Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Strange Virus: Constantly creating new user accounts


23 Jul 2012   #21

Windows 7 Ultimate x64 sp1
 
 

Yes, I ran the Windows defender offline from a bootable CD. Yeah, I'm also not going to be doing much with this computer until I can hopefully get this problem solved and I'm trying not to use the internet, and if I do, it'll be from my cellphone on a portable hotspot with WPA2 protection. I have also disconnected pretty much everything from my computer, including my 2 TB external hard drive, webcam, printer, etc.


My System SpecsSystem Spec
.

24 Jul 2012   #22

Microsoft Community Contributor Award Recipient

Windows 7 Ult. x64 Windows 8.1 x64
 
 

Good idea Jimmyman - just wait for Jacee's next advice.
My System SpecsSystem Spec
24 Jul 2012   #23

Windows 7 Ultimate x64 sp1
 
 

Okay, I also noticed that the user accounts now come back after awhile in Windows from when I delete them, with a new name but the same picture. Any thoughts?
My System SpecsSystem Spec
.


24 Jul 2012   #24

Microsoft Community Contributor Award Recipient

Windows 7 Ult. x64 Windows 8.1 x64
 
 

Thats the malware at work - wait for Jacee to advise before doing anything further.
My System SpecsSystem Spec
24 Jul 2012   #25

Microsoft Windows 8.1 Professional
 
 

Lol, grab a live distro like ubuntu or mint and backup your files, then wipe the disk clean, I wouldnt trust that system even when 10 applications say its clean.
My System SpecsSystem Spec
24 Jul 2012   #26
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

Download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3
  • Disable any script blocking protection
  • Double click the dds icon to run the tool.
  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt <--- will be minimized in the task tray
  • Save both reports to your desktop.
Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.
My System SpecsSystem Spec
25 Jul 2012   #27

Windows 7 Ultimate x64 sp1
 
 

I uninstalled my ESET computer anti-virus. I was trying out the Eset Release Candidate 6 and I enabled anti-theft protection. I think Eset might have a bug in that release though. The reason I think so is because when anti-theft is enabled, the computer would keep creating a false user account when restarted for an attacker to access instead of seeing the real user's account and this was supposed to protect the original user's files and settings from the attacker. The computer might have messed up and thought I was the attacker, or else something else is playing with those settings and messing it up. Since I last posted, several threats were removed with superspyware software and MSE caught a "severe" java virus and qurantined it. Thanks for all the help so far.


Attached Files
File Type: txt DDS.txt (32.8 KB, 22 views)
File Type: txt Attach.txt (28.5 KB, 10 views)
My System SpecsSystem Spec
25 Jul 2012   #28
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

Un-install all old java, you can also use Javara JavaRa | SingularLabs

Next, download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.
  • Double click combofix.exe and follow the prompts.
  • When finished, it will produce a log for you.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
***A guide and tutorial on "How to use Combofix" can be found here:
ComboFix: A guide and tutorial on using ComboFix

IF CF won't run:
During the download, rename Combofix.exe to sVchost.exe
My System SpecsSystem Spec
30 Jul 2012   #29

Windows 7 Ultimate x64 sp1
 
 

That's some dangerous advice. I tried it and then none of my internet browsers worked (Chrome, Firefox, Internet Explorer) and some files I had were deleted as well. Are you sure combofix.exe is a safe program because it sure didn't seem to detect any viruses, just set a lot of registry values for deletion and delete a lot of files! Thankfully, I did a Windows system restore after combofix ran to minimize the damage and then still had the combofix log file. Thanks for the help but I hope that there is a better way to find malware on my computer!


Attached Files
File Type: txt ComboFix.txt (59.8 KB, 20 views)
My System SpecsSystem Spec
31 Jul 2012   #30

Microsoft Community Contributor Award Recipient

Windows 7 Ult. x64 Windows 8.1 x64
 
 



Jacee is a trained malware removal specialist, and has received Microsoft MVP status for her work in this area, and she wouldn't recommend Combofix lightly.

I have no idea what the system restore would have achieved - possibly its simply restored the malware back to your computer.

You are better waiting for her advice. If you don't want to do that, then I recommend a clean install of Windows using the diskpart clean all to wipe the disk prior to installation.

Good luck,
Golden
My System SpecsSystem Spec
Reply

 Strange Virus: Constantly creating new user accounts




Thread Tools



Similar help and support threads for2: Strange Virus: Constantly creating new user accounts
Thread Forum
Virus Creating multiple User accout System Security
Virus constantly creating new user accounts System Security
Solved Creating new user account adds TWO accounts General Discussion
Need Help in creating extremely limited User Accounts General Discussion
Strange Unknown Accounts In User list General Discussion
Solved Affected by virus, user accounts dont display System Security
Strange user accounts i dont reconize? Network & Sharing

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 03:41 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33