Domain Pc auto logs in?!

[kiyotaka]

Super Stealth Virus....?

Ok this is really making me paranoid.. my computer (domain account) automatically logs in , does CTRL+ALT+DEL , enters username, password clicks Ok etc.. and theres a slight delay... unless there is some setting i accidentailly triggered :|

I've gone over all of my startup services.... nothing there

just for the **** of it, I put in a Welcome message before password auth.. it breaks there but if i press ok it continues to enter password and login.. Symantec comes up with nothing, spybot comes up with nothing, Zonealarm shows no signs of anything.. AD_aware shows nothing.. My services and startup seem normal...

my computer also gets lag bursts now =| which is making me extremly annoid.. I'm going to Nuke the partion but still WTF?

 

[Win2kpatcher]

Are you sure its on a domain and not a workgroup? This is Windows XP Pro I am assuming?

 

[kiyotaka]

aye, it's on a domain.. I own a DC and have a domain in my bedroom.. (obscessed IT student)

appearantly whatever it is It played with my Registry settings, autologon, Force Noshift override (and somehow it disabled system file protection)


... And I undid settings, they got re-applied.. I'm reinstalling

Extremly Nasty Stealth virus.... I'm paranoid about what I install/open too.

Now the fun 8 hours of changing ALL my passwords.

I suspect my DC is not compromised as This is the only PC affected.

 

[Law]

You didn't by any chances do this http://www.techist.com/showthread.php?threadid=117152

Did you? What happens if you pull the client off the domain?

 

[kiyotaka]

nope.. but tagged out of interest.. This may work well with a VMWARE server
if i delete the domain accnt or change the PW it just tries to enter it errors and then flakes out.


allready restored off a Ghost image just wondering WTH kind of virus can cause this? it disabled system file protection, disabled shift override on login, and had my PW/login as auto.. it even did the CTRL+ALT+DEL bit.

any time I tried to change the registry entries they popped back.. but Every program running in task man appeared to be legit origin????

 

[kiyotaka]

Possible rootkit?

 

[baronvongogo]

do you actually see it type in a password and then click ok?

could be on auto login go to start>run and type control userpasswords2

it might have an auto login button checked.

 

[kiyotaka]

I actually saw it type a password then after a 1 sec delay it hit enter =/ if i held any key down it broke it but as soona s i let go to type it hit enter.
There were no entries under control userpasswords2 however there was some entries under winlogon but.. they kept popping back up when removed..