All you need to do is boot into ROM Monitor mode. Depending on the telnet software you use will need to press a key combo to enter it.
Now I don't know the steps for the 4000 series, though I imagine they can't be much different than a 2600 series router.
I'm going to list the steps for a 2600 series which should point you in the right direction. For this purpose I am assuming you will use Windows Hyper Terminal.
Consider the router's config register is set to 0x2102 or 0x102. Essentially they're the same. Cycle the power on the router and press the break key on your keyboard within 60 seconds of the router beginning the boot process.
For hyperterminal it is Control+F6+Break or Control+Break.
At the Rommon 1> prompt type: confreg 0x2142
At the Rommon 2> prompt type: reset
When the router boots up again, it should ignore it's config file in nvram. Press CTRL-C to skip the initial config.
Enter enable to go to the priveleged exec mode.
At this point you can either type :
erase startup-config file
which will erase the startup-config in nvram
or
copy startup-config running-config
show run
Look for the unencrypted passwords, you can use these. Any encrypted passwords will have to be re-entered.
To re-enter any encrypted passwords try this:
conf t
for secret:
enable secret yourpassword
for normal password:
enable password yourpassword
and so on for the other passwords for vty, console and line.
The final step is to type the following:
config-register 0x2102
CTRL-Z or End
copy running-config startup-config
Now reset your router. Passwords should be gone. :) Hope this helps you out.
