Can't login to computer. can't get out of Safe Mode back to Norm.

My Symantec Antivirus software informed me that I had a Trojan horse. There
were instructions on how to remove, which I followed.
1. Turn off System Restore, Go to CMD prompt, type msconfig, go to
boot.ini, change boot to boot in Safe Mode, restart computer. This is where I
ran into a
problem. When I rebooted in safe mode, I usually get a CNTRL, ALT, DLT
screen where I need to enter username and password. I entered mine and I get
an error, I can't get in now. Also tried changing username to
"administrator" leaving password blank and also trying different passwords.
Still can't get in. Also can't boot in normal mode. Attempted to by hitting
F8 on start up. Will not start in Noraml mode. Will not start in last know
good config, etc. Can't get out of Safe Mode. Need help Please.

Despite what Symantec says, you should NOT disable System Restore until your
problems have been resolved (better to have a broken Restore Point than do
Restore Point at all), at which point you would (1) disable System Restore
and then (2) immediately re-enable it (which would "flush" all previous
Restore Points).

Moving on...

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/ma...e/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/...moving_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachi...php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002


Lady A wrote:
> My Symantec Antivirus software informed me that I had a Trojan horse.
> There
> were instructions on how to remove, which I followed.
> 1. Turn off System Restore, Go to CMD prompt, type msconfig, go to
> boot.ini, change boot to boot in Safe Mode, restart computer. This is
> where
> I ran into a
> problem. When I rebooted in safe mode, I usually get a CNTRL, ALT, DLT
> screen where I need to enter username and password. I entered mine and I
> get
> an error, I can't get in now. Also tried changing username to
> "administrator" leaving password blank and also trying different
> passwords.
> Still can't get in. Also can't boot in normal mode. Attempted to by
> hitting
> F8 on start up. Will not start in Noraml mode. Will not start in last know
> good config, etc. Can't get out of Safe Mode. Need help Please.

PAS Bear,
Thanks for the information however i can't log onto the computer in
question, so how would I run the scan? and no this isn't my cup of tea :)

"PA Bear [MS MVP]" wrote:

> Despite what Symantec says, you should NOT disable System Restore until your
> problems have been resolved (better to have a broken Restore Point than do
> Restore Point at all), at which point you would (1) disable System Restore
> and then (2) immediately re-enable it (which would "flush" all previous
> Restore Points).
>
> Moving on...
>
> NB: If you had no anti-virus application installed or the subscription had
> expired *when the machine first got infected* and/or your subscription has
> since expired and/or the machine's not been kept fully-patched at Windows
> Update, don't waste your time with any of the below: Format & reinstall
> Windows. A Repair Install will NOT help!
>
> 1. See if you can download/run the MSRT manually:
> http://www.microsoft.com/security/ma...e/default.mspx
>
> NB: Run the FULL scan, not the QUICK scan! You may need to download the
> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
> machine and rename it to SCAN.EXE before running it.
>
> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
> (only!) in Safe Mode with Networking, if need be:
> http://onecare.live.com/site/en-us/center/howsafe.htm
>
> 3. Run a /thorough/ check for hijackware, including posting the requested
> logs in an appropriate forum, not here.
>
> Checking for/Help with Hijackware
> http://aumha.net/viewtopic.php?f=30&t=4075
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://www.elephantboycomputers.com/...moving_Malware
>
> **Chances are you will need to seek expert assistance in
> http://spywarehammer.com/simplemachi...php?board=10.0,
> http://www.spywarewarrior.com/viewforum.php?f=5,
> http://www.dslreports.com/forum/cleanup,
> http://www.bluetack.co.uk/forums/index.php,
> http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**
>
> If these procedures look too complex - and there is no shame in admitting
> this isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>
>
> Lady A wrote:
> > My Symantec Antivirus software informed me that I had a Trojan horse.
> > There
> > were instructions on how to remove, which I followed.
> > 1. Turn off System Restore, Go to CMD prompt, type msconfig, go to
> > boot.ini, change boot to boot in Safe Mode, restart computer. This is
> > where
> > I ran into a
> > problem. When I rebooted in safe mode, I usually get a CNTRL, ALT, DLT
> > screen where I need to enter username and password. I entered mine and I
> > get
> > an error, I can't get in now. Also tried changing username to
> > "administrator" leaving password blank and also trying different
> > passwords.
> > Still can't get in. Also can't boot in normal mode. Attempted to by
> > hitting
> > F8 on start up. Will not start in Noraml mode. Will not start in last know
> > good config, etc. Can't get out of Safe Mode. Need help Please.
>
>

Repost:
>> ...take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA) computer repair shop.


Lady A wrote:
> PAS Bear,
> Thanks for the information however i can't log onto the computer in
> question, so how would I run the scan? and no this isn't my cup of tea :)
>
> "PA Bear [MS MVP]" wrote:
>
>> Despite what Symantec says, you should NOT disable System Restore until
>> your problems have been resolved (better to have a broken Restore Point
>> than do Restore Point at all), at which point you would (1) disable
>> System
>> Restore and then (2) immediately re-enable it (which would "flush" all
>> previous Restore Points).
>>
>> Moving on...
>>
>> NB: If you had no anti-virus application installed or the subscription
>> had
>> expired *when the machine first got infected* and/or your subscription
>> has
>> since expired and/or the machine's not been kept fully-patched at Windows
>> Update, don't waste your time with any of the below: Format & reinstall
>> Windows. A Repair Install will NOT help!
>>
>> 1. See if you can download/run the MSRT manually:
>> http://www.microsoft.com/security/ma...e/default.mspx
>>
>> NB: Run the FULL scan, not the QUICK scan! You may need to download the
>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
>> machine and rename it to SCAN.EXE before running it.
>>
>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
>> scan
>> (only!) in Safe Mode with Networking, if need be:
>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>
>> 3. Run a /thorough/ check for hijackware, including posting the requested
>> logs in an appropriate forum, not here.
>>
>> Checking for/Help with Hijackware
>> http://aumha.net/viewtopic.php?f=30&t=4075
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://www.elephantboycomputers.com/...moving_Malware
>>
>> **Chances are you will need to seek expert assistance in
>> http://spywarehammer.com/simplemachi...php?board=10.0,
>> http://www.spywarewarrior.com/viewforum.php?f=5,
>> http://www.dslreports.com/forum/cleanup,
>> http://www.bluetack.co.uk/forums/index.php,
>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as
>> well.**
>>
>> If these procedures look too complex - and there is no shame in admitting
>> this isn't your cup of tea - take the machine to a local, reputable and
>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>
>>
>> Lady A wrote:
>>> My Symantec Antivirus software informed me that I had a Trojan horse.
>>> There
>>> were instructions on how to remove, which I followed.
>>> 1. Turn off System Restore, Go to CMD prompt, type msconfig, go to
>>> boot.ini, change boot to boot in Safe Mode, restart computer. This is
>>> where
>>> I ran into a
>>> problem. When I rebooted in safe mode, I usually get a CNTRL, ALT, DLT
>>> screen where I need to enter username and password. I entered mine and I
>>> get
>>> an error, I can't get in now. Also tried changing username to
>>> "administrator" leaving password blank and also trying different
>>> passwords.
>>> Still can't get in. Also can't boot in normal mode. Attempted to by
>>> hitting
>>> F8 on start up. Will not start in Noraml mode. Will not start in last
>>> know
>>> good config, etc. Can't get out of Safe Mode. Need help Please.