2nd user account at login screen, Should I be worried?

I was hoping to find a user folder with some log info about why the account was made.

Since there is no user folder, let's look in the Event logs:

Start > right click on Computer
Select Manage from the context menu
Once the Computer Management window opens...
...expand the tree as show below

...select the Security log (via regular click)
(wait for the middle pane to populate with data before the next step)
...then right click on the Security log
...and select Find... from the context menu.

Once the search dialog box appears, enter FDS Running and click on Find Next.


Maybe that will give us a date/time when the account was created.

Maybe you can tie that to some software that was installed or updated.

Hacb said:

hmmm... that is different then. i'll get back to you when i think of something

Thanks! :)

UsernameIssues said:

I was hoping to find a user folder with some log info about why the account was made.

Since there is no user folder, let's look in the Event logs:

Start > right click on Computer
Select Manage from the context menu
Once the Computer Management window opens...
...expand the tree as show below

...select the Security log (via regular click)
(wait for the middle pane to populate with data before the next step)
...then right click on the Security log
...and select Find... from the context menu.

Once the search dialog box appears, enter FDS Running and click on Find Next.


Maybe that will give us a date/time when the account was created.

Maybe you can tie that to some software that was installed or updated.

I'll try this now and see what comes up!

EDIT: I just tried it, and nothing popped up.

Though, I went back to the login screen to make sure I had the 2nd account name correct, and I noticed the name of the anti-theft/tracking software I use (which shows up at the login screen), that the 2nd login account, has initials that match the name of anti-theft/tracking software I use. I'm guessing that the 2nd account is associated with it. Though, I don't understand why it would be necessary for the anti-theft/tracking software to have a user-esque account login at the login screen.

In post #2, I provided a link to this thread TCP Flooding Attack Admittedly, if you did not install software from ESET, then you had little reason to click thru to that link.

Here is one of my screenshots in that thread:



Your software might not behave exactly like the description provided by ESET's software, but some of reasons for having this account are detailed in the screenshot above.

UsernameIssues said:

In post #2, I provided a link to this thread TCP Flooding Attack Admittedly, if you did not install software from ESET, then you had little reason to click thru to that link.

Here is one of my screenshots in that thread:



Your software might not behave exactly like the description provided by ESET's software, but some of reasons for having this account are detailed in the screenshot above.

I see. I have never used ESET, but if it's a security-type software, than the software I'm using probably works somewhat the same way as described in the image. I did receive the software through my university when I was a student (I'm no longer a student now though), as they were giving away free temporary licensed software for a few years. The 2nd account showed up at the login screen just recently, just never realized that the two were related until now.

ESET is company that offers an antivirus app that used to (and maybe still does) include the anti-theft module described in that screenshot. I'm not sure if ESET wrote the code for that module or if ESET bought the module from another company. Maybe you have the same software - just from a different company - the software would have a different name and maybe slightly different features.

Maybe each temporary license has expired and all computers under that temp license have been silently marked as missing by the company that offered the software deal. Marking the laptop as missing should trigger the creation of that second account. However, to be effective, all normal account(s) should have been hidden from the log on screen. The computer should have booted straight to the desktop of this second user. That second user should not have admin rights and should not be able to get to the files from "normal" account(s).

If the web based interface to this software has a test mode (e.g. simulates a lost laptop) I would suggest that you test to see if the software is still functional. If it is no longer functional, then uninstall that software.

UsernameIssues said:

ESET is company that offers an antivirus app that used to (and maybe still does) include the anti-theft module described in that screenshot. I'm not sure if ESET wrote the code for that module or if ESET bought the module from another company. Maybe you have the same software - just from a different company - the software would have a different name and maybe slightly different features.

Maybe each temporary license has expired and all computers under that temp license have been silently marked as missing by the company that offered the software deal. Marking the laptop as missing should trigger the creation of that second account. However, to be effective, all normal account(s) should have been hidden from the log on screen. The computer should have booted straight to the desktop of this second user. That second user should not have admin rights and should not be able to get to the files from "normal" account(s).

If the web based interface to this software has a test mode (e.g. simulates a lost laptop) I would suggest that you test to see if the software is still functional. If it is no longer functional, then uninstall that software.

I see, thank you for the explanation! :) I think this makes sense to me now. I'll have to check and see if the software license is still valid. Thank you for helping me in figuring this all out, I really appreciate it! Marking this thread as solved! :)

You are welcome.

I know how scary having another account show up must be.

UsernameIssues said:

You are welcome.

I know how scary having another account show up must be.

I agree!

Thank you once again for helping me! :)