WinXP Home SAM damaged?

So, there I am sat in my office today when in walks a user with her home box. The story is that they can't log in any way they try. Questioning proves that they have reasonable internet habits, Norton's Securuty Suite etc. etc. etc. The fun thing is that this happened before and they didn't know what else to do but to run the repair, (Read: reinstall), CD that, needless to say, lost all their data.

NP, thinks me.... I boot it up and it comes to the welcome screen.... But there are no names... I click around in case someone has been clever enough to hide a username there.... None. I hit CTRL ALT DEL and after doing it 10 times or so up pops the normal login box with "Owner" already typed in the username... I hit enter and bingo, I'm in. Turns out Owner is a limited/guest account. I try the old "AT 3:30pm net localgroup administrators Tiger_Shark /ADD" and get an "Access denied"... POOH!!!

Not to be outdone I get out my Password Reset floppy and boot to it. When I open the SAM I find an "issue".... Users listed:-

HelpDesk, (or whatever it is called)
Laura (Her)
Mark (Her Hubbie)
Owner (The un-passworded limited/guest account)

Glaringly absent is the Administrator.... It is my understanding that in XP Home the admin can't be deleted, (like any other system), but it can be renamed or reduced in "rank" but only if another user is promoted to admin status.....

I don't believe that these two would mess with this kind of thing.... She is very careful, (call her a worrier), about this though I don't know him..... Bearing in mind that this is the second time this has occurred I have some questions before I start working on it again because when I logged in as him the box all but froze and there wasn't much going on - It wasn't plugged into the network which _may_ have contributed to the freeze.... At this point I decided that since it was already past 4:15 that a trip to the Satellite office and a message posted here might be a wise way to proceed.... So, the questions:

1. Are my assumptions correct about XP home that the Admin can't be deleted?

2. Has anyone seen this behaviour before, (no users listed at "Welcome" screen, no admin account), if so do you have any insight, solutions, theories?

3. While I can't think of any virus that does this I can't pass up the thought of a trojan or other malware..... Anyone hear of any Trojan/Malware that might display similar behaviour?

4. If the SAM is damaged, (thus the no users on the "Welcome" screen), and there is no system recovery set up, (it looks like SP2 and it's on by default there right?), then the SAM can't just be replaced... obviously.... But could it be deleted? Would the system recreate the SAM with a blank admin password or is the system foxxed?

TigerShark,
I have seen this on a relatives computer. It would also, at times, show the user name but wouldn't accept the password. Sometimes it would allow me to log in without any problems. It was a Compaq that was bought from Walmart. I wanted to blame this on a virus, or SP2. The relative admitted to me that he had been to a few XXX websites. His wife swears it is his fault. I scanned the PC with Norton and AVG. He used Mcafee. Nothing was found. Scanned for spyware too. It had the usual stuff...nothing major. I did get it to let me log in, and saved pictures and some documents for them, then reformatted and re-installed the OS. I didn't know what else to do. When I saw this post, it naturally caught my attention. I googled for SP2 problems. I really think it was somehow related to SP2. But SP2 had been installed weeks before the problem occured. I also wondered if the SAM and Sysem files could have become corrupt from an impropper shutdown because that has happened to me in the past on a Windows 2000 box. It appeared to have hung up during shutdown while "saving settings". So I impatiently powered it off. But that caused an error during bootup which identified the files that were damaged. (Sam and System)
If you solve it, please post your findings.

Good Luck!

I'm pretty sure that this lady isn't a secret porn surfer..... I'm inclined to believe that the husband isn't but I am fully aware that spouses aren't always that honest with eachother when it comes to internet use.... ;)

She had pe-contacted me and I told her to tell all the users of the box that I would be "investigating" it and would report to her what the box has been used for and that if they have any "problems" it might be better for them to "come clean" up front rather than have her have to tell them what a "dumbass" they may be.... Yes, they could be lying still, but she brought in the box with a "story" that implied it was all "good".

Seen this on a xp pro sp1 box ........................X-FILES????????????
I did a format and clean install after a vew hours trying to figure out what caused it.
What i remember .....i simply did delete the admin(drunk)..........restart.........still no admin

TS,

Don't know if these will help or not...

http://www.kellys-korner-xp.com/win_xp_passwords.htm
Administrator and User Passwords in Windows XP

http://www.connectedhomemag.com/Home...rticleID=24808
Where Is Windows XP's Administrator Account?

http://www.kellys-korner-xp.com/xp_wel_screen.htm

http://forum.iamnotageek.com/history.../627776-1.html

if they do, great...if they don't, ignore.

