Windows login page bypassed (not by me)

[Jsizzle]

Started my computer.
Windows login pages comes up requesting my password.
I go to get something to eat (1omins or so).
When I come back my desktop is showing, not the Windows login page requesting my password.
I don't have the greatest memory but I am fairly certain ( I could be wrong, however) that I never put my password in.
I'm very concerned.
Currently running Malwarebytes and then Norton Security Scan, will post results.
Advice?
Any way to tell who put the password in?

 

[richc46]

Can you be set for automatic login (no login)?
http://www.vistax64.com/tutorials/66966-logon-automatically.html
http://news.softpedia.com/news/Bypass-the-Windows-Vista-Logon-Screen-51806.shtml
Check the settings

If it continues to happen
Try in safe mode
Try with clean boot
http://support.microsoft.com/kb/929135
To test if problem happens in these modes.

Report the result of the scans-anti virus and malwarebytes

You may have inadvertently put the password in. If you cannot find the cause of the problem. Wait until it happens again to be sure.

Type event viewer in search and look for any errors at the time

 

[Lorien]

Hi Jsizzle,

There's no way to tell who put in the password. Is there anyone in the house who could have done it (even if you think they don't know your password)?

I would test this a couple of additional times to see if it repeats. Does the computer continue to login automatically after 10 minutes or so or does it remain on the logon screen until you enter the password (give it 30 minutes or so)? Please do check this a few times and post the results. How many users are there on the computer? How many are standard users and how many are administrators? Is the built-in administrator account enabled? Is the guest account enabled? What type of account is your account?

Running the scans (be sure to update them first and do full scans) is an excellent idea and I would have suggested it if you weren't already doing it. Please do post the results (screenshots or attaching copies of the logs would be fine).

After this (and the recommendations and possibilities Richard suggested above), we'll see where we stand and what if anything needs to be done. Try not to be too concerned. We'll figure this out if it repeats, we'll bring in a security expert if the scans turn up anything nasty, you'll verify nobody else in the house did it (somehow), you'll try Richard's suggestions, and if it doesn't continue to occur and none of these things turn up anything suspicious, then maybe you did forget and there's no problem at all. Please do answer all our questions in your next post.

Thanks and good luck!

 

[Jsizzle]

Norton Scan Results:

Scan Stats:
Scan Time: 6691 seconds
Scan Options:
Scan Targets: C:\, D:\
Counts:
Total items scanned: 673,332
- Files & Directories: 667,065
- Registry Entries: 594
- Processes & Start-up Items: 5,441
- Network & Browser Items: 224
- Other: 4
- Trusted Files: 0
- Skipped Files: 21,060

Total security risks detected: 1
Total items resolved: 1
Total items that require attention: 0

Resolved Threats:
Trojan Horse
Type: Compressed
Risk: High (High Stealth, High Removal, High Performance, High Privacy)
Categories: Virus
Status: Fully Resolved







Malwarebytes Scan:
Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes

Database version: 5592

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

1/24/2011 8:35:00 PM
mbam-log-2011-01-24 (20-35-00).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 358100
Time elapsed: 1 hour(s), 13 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 8
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\.pox (Rogue.FixTool) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\pofile (Rogue.FixTool) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\program files\perfect optimizer (PUP.PerfectOptimizer) -> Not selected for removal.
c:\program files\perfect optimizer\Backup (PUP.PerfectOptimizer) -> Not selected for removal.
c:\program files\perfect optimizer\Backup\application (PUP.PerfectOptimizer) -> Not selected for removal.
c:\program files\perfect optimizer\Backup\Registry (PUP.PerfectOptimizer) -> Not selected for removal.
c:\program files\perfect optimizer\Backup\Registry\firstbackup (PUP.PerfectOptimizer) -> Not selected for removal.
c:\program files\perfect optimizer\Backup\Registry\fullbackup (PUP.PerfectOptimizer) -> Not selected for removal.
c:\program files\perfect optimizer\Backup\Service (PUP.PerfectOptimizer) -> Not selected for removal.
c:\program files\perfect optimizer\Temp (PUP.PerfectOptimizer) -> Not selected for removal.

Files Infected:
c:\Users\\downloads\perfectoptimizer_5.2.6.exe (PUP.PerfectOptimizer) -> Not selected for removal.
c:\program files\perfect optimizer\perfectoptimizer.ini (PUP.PerfectOptimizer) -> Not selected for removal.


There was no one in the house at the time who could have done it.
I am the only one who uses the computer.

I have the one and only administrator account.

The guest account is turned off.
The built-in administrator account is not enabled.




Thanks,
Look forward to your replies.

 

[richc46]

I am very cautious when it comes to my own computer use. What has happened to you, to be honest, has never happened to me, but if it did I would not be overly concerned.
What I would do is look at the tutorials that I have given you and make sure that my computer was not set for automatic login. If it were, I would change the settings.
I would then go to the event viewer (type those words in search) and look for any warnings, errors or information notations that would explain the strange scenario that you describe.
If everything seems ok, I would just use and enjoy the computer in the way that I usually do.
If it does not happen again, I would forget about it. Every computer, from time to times malfunctions, could be due to a power surge or many other factors.
If it does happen on a regular basis I would use the computer in a clean boot mode (explained in my earlier post) or safe mode if necessary and if it turns out that in these modes there is no problem with login, then I would test. We have tests for corrupted drivers, programs, etc.
For now, we must make sure that the malware that was found by malwarebytes is removed (I doubt if that was the cause).
I have a feeling that this will not happen again, and I do not think anyone logged in, while you were gone, although a distinct possibility.

 

[Manyenya]

Hi try and see if your password auto-login is check marked in 'Ease of Access' centre.

 

[richc46]

From the tutorial given above

5. To Turn Off Automatic Log On

A) Check the Users must enter a user name and password to use this computer box. (See screenshot below step 6)

B) Click on OK.

C) Your done.
​

 

[Jsizzle]

When I try to alter Automatic Login I get this screen.

But I am almost positive I do not have Automatic Login enabled. At my Login Screen, you have to type in a login name and then password. You don't select a user then put password in.

Thanks for all the help. I'll keep you updated if anything happens.

 

[richc46]

The only thing that you can do at this point, is to use it in your normal way. If the problem does not return just use it and forget about it. You may have even put the login pasword in and then walked away. There are too many variables here to take time thinking about it, if it does not occur again.
If it does happen again, that would be another matter.

Has all the reported malware been removed?