Windows XP Locked with "Windows XP Startup Password"

Today I encountered an XP computer which starts up presenting a login window titled:
"Windows XP Startup Password" with a blank space to enter a password.
There are numerous references to this around.  It comes as a result of nefarious "social engineering" which lets strangers into the computer.
My understanding is that they use a Windows "feature" / syskey to force the use of an additional logon  password.
That's not much understanding!  :-)

Anyway, I want to know an effective way to FIX this situation.  I have all manner of live CDs but I haven't got the foggiest idea what to do.
What is the best recommended fix procedure?
My belief so far is that this is NOT a parasite that can be found and removed.  Rather, it's a Windows setting having been made.  Right?
LVL 27
Fred MarshallPrincipalAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Larry Struckmeyer MVPCommented:
There is only one way to fix this.  Wipe the contents of the drive, re format and reinstall windows.

Not a fix, but a work around:   If you have a backup from before the intrusion occurred you could try restoring that as well so long as you have access to the backup from this compromised system.

Now the question becomes:  can you trust a backup from yesterday?  How about last week?  How about last month?  I would not trust any system that has been compromised because I don't know when the intrusion occurred.

Contact your bank and credit card companies and take action to secure your finances.
Brian PiercePhotographerCommented:
This is nothing to do with Windows. Its either a BIOS password that is being requested or its a 3rd party utility.
Sounds like diagnostic and Recovery recommendation and usage.
Have you tried using blank password yet?
You may want to locate startup disc, and/or (always should) make one.

How to install and use the Recovery Console in Windows XP
4. When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER

How to get into Windows XP recovery console without a Windows XP CD
Microsoft has made a set of boot disks that can be downloaded and used to get into the recovery console
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

☠ MASQ ☠Commented:
This one?
SM Password
If so the computer is probably uninfected (although take Larry's point about if you can be foolish enough to get a problem like this through a social engineering scam what else might you have, but here the vulnerability is the user not the PC(!)).

As you've probably already discovered this is a security setting on XP that's been changed  remotely  it normally has a hidden system set value but has been changed to a separate code.

If you can get to a Safe Mode command prompt (from F8 at boot) you can try restoring Windows' built-in password by following the instructions here

Knowing what it is however is simpler than fixing it.  This can be undone if you have some restore points set on the PC, although the person (usually from "Microsoft") who set the new password will usually set the restore files to delete in reboot so you may be out of luck.

To check you'll need to be able to boot to an alternative system and then use that to examine the contents of the affected drive (either a boot CD or by slaving the drive to a working PC - again the risk of this drive having any other form of infection s remote but bear it in mind when connecting to another machine).

Open a file browser in the booted system and then navigate on the affected hard drive to the Windows folder.  Check for the presence of a folder at system32\config\RegBack  if it is there and have content (depending on the system you have booted to you may need to allow Hidden and System files to be visible) then they didn't complete removal of the files.  If it is empty you will need to use the Hive back-ups from the original XP installation (on OEM machines this may fail).

Fingers crossed you find registry backup files at system32\config\RegBack - if this is the case:

Reboot the PC and  press F8 to reach the Advanced Startup Options menu & choose Repair your Computer.  When Windows offers to automatically repair cancel this and select a System Restore date that is earlier than the date the password setting was hacked.

If your System Restore files were deleted by the hacker you will need to copy the backup registry hive from the Windows\Repair folder.  The process is outlined in this Microsoft KB article although this described using Recovery Console to do it and you may be doing this through whatever system you have booted to.

How to recover from a corrupted registry that prevents Windows XP from starting

In summary, this is a deceptively easy thing to set up maliciously on a user's computer and complex, sometimes impossible to recover from - although no data is lost and can be recovered ultimately you may need to reinstall the operating system if the registry hive back-ups have been intentionally deleted.

Good luck!
i suppose you saw this already :
it confirms the scam password, and suggest fresh install

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Fred MarshallPrincipalAuthor Commented:
This is obviously a Windows feature and not a parasite.  Bad actor not bad software!
☠ MASQ ☠Commented:
Just for future reference - that link  does miss that the Windows System Service password for Syskey can be recovered in some instances, so the actor can be prompted to perform correctly :)
Fred MarshallPrincipalAuthor Commented:
I meant that this is often set up by a charlatan who is given access to the system.

But, I'm very curious, how to recover his nefarious password?
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.