Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Random User Accounts After Coming Off Standby


  • Please log in to reply
5 replies to this topic

#1 joetimek

joetimek

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:26 PM

Posted 02 June 2008 - 06:40 AM

It seems that every time I am coming out of standby in Win XP Home, these new random computer administrator user accounts pop up out of nowhere. They typically have garbled names, almost always involving a 't' or '$'. I just cleared a bunch of trojans off my machine...how can I stop this?

BC AdBot (Login to Remove)

 


m

#2 nigglesnush85

nigglesnush85

  • Members
  • 4,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:10:26 PM

Posted 02 June 2008 - 08:09 AM

hello,

Can you remember any of the account names?

Open control panel then administrative tools and event viewer. Are there any errors or warnings under system,security,application?
If there are double click the entry for more details.
Regards,

Alan.

#3 joetimek

joetimek
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:26 PM

Posted 02 June 2008 - 10:10 PM

There are a bunch of logon failure audits, with some of the names being jack$, ts$, t. I believe those times I tried to log onto to those user names, just to see if they somehow used my normal administrator password. Also some userenv errors in the applications category.

#4 nigglesnush85

nigglesnush85

  • Members
  • 4,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:10:26 PM

Posted 03 June 2008 - 08:40 AM

I would suggest a quick audit, http://www.pxserver.com/WinAudit.htm to do this run win audit and wait for the results page. on the left hand side there is a list, expand 'groups and users' and then open 'user accounts'. this will list all the user accounts that are on the system. Are there any in that list that you have not created?
Regards,

Alan.

#5 joetimek

joetimek
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:26 PM

Posted 06 June 2008 - 12:42 AM

I just checked the user accounts today, and about 5 showed up, all with different icons and names, such as: tommy, Brian, CN=MicrosoftCorp..., admin. These only come up after I come out of standby.

#6 nigglesnush85

nigglesnush85

  • Members
  • 4,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:10:26 PM

Posted 06 June 2008 - 06:24 AM

Does anyone have access to the system who might have created the accounts?
Also, what security products do you have installed?
Do the accounts appear in user accounts in the control panel?
Regards,

Alan.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users