppose to be. I may have something old in a zip file but I had the cleaner go through all of that. I can not delete my firewall.

I just logged in as myself and I am still getting the message that I logged in under a different name then I did. I don't know why you keep referring to MSE. I installed it and uninstalled AVAST from both computers the very day you told me to. I think that I am not able to completely delete things or something because I am not the system Administrator and neither can my default admin. I need to get that fixed. You don't understand. I can't even get a cmd prompt so it takes me 4 hours to do one thing. You haven't even mentioned that. I am getting rid of everything else I see that I didn't do this morning. I was up until about 6am. I am sicker today then I think I have ever felt. If you don't think I am following your advice and taking this seriously then you have it wrong. The only thing I can do is go through all the zip files again, even though I had ccleaner do it and I did revo uninstaller yesterday before I ran that for you.

 

[beachinmoney]

I don't know how it's still there, I just found the folder, hidden in my computer that Josh that computer guy downloaded with the crack. I am on the phone now with AVAST. Then I am deleting it. I also found Avira in a file on my desk top. Neither one showed up to uninstall in either revo or windows uninstall. The crack folder was empty. The programs not installed. I just deleted them.

 

[karlsnooks]

Please submit a new Startup.txt file.

 

[karlsnooks]

rb: | MSCONFIG |STARTUP tab |

Uncheck ALL except for
MSC "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

 

[karlsnooks]

Have a glass of a good wine.

How many user accounts are there on your computer?

How many of those accounts are classified as administrator and how many classified as standard user?

Control Panel | User Accounts | click on Manage another account |

You will see all of the accounts listed there and under the account name you will see whether the account is an Administrator account or a Standard User account.

 

[beachinmoney]

View attachment install.txt

View attachment startup.txt

I am going to lay down for a little while.

 

[karlsnooks]

Sleep is always good.

After sleep, uncheck all on that startup list except for microsoft security essentials.

 

[beachinmoney]

Okay, Just did that. Well, at this point the default Administrator, myself and my supposedly real administrator. Then I have on user that is named the same way on both my desk top running in Windows 7 and this Vista in order to use it should I need to get into my desktop like when it crashed. Then the guest account is turned off. Don't know how to get rid of that all together. All I want is me, the admin. and the standard user named the same for my network. I only tried to make myself and admin once I created the standard user for the network because the default admin then lost his privilege.

I have to go out and buy something for my boyfriend to wear to his interview tomorrow. BBL!

 

[karlsnooks]

Your terminology has me confuised.

I have a very simple mind. Would you decide which computer you want to get in order and we will work on that one. After that one is finished, we can move on to another.


Now to further help me understand, would you please use the Snipping Tool to make a snippet of the output of that screen which shows the user accounts? Attach the snippet to your next post.

 

[beachinmoney]

No, I'm not trying to get the other computer fixed at this time. I simply didn't want to be in a position again where I couldn't get into it and I was also and have been having problems with my wireless printer on my desktop. So, when I was doing the settings the same on it as what is on the Vista, the printer and scanner and everything works on Vista, I thought that I should also make a user with the same names on both computers because you can't do a workgroup and communicate with each other unless their both Windows 7.... My mind is always going a mile a minute. Luckily people who know me will tell you I don't talk their heads off like I do type yours off. Sorry!

And, this one the HP has no real issues because I hardly ever used it in Mexico because it's so huge. It's 18 plus inches. I used my desktop or my mini 10! But now I am paranoid and never want this to happen to any of them again.

I just had to restart after checking what can and can start up at the start menu. There are two programs that I am not sure of. One is Log me in. I thought that was something I used to use for work that allowed me to see the other computers in my house. Is it that or something having to do with my network or Windows 7.



Okay, I saved this word file my desktop like always. Tried to upload it and it said invalid file that it is a shoot tried to get the error again, it started with an M. I didn't change the file or anything, Just re-attached and it worked just fine. I'm beginning to think that the man that used to live here at this townhouse and died here is haunting my computer!

Oh, got to eat dinner and go to bed. Have to be up at 6am for my BF's interview.

 

[karlsnooks]

A snippet is a .PNG file created by using the Snipping Tool.

rb: | type SNIPP | ENTER

follow the directions shown and take a "snip" of the area showing the accounts.

When you save the snip, the snip will be saved in the .PNG format.

Attach that file to your next post.

And do help me out, since I'm so easily confused. Let's talk about one and only one computer.