Password Changed automatically

Posted on 2006-03-28
Last Modified: 2013-12-04

the password of my Windows XP was changed automatically by some reason. Also the password of my internet acces through dial-up doesn't work anymore.
This all started to happen when I installed ITunes from the Ipod CD.

I didn't download anything but some ITunes files and I didn't open any attachments because I got none.

The thing is that I can access my machine now because I just hacked it with Knoppix. Nevertheless I don't feel good about this because I also want to use Netbanking.

The password changing happend over the night.

I have a firewall installed but no Antivirus. But I will check with the Antivirus as soon as possible.

Any suggestions how this could happen because I also don't know about any virus changing passwords of Windows Accounts and even the password of my Login
for the internet provider. (In fact this password is selected by the provider and I shouldn't be able to change it myself)

Thanks for any ideas.
Question by:michi3012
    LVL 15

    Expert Comment

    It sounds to me like some remote software is/has been installed and running. If you're using XP pro, see if you have terminal services running and perhaps someone is using RDP to access. Also check your users accounts to see if there are any unknown users setup. Also go to a command prompt and do a netstat -an and see if you have anything listening. Some remote package may be listening that someone is coming in with. Otherwise a keylogger may be giving out info. Its hard to say for sure without more info, but this is a start.

    Check these online scanners
    Stinger -

    Author Comment

    I thought about the same, thanks for you suggestions I will try them and see if they helped.

    This will take a while because I'm at work now.
    LVL 17

    Expert Comment

    Alright, get to using a ton of spyware programs like Adaware, Spybot S&D, and Ewido while your computer's started up in safe mode.

    But yeah, someone's got something that's constantly monitoring your account or they're just changing it from the outside.
    LVL 7

    Accepted Solution

    Hi there,

    Various causes to your question:

    Since you do not have an AntiVirus running, if some malicious sites you visit it will store in your temporary internet folder a threat which may be launched at the next restart etc. Others are chat rooms.

    You mentioned you downloaded a few iTunes files ...what are these few itunes files you referring is it mp3 from someone or some sites etc.

    If your PC is just a standalone without any file sharing. Disable them and inside your Firewall exception uncheck any other apps which is not needed to be accessed by anyone.

    By the way for your information...this is only 1 of such backdoor of many more others
    Backdoor.Berbew is a Backdoor Trojan Horse that is downloaded from the Internet by Trojan.Download.Berbew. The Backdoor Trojan steals passwords and delivers them in the form of URL requests to the Web site of the Trojan's creator. Port numbers 7714 and 8546 may be opened for listening (the port numbers may vary).

    For full protection in future you should install
    Antivirus and antispyware even though you have a firewall.
    For Antivirus: Check out on Symantec and others mentioned by the experts
    For AntiSpy get Microsoft Windows Defenders
    it is free.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Find Ransomware Secrets With All-Source Analysis

    Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

    As I write this article, I am finishing cleanup from the Qakbot virus variant found in the wild on April 18, 2011.  It was a messy beast that had varying levels of infection, speculated as being dependent on how long it resided on the infected syste…
    SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    10 Experts available now in Live!

    Get 1:1 Help Now