Meanwhile, on the OLD PC

I very rarely switch off but yesterday I did for a few hours. When I switched on about 9pm I was treated to something kinda weird. I was asked for a password, even though I have never enabled the Boot Password option But after panicking somewhat I phoned Geeker and as we were talking we realised it was after the boot up but just before Windows starts it asked for the password so I pressed f8 and loaded last good config and got on that way. Thanks Geeker.

I paid for ESET and was kind of disapointed that it did not protect me seeing that it does a scan every day. So anyway I started my quest to find out what was going on and it led me to the conclusion that I dont like ESET very much anymore. Why?, I hear you ask, well I did scans with various applications and what do you know I had a couple of trojans, minor ones and not the cause of my problem but again ESET failed to pick them up. So after doing some reading I downloaded Spy Doctor which is supposed to be the best and after finding another 2 low threat trojans I switched to safe mode and ran a full 90 minute scan. It came up with Trojan.Delf!sd6 which it has removed. Again ESET never warned about this.
Unfortunately when I reboot I am still being asked for a password so something still going on.
I could put a 7 week old backup on and forget about this, but I am a creature of habit, I dont visit many new sites and the only thing I have done lately is download NZB's off Newzbin so even if I did put a backup on I am fairly certain this would happen again so I would like to get to the bottom of it.
Can anyone help?

What version of windows ???

XP-PRO M8

That's why I got rid of ESET and installed Kaspersky.

Try running HijackThis and see if there's anything nasty running in the background.

no AV is perfect ,but obv some r much better than others

i used to use Nod32 but tbh it never found found anyhting ,so these days i stcik with AVG Free ,which also isnt amazing but imho it does a better job than nod32.

If the password is in the BIOS and that is the one being asked for which is what it sounds like ... access the Bios and simply edit out that line save and restart. That should do it.

if it comes back however ??

Eset I think still has the password function going for it .... look to see if it is in there. ( doubtful option but a place to look )

As for an A/V software all are only as good as the definitions they write ... I dont think you will find a better less resource hungry application. Althought I do perfer the older version of Eset myself.

Now that I have said that it's just my 2 cents on Eset ... opinions are like .... well you know the rest.

strange spot to find a password though .. before bootup ?

Sounds more like a startup file has been changed ... but will it happen again afterwards is the real question.



copied the below as it saved me time of typing it

Windows XP Professional
Reset the password in the Local Users and Groups snap-in in Microsoft Management Console (MMC):
Click Start
Click Run
In the Open box type
mmc
Click OK to start MMC
Start the Local Users and Groups snap-in
Under Console Root, expand Local Users and Groups
Click Users
In the right pane, right-click Administrator
Click Set Password
Click Proceed in the message box that appears
Type and confirm the new password in the appropriate boxes ( or leave blank )
Click OK

let us know how you come along .. and good luck

you could try resetting the bios with the jumper that should do the trick

I never trust a system that's been compromised -- sure, the virus might be removed, but there could be holes in the security that won't be discovered.

Do scans with some freebies like AVG8 and Avira Antivir (set the heuristics on maximum), and maybe you'll discover where it came from, but I'd still back-up, reformat and reinstall

I'm with ADL242.

Cannot say I have had much luck removing much of malware. It might seem gone, but then the proceses might just reappear.
If you want to still run that system, I would keep a keen eye on your proceses list.
If it's a boot sector virus, I believe you need a special tool to remove that, if possible.

That's assuming it's a virus of some sort.

Just adding my cents.