Vundo Trojan, Erased From Registry, Now Windows Has Password

[TheShape]

I would be happy to attach a HijackThis log but here is the deal. My neighbor had this trojan. She thought the pc was clean except the fact that everytime she booted her pc, she got a message stating that windows could not find the C:\Windows\system32\mljji.exe file. She did a search for the executable but did not find anything so she decided to just delete any instance of mljji.exe in the registry. Once all of it was gone she rebooted. Upon starting windows, her user name now comes up at the login screen (which it never had before) and when she clicks on it, it asks for a password (which she has never set) She is not able to log into her computer to do anything now. She can't get into safe mode because f8 just brings up her boot menu. I don't even know if the safe mode would work anyway. I let her use a disk of mine that is bootable and enables you access to the sam section of the registry and it showed her account (Owner) as "dis/locked". We were able to unlock it, it also allows you to edit the password but the program we were using said the password is blank. Once we save what we did to the registry, we rebooted but to no avail it came back to the log in screen. It also takes a really long time to get there. We went back into the boot disk and it showed her account as "dis/locked" again. I am stuck at this point. She will definitley have to wipe her HD out and reload windows but the fool that she is, she has over 44 GB of personal pictures that she does not want to lose. I don't know what else to tell her to do. :4-dontkno Any suggestions would be helpful. Thanks in advance.

TheShape

 

[WhiteLotus]

Try some of the other Function keys. I know of a Computer that requires F5 to be hit to get into the safe mode menu - after your in just remove the password.

 

[syncrod]

plugin her hd in another machine and backup the data

 

[zatblast]

http://www.tech-faq.com/recover-windows-nt-administrator-password.shtml

never tried that... but ah yea... did try some version like a year ago on a win 2k machine and it worked wonderfully compared to what i expected... just as a test but yea just search for "windows password recovery" and dont look for the brutes lol look for the illigetament legit ways they are the easiest..

 

[JrRacinFan]

Could always try the "hidden" administrator account, Has she ever setup a password for it?

Try this:

Press ctrl-alt-del twice at login screen: it will come up with a classic windows login dialogue. From there type in "Administrator" as user and password if one has been defined. If no password defined leave it blank and try logging in that way.

 

[BullGod]

Could always try the "hidden" administrator account, Has she ever setup a password for it?

Try this:

Press ctrl-alt-del twice at login screen: it will come up with a classic windows login dialogue. From there type in "Administrator" as user and password if one has been defined. If no password defined leave it blank and try logging in that way.

Yeah that should do the trick.

 

[TheShape]

http://www.tech-faq.com/recover-windows-nt-administrator-password.shtml

never tried that... but ah yea... did try some version like a year ago on a win 2k machine and it worked wonderfully compared to what i expected... just as a test but yea just search for "windows password recovery" and dont look for the brutes lol look for the illigetament legit ways they are the easiest..

Yeah, I have that disk. Upon using it, it looked like it worked, as I stated in my first post, but when she restarted, we had the same problem.

 

[TheShape]

Could always try the "hidden" administrator account, Has she ever setup a password for it?

Try this:

Press ctrl-alt-del twice at login screen: it will come up with a classic windows login dialogue. From there type in "Administrator" as user and password if one has been defined. If no password defined leave it blank and try logging in that way.

Tried that too, no luck.

 

[TheShape]

plugin her hd in another machine and backup the data

This is what I told her to do, I don't see another choice really. She had no business keeping 44GB of personal photos on her machine anyway. One day maybe she'll learn to backup.

Thanks for everyones help.