Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Appearing and Disppearing User Account

22 Sep 2013   #1

Windows 7 Professional 32-bit and a Windows 7 Home Premium 64-bit
 
 
Appearing and Disppearing User Account

Hi, I have a bit of a strange problem. I encountered a user account on my computer which I didn't recognize (SuperDuperstdw36) and because it was logged in an password protected I couldn't delete it. So I shut down my computer, turned it back on, and it wasn't there. I logged into my user account to check to go delete it but it wasn't there, nor was any user directory for it navigating my drive, all of which has me pretty concerned. I'm not sure how to handle this particular problem as it appears nothing is there, but I fear my computer has been hacked. I'm running on a an old dell with Windows 7 professional 32-bit OS.

My System SpecsSystem Spec
.

22 Sep 2013   #2

Desk1 8 Pro / Desk2 7 Home Prem / Laptop 8.1 Pro all 64bit
 
 

Hello and welcome blazah have you run any security scans on this machine if not try these and delete any rubbish they come up with.


http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

download from bleeping computer

also scroll down the the TDSS Killer and run it form here Free Malware Removal Tools
My System SpecsSystem Spec
23 Sep 2013   #3

Windows 7 Pro x64
 
 

If there was a new user created there will be an entry for it in the Registry. There is no way they could wipe all tracks of it in time with you shutting down the computer.

This Registry key will have a list of accounts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
My System SpecsSystem Spec
.


23 Sep 2013   #4

Windows 7 Professional 32-bit and a Windows 7 Home Premium 64-bit
 
 

I ran the 4 anti-spyware/malware programs and cleaned up what they found. However looking at the registry in the ProfileList I see 6 entries in the profileimagepath. I took a look at my other computer to see compare the differences (Both windows 7, first with prob is a 32bit Professional, second is a 64bit Home Premium) and they are as follows:

Windows 7 Professional 32bit;
%systemroot%\system32\config\systemprofile , C:\Windows\ServiceProfiles\LocalService , C:\Windows\ServiceProfiles\NetworkService , C:\Users\*my account* , C:\Users\*mothers account* , and C:\Users\Administrator .

Windows 7 Home Premium 64bit;
%systemroot%\system32\config\systemprofile , C:\Windows\ServiceProfiles\LocalService , C:\Windows\ServiceProfiles\NetworkService , C:\Users\*my account* , C:\Users\*account the store put on as it was a floor model when purchase* , and C:\Users\DefaultAppPool .

I exported the ProfileList to a text file because I'm not sure if the other data is relivent or not, however if needed i can dropbox/link the text file here for viewing. I'd also like to completely remove the account the store put on but thats another problem and not critical at the moment.

Also worth noting is when I went to view the registry on the Windows 7 32bit machine the explorer.exe crashed, which isn't normal, and I'm thinking/wondering if its related. I looked at my event logs and saw their was a few special logins today after I had ran the 4 malware removal software.

I took the liberty of saving the most recent event logs from Applications, Security, and Audit beginning from the last startup (both table data and detail data) but the text is quite long and I'm not sure if they would be of use. Should I dropbox the event log text files and link them here for viewing?
My System SpecsSystem Spec
23 Sep 2013   #5
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

Quote:
I encountered a user account on my computer which I didn't recognize (SuperDuperstdw36) and because it was logged in an password protected I couldn't delete it.
Quote:
Windows 7 Home Premium 64bit;
%systemroot%\system32\config\systemprofile , C:\Windows\ServiceProfiles\LocalService , C:\Windows\ServiceProfiles\NetworkService , C:\Users\*my account* , C:\Users\*account the store put on as it was a floor model when purchase* , and C:\Users\DefaultAppPool


So in a 'nut-shell' they sold the floor computer to you "as is" and didn't restore the system to it's original settings?
My System SpecsSystem Spec
23 Sep 2013   #6

Windows 7 Professional 32-bit and a Windows 7 Home Premium 64-bit
 
 

Quote   Quote: Originally Posted by Jacee View Post
Quote:
I encountered a user account on my computer which I didn't recognize (SuperDuperstdw36) and because it was logged in an password protected I couldn't delete it.
Quote:
Windows 7 Home Premium 64bit;
%systemroot%\system32\config\systemprofile , C:\Windows\ServiceProfiles\LocalService , C:\Windows\ServiceProfiles\NetworkService , C:\Users\*my account* , C:\Users\*account the store put on as it was a floor model when purchase* , and C:\Users\DefaultAppPool


So in a 'nut-shell' they sold the floor computer to you "as is" and didn't restore the system to it's original settings?
That would be correct however that is on my other computer (64bit OS), the one that didn't have SuperDuperstdw36 (the 32bit OS) user account. The 64bit OS machine store's account is "Kiosk" which I've known about for some time but been unable to do anything about it as its hidden and password protected.
My System SpecsSystem Spec
Reply

 Appearing and Disppearing User Account




Thread Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 08:45 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33