Egal:

Thanks.... The second link is really making me wonder about XP Home, (never really used it). From what it says the admin should be "there" in the SAM but might only be available from safe mode... It wasn't. I tried that... *SIGH*

The third link will be the first thing I try on monday... Slave the drive off and see what I can mess with...;)

You said, in another thread that we won't go back to, that you don't know anything about computers, (paraphrased). Needless to say I received a "You have to spread your AP's around" message a minute ago.....

Thanks....

I would've hit him for ya TS, but I don't have near the pounce your ap stack does, and I also received the 'gotta spread 'em around' message... maybe Gore'll happen in and handle it on our behalf.

One of the things that i've noticed is that, it is possible to replace the SAM file with an earlier SAM file of that box. I have a backup of the SAM which i keep in a floppy. Incase the SAM file gets messed up somehow, all one needs to do is to replace the SAM using a live cd or just by entering the command prompt mode !. A cracked SAM file is one's unlimited passport to the box it was taken from. I'm not sure about deleting the administrator part. But isn't it possible to manually edit the SAM file or something and delete the administrator part???

Cheers

I know I'm mostly preaching to the converted here but I'll post it anyway.

1) Correct & SAFE mode always displays privileged account(ADMIN)

Quote:

---

Originally posted here by Trusted Facility Manual aKa "Administrator's and User's Security Guide"
Admin
Cannot change his or her own account type to limited unless there is at least one other user with a computer administrator account. This ensures that there is always at least one user with a computer administrator account on the computer.

---

Quote:

---

Originally posted here by Tiger Shark
Has anyone seen this behaviour before, (no users listed at "Welcome" screen, no admin account), if so do you have any insight, solutions, theories?

---

2) I'll give a simple theory. An Admin installed some type of jerryrigger spoof login theme ;) (process would be clearly in the taskmanager).

Quote:

---

Originally posted here by Trusted Facility Manual aKa "Administrator's and User's Security Guide" C2 Level Security
All users should always press ctrl+alt+del before logging on. Trojan horse programs designed to collect account passwords can appear as a logon screen that is there waiting for you. By pressing ctrl+alt+del you can foil these programs and get the secure logon screen provided by Windows NT.

Use separate accounts for administrative activity and general user activity. Individuals who do administrative work on the computer should each have two user accounts on the system: one for administrative tasks, and one for general activity. For example, viruses can do much more damage if activated from an account with Administrator privileges.

The key to Windows NT security is the user accounts. :)

---

Dang !mitationRust! you beat me to it!

start into safe mode and there should be a default admin account... also, on a security point of vew, you should always give this a password, otherwise it is a huge physical security risk!!

There is no default admin account when I log into safe mode.... It comes up with Owner again.... But Owner is a restricted account.... I just had a thought - it's an ownership issue - but I have dismissed it because of the permissions I found the Owner did have.... They are accurate per a limited account.

Rather than speculate could someone do me a favor and go here, d/l and make the floppy and then take a look into the SAM on WinXP Home and tell me what you see....

TS if ya do the drive slave thing later, let us know how it turns out please? Kinda curious if this is a viable workaround.

TS,

This seems to have alot of information regarding SAM...I thought it might be useful to spark some ideas...

http://neworder.box.sk/sam_index.php
NewOrder - computer security and networking portal

Eg

Quote:

---

Download the Windows XP powertoys from Microsoft's site. The program contained within, TweakUI, let's you add the administrator to the XP Welcome Screen with the other users' icons.

---

Don't know if that will help, I got that off another forum... Hope it does! :D...

Quote:

---

Rather than speculate could someone do me a favor and go here, d/l and make the floppy and then take a look into the SAM on WinXP Home and tell me what you see....

---

Xp Home, one active account, guest account not active.

