Printable View
Hello guys, I have a very strange problem. Instead of hiding my login password with bullets, my Windows XP shows it in plain vanilla text during login. I tried the Process Explorer from SysInternals and the Rootkit revealer, none of them shows anything obvious.
I've also rebooted my PC, the problem persists. Any ideas? I don't know what I should google for...
What is your patching state like?
Do you have an up-to-date AV running? How about sypware...have you gone through the steps to see what might be installed?
I've not heard of this, and a google search for "Windows XP Not Masking Passwords" brings up a lot that isn't nearly filtered enough, yet.
Is this XP Pro or Home
Are you in a home evironment or work???
MLF
Edit> looks like its related to some password recovery tool....sound familar???
Hi Folks, thanks for your replies! I'm running Windows XP Pro and don't have a virus scanner running. I used to run Norton Antivirus but it kept slowing down my system to a crawl... Can you recommend one? I've tried Spybot Search & Destroy 1.4 with the most current updates, it only found tracking cookies from HitsLink and WebTrends live.
I have Service Pack 2 installed and cannot remember having installed some kind of password recovery tool lately...
Howdy.
Are you using the default login screen, the blue one that says welcome?
If so then you've been hit with a trojan that puts up a fake welcome screen thus your password is seen in plain text, and then stored. Once you connect to the internet it sends your credentials via email.
cheers
f2B
Could be. Any ideas where I could find it? And how to get rid of it? Does it have a name, so I could research a bit about it?
Greeting's
The most important thing here is to know if you system is patched. It doesnt matter if you have an anti-virus or firewall you system can still be hacked into if you dont patch it. Go to windows update and update it now. ONLY HAVING SERVICE PACK 2 WILL NOT HELP PROTECT YOUR SYSTEM
Second thing if your system is patched, then do you use admin account to surf the net ? If yes, then its bad. you must never use the administrator account, if you must then use it with DropMyRights
Get more information here :
http://msdn.microsoft.com/security/s...re11152004.asp
http://msdn.microsoft.com/security/s...re01182005.asp
Anyway get an online scan done at housecall or even at microsoft. Remember to disable system restore before you do this.
Well I guess it depends on your hardware...such as memory cpu harddrive speed and conflicts with other apps on how an av would affect your system
Maybe someone else has installed a password recovery tool amongst other things on your system..
MLF
Strong local security policies can prevent this type of occurence, with or without patches.Quote:
The most important thing here is to know if you system is patched. It doesnt matter if you have an anti-virus or firewall you system can still be hacked into if you dont patch it. Go to windows update and update it now. ONLY HAVING SERVICE PACK 2 WILL NOT HELP PROTECT YOUR SYSTEM
I'm not trying to start a fight here because you are correct... But... How many times, in how many threads, are you going to use _exactly_ the same sentence without expanding on it sufficiently to be of use? It's beginning to get tiring on these old eyes....Quote:
Strong local security policies can prevent this type of occurence, with or without patches.
Rather than explain myself in every single thread, I have decided to just be an ass.Quote:
I'm not trying to start a fight here because you are correct... But... How many times, in how many threads, are you going to use _exactly_ the same sentence without expanding on it sufficiently to be of use? It's beginning to get tiring on these old eyes....
I am writing a tutorial on XP security, it is just a bit late due to time constraints at the house.
Ok... We know it's coming... Please quit repeating yourself... ;)
Hi,
It has been hinted at but not clearly stated: where is your computer located and what is its physical security ?
Like do you share it, and do other people have unsupervised physical access?
:)
Well, it's at home. I'm the only one living there. My girl friend comes for a visit often, but she doesn't have a key to my home and I'm around when she is. Also my father has a key for my flat but he's not too computer literate.
Physical security? A 60kg door :-)
Hi rck thanks for the response mate...................that rules out room mates, estranged partners or siblings messing with your machine.
You would be surprised how often that sort of thing does happen ;) I generally take the old fashioned view that if you don't have access security you don't really have any security.
What we have done is eliminate some possibilities and narrowed down the field a bit :)
Anytime. But please guys, actually my question is: How do I get back the old login screen behaviour. Please advise...
Howdy.Quote:
Originally posted here by rck
Anytime. But please guys, actually my question is: How do I get back the old login screen behaviour. Please advise...
Well your Pc has obviously been pwned, so i would suggest that you back up all important data on to CDr's or DVD disc if possible, then format and re-install windows.
Install ALL service packs, and updates for the operating system, and install a firewall and antivirus and keep them updated at all times.
And if you are downloading programs then always scan them with an antivirus, and also don't use the administrator account for every day use.
Create a limited account, and use that.
