Locked out of my XP system - Can't log in using anything

[webgecko]

Howdy

I am running a dual boot system with WinMe and XP sp3.
I am doing this on Me. (Asus A7n8X-X mb AMD Duron 1.4GHZ
500MB DDR 80 & 120 WD HDDs Pioneer DVDRW DVR108BK etc..)

I have been using my XP system fine until the other day I ran
NAV and did a full system scan. It found w32.sober.aa@ww
which is an email worm which NAV quarantined and it also found
some back door thing but unfortunately I shutdown to restart
and I didn't get the name. I think NAV quarantined everything.

BUT the next time I try to use XP (which normally just runs desktop
with no login) I get a login screen wanting authentication.
None of my normal userid/passwords work i.e. that is
correct userid/password gets me into desktop loadup where
settings are being loaded, music comes on THEN it says
LOGGING OFF !. I can't get past the login screen.
I am locked out and for one thing I can't do any printing
under ME as my new canon PIXMA only works under XP.

I am stuck ! Is there anything I can do to get around this ?
I have access to the XP partition from Me or DOS.

I don't want to have to totally reload XP if I can avoid it.

Any help much appreciated.

Thanks

webgecko

[Panama Red]

Try getting into Safe Mode with Networking under XP and run a scan (after updating) with Malwarebytes. I don't think mbam will run on ME.

[glc]

SuperAntiSpyware 4.24 is compatible with ME.

http://www.filehippo.com/download_su...ispyware/5052/

On XP, have you tried logging in as Administrator with no password?

[webgecko]

PanamaRed

I tried all the safe mode startups but they have been disabled
(yeah I tried with networking as well).

They all end up restarting/rebooting the system so I end up back at my
dual boot menu.

Thanks for trying. Any other ideas ?

I suspect someone/something planted a startup program which kind
of says "If my backdoor has been removed/disabled then
disable logins i.e. let a valid one through then log it off straight away.

If I knew where to look in the XP partition I could maybe disable
the planted program (maybe). If they have changed DLL code
then I may never find their changes.

Anyone got any ideas ?

thanks again panamared

webgecko

[webgecko]

GLC

Yeah I just tried administrator no pwd. No joy.

I basically get to desktop startup using one username and no pwd
and administrator with a good pwd BUT after the music plays
(is that the fat lady singing ? ;0() It says LOGGING off and back we go
to the login screen.

All legitimate logins are being logged off straight away !

I don't know what to do really. I will try the spyware scans from Me.
I don't have a version of NAV I can run from Me right now.

There is bad code in there somewhere. If I can kill it then
I can avoid hours of reloading XP etc..

Help still wanted.

webgecko

[David M]

Have you tried slaving that drive to another computer and then running antimalware?

[webgecko]

Hello David

Thanks for your suggestion but I can't see how this would change anything.

I already have access to the XP partition from Me or DOS if I want to boot that.
I can run anti malware or other AV scans already from Me.
I have tried SuperAnti Spyware to no avail.

If XP code has been changed it could be very hard to pinpoint this infection.
If files have been added it's easier to spot.
BUT I still ain't sure what I'm looking for.

I need an XP code or file expert to tell me where to look and maybe what to
change.

I am still getting nowhere fast.

Any help still appreciated

webgecko

[glc]

Why can't you just do a XP repair install?

Repair Reinstallation of Windows XP (using XP CD)

Recommend you do it with a SP3 slipstreamed CD.

http://www.winsupersite.com/xp/sp3_slipstream.asp