RID. 01f4 username: Administrator. *password*
RID. 03ec username: Me
RID. 01 fs username: guest. *password*
RID. 03e8 username: Help Assistant *disabled or locked*
RID. 03ea username: support_388945a0 *disabled or locked*
RID. 03ef username: support_3f15ab9 *disabled or locked*

After you are done messing around with I am sure you know about windows Repair mode... NOT RESTORE. I have seen issues similar to this at several clients homes and never really took the time to investigate fully into it. I usually just pop in the xp home disk restart act like I am doing a normal install and it will say that a previous version of windows was detected and will ask if I want to repair it.. just say yes and it will go through and reinflate the cabs and do some other stuff then you just run through the setup again and all their data will still be there and all the windows files will be replaced so it should act "normal" again

Just for interest attached is a copy of a SAM file from an xp home box. Grabbed using knoppix std.

Jinxy: Thanks man... I thought there were some others missing too but I never played with XP Home so i wasn't sure... I need to ask if they did any account deleting but I'm pretty sure they didn't, (well, I'm pretty sure she didn't).

Interesting too... all the passwords are blank..... More to look into...

Spyrus:

Yeah, I know but this one interests me since this is the second tim ein a couple of months this happened and it really shouldn't.... The only time I have ever been locked out of a Win2k+ box is when this dumbass forget the password he gave it... :o Thus, rather than just fixing it, I want to see if I can find the cause. I've warned them that it may take a week or more to determine the cause and then it might be inconclusive... They can live with that, they don't use it that often she says.

Tiger,
bare in mind, I have a Dell and one of the accounts listed is Dell help and support.
Have you been able to get at the task manager to see what they have running? If not try pviewer from the server 2003 support tools. As you do not have to install it.

Jinx: I won't see the box till monday and it's a Gateway.... I'll update you all when I get back to it....

Thanks for all the thoughts so far... everyone....

Quote:

---

Originally posted here by Tiger Shark
Users listed:-
HelpDesk, (or whatever it is called)
Laura (Her)
Mark (Her Hubbie)
Owner (The un-passworded limited/guest account)

Glaringly absent is the Administrator...

---

This is totally illogical captain ~ Spock
What did the list look like when you ran

Code:

---

control userpasswords2

---

?

And when you get the box back the Event Viewer might shed some light.
To tell you the truth I've never managed to screw up a OS like this,;)well I'll take that back, in 91 on Windows 3.1 I was on a BB online playing Strip-Poker..... nevermind.

I'm sorry...I regret that I can come up with no other logical alternative." ~ Spock

Good Luck

OK... These are my notes/observations to date..... I'm confuddled unless I have unknown malware... Can anyone see anything glaringly obvious before I run a repair?

Pre-Note: This is not a forensic investigation per se. I'm looking for why rather than who or what?

Quote:

---

NOTE: Having left the PC on all weekend it required restart. It was not connected to the network. Entire task bar was missing and it required CTRL ALT DEL to initiate a restart. Odd! It shouldn't be that unstable.

Reran Password Reset. Users and RIDS:-

Help Assistant, (RID: 03ec) *Disabled or Locked*
Laura XXXXXXX, (RID: 03ee)
Mark XXXXXXX, (RID: 03ed)
Owner, (RID: 03ef)

None of the RIDS match an Administrator RID per Egals information. RIDS start at 03e8 so there have been other users that are now deleted because RIDS e9, ea, eb are missing? None of the passwords "appear" to be set per Jinxy's post.

Theory: Since the Administrator can't be removed without another admin being present has someone deleted the admin?
Test: Log in as each user and determine permissions
Result: Logging in as Laura generates an "Error: Installation Failed".The box itself is _very_ slow. Logged in as Laura I attempted to view the users through the control panel. Computer locked up.... This is messed up but it implies damage to the SAM and an underlying process at this point. The computer is much faster under Mark's context but after trying to switch user the computer will not accept CTRL ALT DEL. Pressing the power button gives an "Other users are logged on" message, (Is this normal even though the logoff from Mark appeared to be normal, (SYSTEM?)?). As Owner the computer is also fast. None of the three can view the security log.

Theory: Norton AV is causing an Issue
Test: Check it's settings
Result: I cannot change the setting in limited user context. Last system scan 2/18/05, liveupdate set to auto last defs 2/18.05. Taskmgr indicates no exceptional activity by NAV components.

Theory: Norton Internet Security is causing an Issue
Test: Check it's settings
Result: I cannot change the setting in limited user context. Security, Personal Firewall and IDS are all on. Privacy, ad blocking and anti-spam are all on. No unusual component activity.