Only use the admin account to install programs etc. witch can usually be done by right clicking the icon, and selecting Run As select the admin account and you will be able to install/ run the program etc etc.
cheers
f2B
If that is all you REALLY care about!? Right click My Computer > Properties > System Restore Tab. Restore your system to a timepoint where the password didn't show.Quote:
Originally posted here by rck
Anytime. But please guys, actually my question is: How do I get back the old login screen behaviour. Please advise...
If you live alone, no one else really uses the computer, why are you typing a password in the first place? If your computer gets stolen that little password means nothing. Waste of time.
Set it to autologin and pretend nothings wrong. Then post your IP here and we will login and fix it for you. :D
Oh and one more thing. Keeping your computer without any source of power can prevent this type of occurence, with or without patches.
Not quite true. A strong Windows password would take an inordinate amount of time to crack, so a thief will just reset it. That provides you with a good line of defence if the machine is used for something illegal. It would provide "reasonable doubt" and could generally be forensically proven.Quote:
If your computer gets stolen that little password means nothing.
Sort of :D .................................turning off the power is a good idea because you have lower electricity bills and you are reducing the potential fire risk .Quote:
Oh and one more thing. Keeping your computer without any source of power can prevent this type of occurence, with or without patches.
From a security viewpoint disconnecting from the internet when not required makes your machine less attractive as a bot, because it is not reliably available ;)
Hi Sandcraft, well, it's a couple of things I care about. The main thing for me is, how can I make this go away. I'm not sure whether the system restore will work for me but I'll give it a try.
The other things of course are
1) what IS this thing?
2) how was it deployed on my server?
3) how can I prevent it from appearing again.
It is important for me to get the "default" behavior back, because there are friends coming to my place and I don't want to tell them "turn around" all the time if they are near my computer and I have to enter my password.
What I did yet:
1) doublecheck the status of Windows update. It was set to automatic, only two updates where missing (Excel and PowerPoint apparently) -- I've installed them. MS Baseline is happy now.
2) tried two different Anti-Virus programs (AntiVir and NOD32) -- both did not help
3) tried a couple of Anti-Trojan programs (a², Windows Detector, Process Guard, ...)
4) tried nmap on my Linux server, showing me the used ports of my Windows machine -- nothing special.
5) tried Spy Bot Search and Destroy -- didn't find anything either.
I've also noted, that safe mode just hangs for me, it's not working.
Hi,
That is NOT good news, and certainly points to the reformat and reinstall route :(Quote:
I've also noted, that safe mode just hangs for me, it's not working.
You might have one last shot with EWIDO:
http://www.ewido.net/en/
There is a 14 day trial of the whole thing, but you can update and use the on demand scanner after that.
For the average Joe, but I can own that thing in the time it takes to boot Austrum Latvijas Linukss and type three commands. Always plan for the worst case scenario and use strong encryption on any sensitive information stored locally.Quote:
Originally posted here by nihil
Not quite true. A strong Windows password would take an inordinate amount of time to crack, so a thief will just reset it. That provides you with a good line of defence if the machine is used for something illegal. It would provide "reasonable doubt" and could generally be forensically proven.
Sandcraft, this is not quite my scenario. At home, my password mostly serves the purpose that my visitors cannot easily enter my PC while I'm not in the same room monitoring them. This is mainly true for people I don't know about.
So my problem is, that my login password is visible to ANYONE standing next to me. And asking them for "uh, could you turn around, my password is shown" isn't exactly implying a good sense of security / "knowing what's going on" on my side.
My company notebook is a different story. We have a strict password-policy there and a help-line that would guide us through problems like this one. I don't have such a help-line at home. I rely on advice like yours to build up a good opinion about the current situation.
Hi rck
Did EWIDO find anything? I am afraid that I am starting to run out of ideas so I will summarise on my thinking so far (such as the process might be described as "thought" :D )
1. Your password is displayed as plain text. I have never actually seen that without using a tool to do it. If that is malware/spyware it is not working properly as it is advertising itself totally promiscuously? It is obvious that there is a problem, as malware tries to hide itself.
2. You have used some quite respectable detection tools for all sorts of malware and they have found nothing? All I can suggest there is that you review the settings and run them again. Make sure that heuristic detection is set to maximum and that you enable "detect security threats" where that is available (A-Squared I think?).
That last setting will detect stuff like John the Ripper, nmap, Cain & Abel, and so on, which are NOT malware but would be malicious if you had not installed them yourself. That may throw up a password revealer.
3. I am afraid that I am starting to lean towards Morgana~'s way of thinking, and that you have some sort of corruption or conflict. Please do not misunderstand me, Morgana~ is a very astute analyst and I would generally follow her line of thought, were it not that the only solution is save your stuff, reformat and reinstall.................which is a pain?
4. If you cannot get into safe mode, this also implies a corruption situation to me. OK I know some malware does this, but it really advertises itself when it does so. Stuff that crude should have been detected in the scans that you have run.
