It's all about control...

Let me re-emphasize my frustration…



Scenario: My good friend lives 2 states away. Her kids messed up the computer and there is TONS of malware on it. She doesn't know what to do. She is using Windows Vista OS.

I have learned alot about computer fixes and repair over the years and have been able to help a lot of friends and family, but this is the worst case I've seen, in terms of disabled funtionality from malware.

I wanted to access her computer via remote assistance and see if I can't clean it up. BTW, I'm using XP OS.

Problem: Whatever infected her computer is messing with user permissions…presumably. Using remote assist, I went in and double checked what she was telling me…sure enough, you can change her controls from Standard to Administrative, but it just won't take affect. She can't delete any programs, install AV programs…nothing until we can fix this user permissions problem.

Question: I want to go into her computer and access her computer using the hidden built in Administrator account, but the cmd.exe way won't work because…once again, permission denied. Obviously the easy, User End way isn't working, and I assume there is a registry way, but I doubt her computer will allow access under standard user permissions (maybe I'm wrong).

How else can I access the (obviously hidden) built in Admin account? It doesn't show up on the Welcome screen or in User Accounts under Safe Mode, so it must be "hidden". It seems like it should be an easy fix, but the amount of malware on her system is tremendous and so far, the only luck we have had doing ANYTHING is being able to use Teamviewer…and that's just because she didn't have to install anything. LogMeIn didn't work, MSN Messenger doesn't work. I can't even produce a HJM log or anything because of this. I can't clean her computer from old programs, I can't make many changes because of her denied user access. Once we get over this hurdle, we move on to bigger and badder (I know, now a real word) problems

Thanks MUCHLY and look forward to working with someone on this ASAP!

Hi haypor,

You may already be familiar with the fact that today's malware often uses methods to hide itself, and to prevent the known removal utilities from removing or even seeing them.

"Sometimes" a simple renaming of a utility can fool the malware enough to allow the tool to work.
But this re-naming is more complicated than it may appear.

For instance, renaming hjt to something else like hayporlookup, won't do the trick, since hjt is already referenced in the Registry and the malware has blocked that actual path, renamed or not.

Your best course of action would be to have your friend post to our Infections Removal Forum, and have one of our excellent specialists assist.

"If" your friend insists upon you being involved, you "may" be able to follow and implement instructions from an Infections Removal specialist via TeamViewer remote control of your friend's machine.

Haypor, this permission problem is not a little "hurdle." When a machine is infected to this extreme your best option is going to be talking your friend through backing up data and performing a destructive system recovery. Trying to do anything else from remote is ridiculous. You might as well drive two states away and camp out for a couple of weeks while someone in the infections removal forum attempts to clean that computer which still might not be successful. Unfortunately, the damage is done, get the system restored new again, and then educate your friend on how to stay up to date and protected from malware. Enforce the issue that her kids should not have an administrative account on the computer, period. Using a computer is a privilege, not a right.

appleoddity, I appreciate your candid opinion in this matter. I'm actually trying to remove something on my system right now and have put her's on hold for a few days/weeks. However, are you saying that she should or shouldn't post on the Infection Removal forum? I am nowhere near an expert and that's why I've found this forum so helpful over the years. I was going to have her register on here and post her problems, but I'm not sure she's able to because she can't install any new software. It keeps saying she doesn't have the admin rights, but she SHOULD. I have full confidence in helping her through a fix with direction from one of your tech experts on here. I intend on helping her find that same confidence so that I don't have to help her the whole way.

The decision is yours. However, if it were me, I would be reformatting the hard drive. It may come down to that after a large waste of time anyways. If the goal is to have a perfectly running computer, then cleaning the infection is not the way to go in my opinion.