At this point I tried to close Systray Items... MSN Messenger informed me that other apps are using messanger functionality. Is this normal?

Theory: Malware affecting computer.
Test: Run Hijack this in the context of owner to see if there is anything "odd".
Result:

04 - Global Startup: Install pending files.LNK = c:\program files\sifxinst\sifxinst.exe

http://securityresponse.symantec.com...ad.chekin.html

Interesting.... The drive is coming out since I cannot connect this to my network to extract data but I need some of it to properly document it.

Dir of c:\program files\sifxinst

03/07/2005 10:29a <DIR> .
03/07/2005 10:29a <DIR> ..
11/20/2004 11:09a 94,208 DoMore 1.PWR
03/04/2005 04:20p 94,208 DoMore 2.PWR
03/07/2005 09:14a 94,208 DoMore 3.PWR
11/20/2004 11:09a 94,208 DoMore.EXE
11/20/2004 11:09a 1,662,976 DoMore.PWR
11/20/2004 10:58a 569,344 SIFXINST.EXE
11/20/2004 10:58a 94,208 XPPrinter.exe
7 File(s) 2,703,360 bytes
2 Dir(s) 7,313,469,440 bytes free

Drive slaved. SIFXINST folder copied to secondary drive. Scanned with BitDefender. No results. Scanned with The Cleaner 4.1 fully updated. No Results.

Looking at the strings for sifxinst.exe and domore.exe indicates that this is an installer package from LANovation and domore.exe is actually the picturetaker product belonging to LANovation

This is a Gateway Computer and there is an app Gateway uses called domore….
XPPrinter googles nothing sensible….

That domore 3.pwr would most probably have been created when I logged in as Laura

I found a copy of the SAM in the repair folder. It is only 16kb but strings shows an administrator account. The existing SAM was 256kb… Drive back in original box. Login denied as administrator. Back to Password reset. Damn. Password Reset indicates only the help assistant RID: 03ec. That's really odd... At one point there was only one user in the SAM and that user was disabled.... How could that be?

Put drive back in this box to do complete scans of drives.

BitDefender complete scan found:-

E:\Documents and Settings\Owner\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe Infected Application.Adware.PowerReg.3.0

Not an issue

While the scan took place I submitted the files to viruscan.jotti.org. All were inconclusive.

Complete scan with The Cleaner… Nothing found

The oldest system restore is 2/27/05 same date as the other bad SAM file from the repair folder.

---

as an 'off the wall' approach ........
would it be possible for someone to access the box from across the web, and as THEY had admin rights, they screwed with the owners heads by deleting the physical admin ?

it IS possible to bypass Norton / MacAfee ?

[edit]
It is XP home, so the admin is only available in 'safe' mode.
user accounts are admin or limited

off the top of my head I cannot think of anything that fits the bill bar that first paragraph.

What net connection do they have ? broadband ? continious [easier to gain access throuh a big pipe that NEVER shuts.]

This box was damn good for a home user's box.... I think she's been listening to me... :cool:. I found one piece of spyware..... that's pretty damned fine unless there is unknown malware there that nothing is detecting.

I think she's cable but the firewall, IDS, AV etc. were all on and up to date. Frankly, I'm baffled. I went ahead and tried to repair hoping it would fix the SAM for me.. It didn't. So I did a reinstall which is still running..... I've only done that because I can;t think of another way of repairing the SAM such that the existing permissions etc. don't get messed up. It's really not worth the hassle to go much further. If it happens a third time I will have all the notes etc. to refer back to and compare and I have told her that if it does happen again that she shouldn't do anything to try to fix it, just bring it in.

[EDIT]

Oh, I forgot... none of the event logs go back past 3/4/05 so they don't take me back to the 2/27/05 point which is where the things seemed to be going funny.... Shame really... there had to be something in there

[/EDIT]

you know I was smelling a RAT.. or a kernel Hijack.. but what you have found dosen't seem to fit..
if you had a win.ini or system.ini that had a "shell= explorer; XXXX.exe" I wouldn't have been suprised.. or a hijacked userinit file.. .. so I am no help

Undies:

Yeah.... I'm with you... But if it's that deep then it's a reinstall anyway and since it's a home box with no remote access but a user that does work at home then carries or emails it in I'm giving up.... Like I said, it's not a forensic investigation... ;)

The user just reported the same thing has happened again......

I'm utterly out of ideas......

Is there anyone here that didn't see this thread before that would like to review it and see if there is something I'm missing......

Hi,

This thread reminded me of something that happened with my PC a while back (long shot though and feel free to laugh at the cause of my problem)

When i moved house the mains plug for the pc was no longer hidden behind it and so very easy to access. Because of this (and cause i look things to be properly off if possible) i started turning it off and unplugging from the wall each night. Something that i then noticed about my the box was that every time i plugged it back in it would power up for a second and then turn off. (i guess just the way my power supply works) anyway after a couple of months it started acting "odd" (things like random crashes, even while do nothing etc) until eventually one day i turned it on and the users were all screwed up. (one wasn't there, others wouldn't work etc) So as i don't know that much about the depths of windows i eventually got in in safe mode backed up and formatted.

Anyway i figured just one of those things kept turning it off etc and lo and behold a couple of months later same deal. I now don't turn the mains off each night (obviously shut down but just not flicking the wall switch) and she works as good as gold again. Been going fine for a year now.

My thinking was that if like you think the users of the computer aren't silly and actually do all they can to stop spyware viruses etc then maybe it isn't that, maybe its something as simple as a piece of hardware coming near to the end of its life, or like for me, just the way the machine was powered on each day.

Hope that you do find the solution to this and please do post it as its very intriguing.

Matt

Ts

It was mentioned before, however the symptoms seem to point in this direction:

Quote:

---

Persistent Rootkits
A persistent rootkit is one associated with malware that activates each time the system boots. Because such malware contain code that must be executed automatically each system start or when a user logs in, they must store code in a persistent store, such as the Registry or file system, and configure a method by which the code executes without user intervention.

---

If you haven't allready done one, I would recommend a scan withRootkitrevealer


Also, if you get a chance this time, have a look at the event logs.I am using Pro, so don't know if this is useful on Home, but try control userpasswords2 at the run command, it will open the user accounts window, there is a secure logon feature in Pro not sure for Home.

Quote:

---

Also have they used remote assistance at any time:
You can change a Windows User Account password that is on any Windows computer from any other Windows computer regardless of whether the User Account is on a workstation, a stand-alone server, or a Windows domain controller. Additionally, it makes no difference whether the password being changed from a workstation, a stand-alone server, or a Windows domain controller. This is true for any NT 4.0, W2K, XP Pro and Windows Server 2003 computer.

You do not have to be logged on from the User Account Database that contains the Username, and you do not have to be currently logged on with that Username. This procedure is especially useful if you want to change your password in a User Account Database or security accounts manager (SAM) that is not in your default logon domain.

---

Quote:

---

This procedure is allowed even if the User Right “Access this computer from network” is disabled for the group Everyone. Changing a password does not use resources on the server. The ability to change a password without requiring the user to be logged on allows a user to change his or her password outside of the user’s logon hours, or when the password has expired and the user is not able to log on.

---

Quote:

---

Add Administrator Account to Log In Screen
When Windows XP is first installed it requires you to enter at least one name of a user who will access the computer. Once you create this name the default Administrator account vanishes. To access it, press Ctrl-Alt-Delete twice at the Welcome screen to retrieve the standard Windows 2000 logon dialog. Log on as Administrator from this point. To log the Administrator off, click [Start] [Log Off] and [Log Off] when the [Log Off Windows] selection box appears. The Log On screen with the available users will be displayed.


To Make the Administrator Account Always Visible on the Login Screen
[Start] [Run] [Regedit]Registry Key: HKEY_LOCALMACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListModify/Create the Value Data Type(s) and Value Name(s) as detailed below.Data Type: DWORD// Value Name: AdministratorSetting for Value Data: [0 = Disabled / 1 = Enabled]Exit Registry and Reboot


Bypass The Windows XP Log On Screen
To make logon an unattended process:
Click [Start] [Run] and type control userpasswords2 Click [OK]
The [User Accounts] Property Sheet displays.
On [Users] tab, clear the [Users must enter a user name and password to use this computer] check box.Click [Apply].
Enter a user name and password that should be used to logon automatically in the dialog box that appears.Click [OK].
Go to [Control Panel] [User Accounts] [Change the Way Users Log On and Off].
Uncheck [Use the Welcome Screen] and [Use Fast User Switching]

---

http://www.theeldergeek.com/missing_...or_account.htm

Just an aside IMHO Norton is bloatware, have they recently upgraded their version of Norton, if so then this may be the culprit, as it seems intermittent, try uninstalling Norton and replacing it with AVG or Avast and see if over a period of time anything happens. :p

Tiger,

Is there any warning before this happens, such as BSODs etc? All symptoms suggest the damage could be being caused be the system recovery process.

