Solved

Windows XP Locked with "Windows XP Startup Password"

Posted on 2014-09-25
8
509 Views
1 Endorsement
Last Modified: 2014-11-23
Today I encountered an XP computer which starts up presenting a login window titled:
"Windows XP Startup Password" with a blank space to enter a password.
There are numerous references to this around.  It comes as a result of nefarious "social engineering" which lets strangers into the computer.
My understanding is that they use a Windows "feature" / syskey to force the use of an additional logon  password.
That's not much understanding!  :-)

Anyway, I want to know an effective way to FIX this situation.  I have all manner of live CDs but I haven't got the foggiest idea what to do.
What is the best recommended fix procedure?
My belief so far is that this is NOT a parasite that can be found and removed.  Rather, it's a Windows setting having been made.  Right?
1
Comment
Question by:Fred Marshall
8 Comments
 
LVL 21

Expert Comment

by:Larry Struckmeyer MVP
Comment Utility
There is only one way to fix this.  Wipe the contents of the drive, re format and reinstall windows.

Not a fix, but a work around:   If you have a backup from before the intrusion occurred you could try restoring that as well so long as you have access to the backup from this compromised system.

Now the question becomes:  can you trust a backup from yesterday?  How about last week?  How about last month?  I would not trust any system that has been compromised because I don't know when the intrusion occurred.

Contact your bank and credit card companies and take action to secure your finances.
0
 
LVL 70

Expert Comment

by:KCTS
Comment Utility
This is nothing to do with Windows. Its either a BIOS password that is being requested or its a 3rd party utility.
0
 
LVL 24

Expert Comment

by:SunBow
Comment Utility
Sounds like diagnostic and Recovery recommendation and usage.
Have you tried using blank password yet?
You may want to locate startup disc, and/or (always should) make one.

How to install and use the Recovery Console in Windows XP
http://support2.microsoft.com/kb/307654
4. When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER

How to get into Windows XP recovery console without a Windows XP CD
http://www.computerhope.com/issues/ch000635.htm
Microsoft has made a set of boot disks that can be downloaded and used to get into the recovery console
0
 
LVL 62

Expert Comment

by:☠ MASQ ☠
Comment Utility
This one?
SM Password
If so the computer is probably uninfected (although take Larry's point about if you can be foolish enough to get a problem like this through a social engineering scam what else might you have, but here the vulnerability is the user not the PC(!)).

As you've probably already discovered this is a security setting on XP that's been changed  remotely  it normally has a hidden system set value but has been changed to a separate code.

If you can get to a Safe Mode command prompt (from F8 at boot) you can try restoring Windows' built-in password by following the instructions here

Knowing what it is however is simpler than fixing it.  This can be undone if you have some restore points set on the PC, although the person (usually from "Microsoft") who set the new password will usually set the restore files to delete in reboot so you may be out of luck.

To check you'll need to be able to boot to an alternative system and then use that to examine the contents of the affected drive (either a boot CD or by slaving the drive to a working PC - again the risk of this drive having any other form of infection s remote but bear it in mind when connecting to another machine).

Open a file browser in the booted system and then navigate on the affected hard drive to the Windows folder.  Check for the presence of a folder at system32\config\RegBack  if it is there and have content (depending on the system you have booted to you may need to allow Hidden and System files to be visible) then they didn't complete removal of the files.  If it is empty you will need to use the Hive back-ups from the original XP installation (on OEM machines this may fail).

Fingers crossed you find registry backup files at system32\config\RegBack - if this is the case:

Reboot the PC and  press F8 to reach the Advanced Startup Options menu & choose Repair your Computer.  When Windows offers to automatically repair cancel this and select a System Restore date that is earlier than the date the password setting was hacked.

If your System Restore files were deleted by the hacker you will need to copy the backup registry hive from the Windows\Repair folder.  The process is outlined in this Microsoft KB article although this described using Recovery Console to do it and you may be doing this through whatever system you have booted to.

How to recover from a corrupted registry that prevents Windows XP from starting


In summary, this is a deceptively easy thing to set up maliciously on a user's computer and complex, sometimes impossible to recover from - although no data is lost and can be recovered ultimately you may need to reinstall the operating system if the registry hive back-ups have been intentionally deleted.

Good luck!
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 91

Accepted Solution

by:
nobus earned 500 total points
Comment Utility
i suppose you saw this already :  http://blogs.msmvps.com/sp/2008/01/27/disabling-syskey-startup-password/
it confirms the scam password, and suggest fresh install
0
 
LVL 25

Author Closing Comment

by:Fred Marshall
Comment Utility
This is obviously a Windows feature and not a parasite.  Bad actor not bad software!
0
 
LVL 62

Expert Comment

by:☠ MASQ ☠
Comment Utility
Just for future reference - that link  does miss that the Windows System Service password for Syskey can be recovered in some instances, so the actor can be prompted to perform correctly :)
0
 
LVL 25

Author Comment

by:Fred Marshall
Comment Utility
I meant that this is often set up by a charlatan who is given access to the system.

But, I'm very curious, how to recover his nefarious password?
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Suggested Solutions

If you have done a reformat of your hard drive and proceeded to do a successful Windows XP installation, you may notice that a choice between two operating systems when you start up the machine. Here is how to get rid of this: Click Start Clic…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Notifications on Experts Exchange help you keep track of your activity and updates in one place. Watch this video to learn how to use them on the site to quickly access the content that matters to you.
Articles on a wide range of technology and professional topics are available on Experts Exchange. These resources are written by members, for members, and can be written about any topic you feel passionate about. Learn how to best write an article t…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now