Computer Hacked: Account Limited (NO admin)?

I think my girlfriend's computer got hit by a virus or something recently. She ran a KIS 7 system scan and it found 2 virus (some trojan + printer.exe virus). Both have been put in "quarantine" until it's determined that it's safe to permanently delete.

The main issue is that her user account no longer has ADMINISTRATOR rights. She can no longer access the Control Panel, can't right-click into Properties, can't bring up the Task Manager, etc. She's getting a pop-up saying that it's a "limited account" and she needs to be logged in as an Administrator to access those things.

Can someone please tell me how to restore "COMPUTER ADMINISTRATOR" rights back to her current account? Can this be done in SAFE MODE (log in as Administrator) or is it a Registry Tweak that is needed?

Any help/info is greatly appreciated.

p.s. what's a good site to post Hijack-This logs for analysis?

 

Birdman,

Check the whole thread, probably SubInACL - http://www.windowsbbs.com/showthread.php?t=59082
They've got a section where you could ask beforehand - http://www.windowsbbs.com/forumdisplay.php?f=41


GF

 

^^ No luck. I tried some other suggestions (through "Googling") and nothing got resolved.

I hoped that by creating another ADMIN account....I could DELETE the current user account and go from there. However I got a 80070402 ERROR message when trying to delete the user account.

Also I logged into "Administrator" in SAFE MODE and it showed the other user acct as a "computer administrator"......but it's still telling me that it's a LIMITED ACCOUNT and won't let me access the Task Manager, Control Panel, Properties, or anything else.

Is there another way to RESTORE admin rights back to that account?

Thanks.

 

You need to post a HijackThis log over some forums( not over here!).

 

Birdman, my always more than obvious shortcut (which you of course considered) is reinstall the whole thing. 1st backup all important files and programs, then see if there are any settings to be kept. If nothing special - just do it nike.

The best buy i made, when reading things like this, is my external HD.
Still haven't settled on an imaging program, but it's also not crucial for me, for now. But this really does make the next big problem easier to solve (planning ahead so it won't be a problem again).

What do you think, or why is this not ideal? Too much work you figure?

Cheers

 

I agree. U can go for easier n better way. Format and re-install. Make an image backup, test it by doing a restore and u r ready to go!

 

There WILL be an admin account (unless you are on a domain).

Can you run the management console ("mmc" from start menu -> run) ? if you can get to that you can get to local users and set passwords there.

http://home.eunet.no/~pnordahl/ntpasswd/ is a good guide on how to reset ANY password.

If you simply need to find the password of any local user, I have been recommended this: http://ophcrack.sourceforge.net/ (if you need a list of local users run "net user" from a command prompt.

I have also seen this: http://internetbusinessdaily.net/how-to-hack-a-window-xp-admins-password/
dunno if it works or not though.