Norton Internet Security 2005 has an issue with one of Microsoft’s hotfixes, for instance. Which will BSOD the system.

As the lady seems to be switched on, is she running user accounts as restricted? If this is the case and the OEM seems to have renamed the Administrators account Owner (with restricted privileges) or deleted the Administrators account.

If this is the case the box would not have an account with admin privileges. Perhaps the problem lie’s here?

ShipMA: I've thought about a hardware issue but I can't see how it would hit the SAM in a similar fashion three times. The box has been re-installed with the repair disk twice now and updated numerous times - the SAM would _have_ to have moved even if it only offset by 1 byte on the disk. The chances of hardware failure causing such a specific error in a single file three times on the trot through a re-install are pretty remote even if the repair disk is a simple image. I have to discount this as highly improbably.

dalek: The rootkit _shouldn't_ be able to survive two reinstalls because the disk is formatted and she loses her data - she backs up regularly to CD - can you believe that for a home user.... :). Furthermore, Windows rootkits are not common simply because of the complexity required to create a stable one that will work on any box regardless of configuration. Then it would be required to call home because she has an external router/firewall and finally what would be the motivation of an attacker to do silly mischief like this and raise the chances of her reformatting and installing from something other than the Gateway repair disk thus losing him the box.... Again, I put this down as highly improbable.

Jinx: No, no BSOD's or other "oddities" and yep, the two accounts are restricted as is the owner account hence the problem with being unable to do anything sensible on the box when this happens. It wouldn't be an issue if we could just add a new user as Admin but we are prevented by the account restrictions.

As it stands I have told her to go ahead and run her repair disk because I can't spend the time trying to find a cause for this issue having already spent so much time previously. If it's malware then it's pretty damned sophisticated to be able to get to the SAM in any way other than reading it. Changing it, even if it is screwing it up rather than successfully acheiving some nefarious goal is yet more sophisticated and is way beyond my level of skill simply because if he can attack the SAM he's also going to have done a fine job of hiding his malware's existence or this would be common knowledge.

I was just hoping for some luck in finding someone new coming across this and being able to explain it..... As it is it just goes in the "Odd, inexplicable, but I have to move on and hope that I run across the solution sometime in the future" file..... It's the longest label in my filing cabinet.... ;)

Just a thought.

Ask the user if she restored anything from backup prior to the "crash" Perhaps she is restoring something that is causing the issue.

Kicks and giggles, scan the backup media.

TigerShark,

I've only seen a problem like this with PC Anywhere installed/running but it was after an upgrading a system to XP Home a few years ago and ended up removing PC Anywhere.

I know you've filed it away in the file with the label that wraps around the file twice :) but in case you have an urge to dig into this again ...

Have you tried to have them restore to a point prior to this latest corruption? Were there any errors listed in the eventsviewer if you got in this time?

Since it has happened on several occasions, maybe have them create a backup SAM once everything is back to "normal".

I did see this article which may be of use:
http://support.microsoft.com/default...b;en-us;312131

This isn't directly related to the issue but may provide some further options to investigate as your time permits:
http://support.microsoft.com/default...;en-us;q307545

My gut feeling is, (I’m a cynical bugger) this could well be an issue built in. Accidentally on purpose.

To insure the system goes back to the point of sale for repair/service. I have never come across an OEM box that does not restore without an Administrators account.

This is not beyond the bounds of possibility, just look at all the custom builds of XP that are available via P2P.

She tried the usual attempts, (safe mode etc.), and was in the same position as before. She then did the restore from the gateway disk and it worked fine... again... OK.... She asked me if she should just get a different install media such as the original system disk for Win XP Home... I told her it would be a good idea to try that..... I guess we'll see if this happens again in a month or so....