5. So, my conclusion is that unless you have some weird setting that I am totally unaware of, you would be best served by biting the bullet and reinstalling your operating system.
I presume that you have already tried restore and repair to no avail?
sandcraft
I think that you misunderstand me old chap. I already clearly stated that without physical security there is NO security. My comment was that there was a degree of protection in that no one would bother to CRACK the existing password, they would just reset it............which is what NT admins do anyway?...........unless you are envisaging some sort of MI5/MI6/GCHQ "fit up"?
I can tell you that in the defence/security sectors, we use removable hard drives so your little CD is useless :D
It is also useless with some laptops............just set the boot password, admin password and the HDD password. The first two are on an independent EEPROM chip (probably a 24C) and the last is on the HDD which is encrypted. OK I know how to, and have circumvented the first two, but the last one is a killer ;)
Howdy.
Just a thought, but have you tried to Clear the Page File at System Shutdown
Default settings allow process memory files to be paged to the hard disk in clear text form at shutdown. Although this allows more
rapid recovery of this information the next time the system is started, it’s a great place for an intruder to look for any sensitive
information, and it is displayed in plain text form.
To clear the Page File at shutdown, follow this procedure:
1.Click Start and go to settings and open the Control Panel
2.Open ‘Administrative Tools, and choose ‘Local Security Policy’ followed by ‘Local Policies’ in the left pane, and then ‘Security Options’
3.In the right pane, right click on ‘Clear virtual memory pagefile when system shuts down’ , left click ‘Security’, and choose ‘Enabled’
4.Left click ‘OK’ to save your settings, and close all open windows.
Then do a restart of the system and see if that clears it up.
And if the above does not work then this should defiantly work.
f2BQuote:
1. Place your Windows XP CD in your cd-rom and start your computer (it’s assumed here that your XP CD is bootable – as it should be - and that you have your bios set to boot from CD)
2. Keep your eye on the screen messages for booting to your cd Typically, it will be “Press any key to boot from cd”
3. Once you get in, the first screen will indicate that Setup is inspecting your system and loading files.
4. When you get to the Welcome to Setup screen, press ENTER to Setup Windows now
5. The Licensing Agreement comes next - Press F8 to accept it.
6. The next screen is the Setup screen which gives you the option to do a Repair.
It should read something like “If one of the following Windows XP installations is damaged, Setup can try to repair it”
Use the up and down arrow keys to select your XP installation (if you only have one, it should already be selected) and press R to begin the Repair process.
7. Let the Repair run. Setup will now check your disks and then start copying files which can take several minutes.
8. Shortly after the Copying Files stage, you will be required to reboot. (this will happen automatically – you will see a progress bar stating “Your computer will reboot in 15 seconds”
9. During the reboot, do not make the mistake of “pressing any key” to boot from the CD again! Setup will resume automatically with the standard billboard screens and you will notice Installing Windows is highlighted.
10. Keep your eye on the lower left hand side of the screen and when you see the Installing Devices progress bar, press SHIFT + F10. This is the security hole! A command console will now open up giving you the potential for wide access to your system.
11. At the prompt, type NUSRMGR.CPL and press Enter. Voila! You have just gained graphical access to your User Accounts in the Control Panel.
12. Now simply pick the account you need to change and remove or change your password as you prefer. If you want to log on without having to enter your new password, you can type control userpasswords2 at the prompt and choose to log on without being asked for password. After you’ve made your changes close the windows, exit the command box and continue on with the Repair (have your Product key handy).
13. Once the Repair is done, you will be able to log on with your new password (or without a password if you chose not to use one or if you chose not to be asked for a password). Your programs and personalized settings should remain intact.
Well, yes. 709.278 objects, 8.659 infected. Hmmm.Quote:
Will post a follow-up, just came home from my office to see this result.
-edit- most of them tracking cookies except one. EWIDO thinks, one of my Photoshop-pattern files is a trojan (?)
Why would a trojan give itself away so easily? I believe you, it just seems strange to me.Quote:
Originally posted here by .:front2back:.
Howdy.
Are you using the default login screen, the blue one that says welcome?
If so then you've been hit with a trojan that puts up a fake welcome screen thus your password is seen in plain text, and then stored. Once you connect to the internet it sends your credentials via email.
cheers
f2B
Please be a trifle cautious old chap, some of these tools are "over sensitive"Quote:
Well, yes. 709.278 objects, 8.659 infected. Hmmm.
I actually posted a warning about A-Squared a few days ago.................it is OK now folks, they have fixed it and version 2.0 is available..............still free to private users ;)
I am not involved with ANY free software that I might suggest, other than possibly as a beta tester ; I certainly receive NO remuneration :eek:
rck
Try just renaming that one for the moment, and see what happens? ;)