Strange, when I opened the file it opened to my .etvx location in event viewer.
If you can't figure out any of those ID's, try going to friendly view and copy/paste that into notepad and post.
Just saw your post.
Okay, let us know how its going.
Your welcome.
Here are some log files from my VM - hope this will help.
I'm not sure whats happening, but when I opened either your (UI) or lcz's .evtx logs it comes up with my machine name.
Surprisingly it has been ESET causing the phantom account. Re-Enabled the Anti-Theft feature, and wouldn't you know it, a random account came up again. Wouldn't have ever noticed it if I didnt reboot my computer and was asked to log in. In either case, Thanks for all the help!
I'm not sure that ESET has this anti-theft feature working just right. They ask you to pick a name for the account and they fill in the field with an example of "John". It does not matter what name I put in, the name created on the computer has a random name. ESET tells you to pick a name that won't look suspicious and yet the create a very suspicious looking name.
There are some other flaws in the way ESET has implemented this - but I don't have time to go into that now.
I think there may be more than a single flaw with ESET security, but in the end, it was near free when I purchased it. Otherwise I was just using Microsoft's Security Essentials.
Quote