Why do I have the horrible feeling it will raise it's ugly head again???? :mad:

Hi

It just came to my mind that the pc with win xp home has got the same file infected many times even after reinstalls. The hardware on the pc has been the same all the time. So it can be that a TSR(Terminate and Stay Resident) virus.

A TSR virus will load into memory and can infect all programs that are executed by the computer. Anyhow a TSR virus can certainly spread a lot faster compared to a Non-Resident Virus. Because a NON-Resident Virus will only infect file each time it is ran. Though the NON-Resident will start off very slowly infecting the system files but after the virus is in the system after a number of weeks, it will certainly infect ALL files that are in the system. Where a TSR virus will USUALLY infect files that are executed.

Quote:

---

After loading them (by launching an infected program for example), they fix themselves inside of the computer's memory (RAM, Random Acces Memory), and they get control over the machine. Inside of PCs, there is a kind of memory which users can't directly access to. I'm talking about ROM memory (Read Only Memory) which can't be updated or written but only read. This means that no program can change it. Inside of this memory there is the BIOS (Basic Input Output System), just a program - or even better, a set of programs - which handle all the machine's main operations. The BIOS for instance - whenever you start your PC - read the first floppy's sector (if you have put it into its drive, of course) and if it doesn't find any floppy, looks inside of the hard disk searching for that record indispensable to load the operating system. The BIOS reads the RAM. The BIOS 'reads' the characthers which you type on the keyboard and then display them on the screen. All these functions are handled by BIOS programs, called 'services'. Programs can use these services by means of 'interrupts'. An innterrupt is' - as you can easily understand by its name - a temporary break of all things the machine was doing till that moment, to execute something of more important. For instance, when you press a key, the keyboard causes an hardware interruption, in other words, the keyboard asks the machine to handle the 'key-pressed' event. Any program was running before, is stopped, a BIOS program handles that event and, soon after, all stopped activities can resume. All that happen thousands of times and you don't notice anything! There are many kind of interruptions, and each of them is needed to handle a particular event, such as reading pressed keys, writing on the screen, writing into the disk, reading of RAM and so on. Well, a TSR virus, once placed itself inside of the RAM, intercepts all system's interrupts, and, before calling real BIOS programs to handle a certain event, it launchs itself. Soon after it calls the real BIOS program, so nobody can notice its presence.

---

Quote:

---

Each virus is recognizable by its 'identification sttring', that is a kind of virus' finger-print, composed by the first statements of the virus (remember: a virus is just a program). Well, many viruses try to hide themselves, by encrypting their code; in this way antiviruses can't detect them! This kind of viruses have a encryption algorithm to hide their statements, and decrypt them just a second before they are runned. Whenever a virus is launched, it encrypt itself, every time in a different way. But cryptography algorithm, is always the same, so antiviruses can detect it.

---

There might be a possibility that the pc's RAM may be infected by such a virus that targets SAM.

Why not try some other OS on the pc . Like windows pro or even linux. This might tell something.

You need just replace SAM with SAM from "system volume information" folder that stores restore information, or use files from "%windir%\repair" folder. Other way can be to create new user from bootcd and then use that account if possible, to restore others settings and passwords.

Here is from microsoft:
http://support.microsoft.com/default...;en-us;q307545


RAM damaged, mainboard damaged,PCI cards or HS's , or even if CD/DVD damaged or some other parts that able to generate "block access" to file (memory holes in system).

Hi Again,

When you mentioned that she was gonna try a different install media it reminded me of another issue i had with a different PC.

Back when Win 98 was king i purchased a brand new PC from Tiny (company in england that has now gone bust due to crap computers but they were new then so noone new they were crap) Anyway this machine would run fine for a half hour and then freeze. After doing a couple of restores with THERE cd i called there tech support. Basically they ended up coming out three times and in total they changed:

HD
CD
RAM
Power Supply
Graphics Card
Processor

and still the damn thing wouldn't stop crashing. Anyway my Dad had a work copy of Win 98 so we tried that and the machine worked beautifully, no crashes or anything. By that time we had got so peed off with tiny that we were in the process of sending it back anyway but it was nice to finally know that actually it was there build of 98 that was causing all the problems and nothing else.

Anyway the point of the story was that she might well be on to a winner by using an origional XP Home and not the gateway build as there might be an inherent problem with it like my tiny one did.

No real help, but a nice/ammusing story anyway ;)

Matt