Windows XP forum: computer locked

Hi, thanks for trying to help but there is nothing on the nirsoft site that can help.

when i put the windows password recovery program on it came up with everything that had a password, one was admin, the other was mine and the last 2 were remote help and the support number I wrote. the last 2 were the only ones that couldn't be recovered

Sorry for the confusion, when I put the windows password recovery program on, it came up with all the passwords on the computer, administrator didn't have one, mine and my husbands came up and was reset but the last two in the list were remote help password and the the one with the numbers that I listed, both of these could not be reset. I cannot get into windows to delete it as when it boot up it comes up with a little box that says xp is password protected and I need to submit the password.

It was a scam of course, and if we knew who they were we might be able to find out more about their methods.

In any case I am a bit mystified. As far as I am aware there are only two methods of password protecting computers;

1] BIOS passwords

I doubt these can be set remotely because any remote control is extinguished when the system is restarted and it would have to be restarted for the BIOS password to be set. The BIOS password screen would be displayed immediately when turned on and certainly before any OS loads, so I can't see how such a password screen could say "XP is protected" as the BIOS knows nothing about which OS is installed.

2] Windows' Account Passwords. All Accounts are equal and none takes precedence. So on bootup and after the BIOS has done its POST, (Power On, Self Test), routine and reports, the Welcome Screen should show a list of Windows Accounts available. All of them should work and none of them can exclude others from working. There is no method of including a Master Password before allowing user account access.

Can you tell us, clearly, when this little box message appears. From turning the computer on, what do you see before this box is displayed?

Since this is XP, have you tried to boot into Safe Mode to see if the hidden System Administrator's account is displayed? If so, try that.

Mark

into the 'support' account they made.

I suppose Safe Mode doesn't do the autologon. But I don't know. Worth a try anyway, indeed. They might even be able to own in their own password-cleared account, delete that support account and rest the autologon.

Kees

I have gone into the bios and there is no admin password. The box appears after the initial windows logo when computer is turned on. I have taken a photo of it but don;t know how to upload it here. The people said they were windows repair technicians. From what my son said they sounded indian. When you start in safe mode you get the same box that says xp is password protected.

These forums don't allow direct image posts but you can stll upload your image to your favored Image Hosting site, eg ImageShack, Photobucket, Flickr or similar, then post a link to that image here to the 'full sized image.

If none of the tools in Ken's link below works, this is looking increasingly difficult.

Mark

http://www.bleepingcomputer.com/forums/topic200551.html doesn't seem too promising.

I'm afraid a clean install of Windows XP might be necessary. Unless you are willing to do some tricks, like this:

http://support.microsoft.com/kb/307545 tells how to recover from a damaged registry, by (1) replacing it with the very initial versions left for that purpose by the Windows setup program, (2) running system restore to the latest restore point after logging in into that very initial state. You need the XP CD to boot into the recovery console.

I find the rename and copy procedure for step 1 much easier if you do it from a Linux Live CD. That has a GUI (more or less like Windows Explorer) and that's easier than typing all those commands.

If you boot from Linux, do what's mentioned above and it still doesn't work, a clean install is unavoidable. But you can use that same Linux to copy all your personal files to an external hard disk, so you won't lose any data. But it sure is annoying.

Kees

window try pressing the three fingered salute combination of Ctrl + Alt + Del TWICE and see if you get a normal logon window that allows you to type in your own user name and password.

If it does you can them use your own Admin account to delete the accounts they added. You will also want to download and install TweakUI from Microsoft -
http://download.microsoft.com/download/f/c/a/fca6767b-9ed9-45a6-b352-839afb2a2679/TweakUiPowertoySetup.exe

This will allow you to run it and if these people did set up an autologon account you can disable autologon (it is located under the LOGON > Autologon settings in the left window of TweakUI)

Hope this helps.

Thanks for everyone's help,
the only thing that worked was getting the hard drive out and putting it in the usb enclosure, recovered the files, deleted the ones I could find that they put on there, then restored the computer to it's original condition. Lost the programs but happy to recover personal folders. There is certainly a lesson to be learn't from this experience and the son has been justly reprimanded about letting anyone into the computer.

Hi, and thanks for your help, I can't get into the computer to create the disc that microsoft give instructions for . I can get into the bios and thats all. I have tried 3 different password recovery programs including the windows password recover version 3.0 one that I paid for and it said was 100% to work but didn't.

Keep trying with the password recovery utilities.

If not then the system is locked out and a reinstall is the only way forward.

You can still get your personal files off that hard drive and there are a couple of options for that;

1] Remove the hard drive, enclose it in a USB external hard drive enclosure, connect that to another Windows computer and copy off all your personal files, or

2] Use a Linux LiveCD like Ubuntu LiveCD on this laptop. Ubuntu is a version of the Linux OS that can be downloaded and burnt onto a CD as an ISO. That CD then becomes the operating system. You can then boot up the laptop with that CD inserted into Linux and copy the files off to some other external media, eg a memory stick or similar.

Not at all satisfactory I know, but these seem to be the only options you now have.

Mark

Assuming they did something in the registry (such as autologon to that account) I pointed to Microsofts standard recovery for a corrupted registry in a post above. That first replaces the registry with the initial one from long ago, then with the latest one (or any one) from System Restore. If succesfull, it certainly beats a reinstall of the OS. If not succesfull, no harm done, because the clean install will undo everything.

Kees

You're right, I didn't do more than skim that article and missed the part about how it only works with the current computer. I was thinking you could create it on another computer and then use that to reset the password, but I guess not.

So I would say I agree with Mark in that formatting and starting over seems to be your only real option here short of trying some kind of brute force password cracking program which could take weeks or months. That, or you can pay the $100 extorted from you by the people who locked the thing if you can figure out how to contact them again.

Just let this be a lesson on this kind of scam, and other social engineering scams. You and your kid(s) should probably take some time to learn about the more common types of social engineering scams so that you can recognize them in the future and avoid these kinds of problems.

In any event, once you get the system running again, I would make sure to create one of those password reset disks.