Login problem

[atDFN]

I have a friend's computer that I was cleaning up. You know, spyware
and such.

When the computer boots, there's an error given about the password.
Obviously, there's a login file that's trying to bypass having to type
in the password. I'm not sure where to find this and get rid of it.
I can cancel out of the error, type in the password, and boot
normally. Can someone tell me how to find the file that's running at
bootup so I can just get rid of it?

Thanks.



ben

 

[Lanwench [MVP - Exchange]]

I have a friend's computer that I was cleaning up. You know, spyware
and such.

When the computer boots, there's an error given about the password.
Obviously, there's a login file that's trying to bypass having to type
in the password. I'm not sure where to find this and get rid of it.
I can cancel out of the error, type in the password, and boot
normally. Can someone tell me how to find the file that's running at
bootup so I can just get rid of it?

Thanks.



ben

If you can get ahold of msconfig.exe from a WinXP computer, copy it to
%systemroot%\system32, and then run it (start, run, msconfig <enter>) and
check the startup tab. Or see http://www.jsiinc.com/subi/tip4200/rh4221.htm
Also check services. What tools (and versions thereof) did you use to remove
the malware?

 

[atDFN]

If you can get ahold of msconfig.exe from a WinXP computer, copy it to
%systemroot%\system32, and then run it (start, run, msconfig <enter>) and
check the startup tab. Or see http://www.jsiinc.com/subi/tip4200/rh4221.htm
Also check services. What tools (and versions thereof) did you use to remove
the malware?

I used SpyBot and AdAware (their latest versions). The problem was
there before I ran those utilities, though. I've loaded a copy of
msconfig from my XP computer and will check out the startup tab.

Thanks for your help.


ben

 

[Guest]

Navigate thru the registry and check any strange item from

HKLM\Microsoft\Windows\CurrentVersion\Run or
HKCR\Microsoft\Windows\CurrentVersion\Run or RunServices

 

[Nicolas]

I have a friend's computer that I was cleaning up. You know, spyware
and such.

When the computer boots, there's an error given about the password.
Obviously, there's a login file that's trying to bypass having to type
in the password. I'm not sure where to find this and get rid of it.
I can cancel out of the error, type in the password, and boot
normally. Can someone tell me how to find the file that's running at
bootup so I can just get rid of it?

Thanks.



ben

Maybe autologin...
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Set AutoAdminLogon at 0

This may help : http://www.winguides.com/registry/display.php/13/