Windows Vista malware changed my admin password

Question

I accidentally installed malware on my computer and it changed the admin user account password. Is there any way to bypass putting in the password, so I can run anti-malware?

Answer 1

You do have a few options when it comes to getting back into your account. This assumes, however, that it is not tied to a Microsoft Live account.

1. You can use SAM RESET to remove the password on the account. You'll need another computer to download SAM RESET, and to load it onto a CD/DVD or USB drive.

http://pogostick.net/~pnh/ntpasswd/

Then you'll boot into said device, select the proper drive your account is on (it will most likely be an NTFS drive), and select the default directory for registry files (Windows/system32/config). Next, select option 1 for Password reset, and then choose the account for the password you want to clear.

You'll then quit out, saving changes that you have made.

2. You can also try using Windows repair. You'll need your installation media (CD/DVD/USB), and boot to that.

Next, you'll use the Repair your computer link, Command Prompt, and enter the following:

copy c:\windows\system32\sethc.exe c:\

Enter

copy /y c:\windows\system32\cmd.exe c:\windows\system32\sethc.exe

Enter

Exit Command Prompt. Restart your computer. When you get to the login screen, hit SHIFT 5 times, and you'll get command prompt. Type in:

net user [username here] [new password here]

Then you'll be set.

Answer 2

My first thought would be to disconnect from the internet, create a new administrator account, and run your malware scanner using that new account. Assuming you are able to get rid of the malware, you could then purchase a SATA/USB adapter and possibly copy your personal files onto another computer's hard drive. In my experience, when copying files from hard drive using this method, the system receiving the files tends to treat the original hard drive as an external hard drive with no credentials required.

After copying the files to another hard drive, log in to your new administrator account, reset the password to the old one (which would delete all of the personal files if they were still on that account), and copy your files onto the new hard drive.

My wife had a similar problem last year. I thought that I would be prompted for her credentials (which she had forgotten) when trying to access her files, but surprisingly, I was able to do this with no problem at all.