Notifications
Clear all

A "Can you fix my machine?" question.

7 Posts
3 Users
0 Likes
398 Views
(@roncufley)
Posts: 157
Estimable Member
Topic starter
 

This is not a forensic question, this is a "You know about computers, can you fix my machine?" problem.

A laptop belonging to the local Church and ridddled with viruses was given to me to fix. I attached the drive to my sheep-dip machine, removed the viruses and put the drive back in the laptop. Everything went OK, booted the machine, no password prompt, in fact no account prompt. I then cleaned up the registry and defragged the drive. The next time I booted I was taken through the account/password screen. I know that I was not asked for a password the first time because I don't know what it is.

Cleary I can defeat the password but I am interested in why this happened. Any ideas?

Thanks
Ron

 
Posted : 24/02/2009 4:47 pm
Jamie
(@jamie)
Posts: 1288
Moderator
 

Perhaps related to a change in the registry when you were cleaning it up? e.g. removal of saved profile info or a change to the default logon procedure?

Jamie

 
Posted : 24/02/2009 4:57 pm
(@fuzed)
Posts: 93
Trusted Member
 

what OS is the machine running?!

 
Posted : 24/02/2009 5:10 pm
(@roncufley)
Posts: 157
Estimable Member
Topic starter
 

what OS is the machine running?!

Sorry, I should have said Win XP SP2.

 
Posted : 24/02/2009 5:14 pm
(@fuzed)
Posts: 93
Trusted Member
 

could be profile related!!?! maybe the profiles that were on there have been deleted some how…

Seen XP do some very very strange things in my time of using it (esp with profiles)…. have a dig around and see if there are any corrupted profiles on the machine..

 
Posted : 24/02/2009 5:25 pm
Jamie
(@jamie)
Posts: 1288
Moderator
 

Ron,

I feel I need to refer you to this video for further explanation of the behaviour you're seeing wink

Jamie

 
Posted : 24/02/2009 9:08 pm
(@roncufley)
Posts: 157
Estimable Member
Topic starter
 

Thanks, Jamie. That explains it all. The answer is always so simple once you know what it is.

 
Posted : 24/02/2009 9:28 pm
Share: