Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Mysterious User Account Icon on Login Screen - Have I been Hacked?

15 Apr 2015   #1
skora

Windows 7 Pro 32 bit
 
 
Mysterious User Account Icon on Login Screen - Have I been Hacked?

My pc sits where I walk by it everyday. My screen saver is a digital clock.
I walk by it today and it is sitting at the login screen with a new user Icon.
The icon is listed as "David" as the user. I don't know any David's nor have
ever had a David as a user on this pc. There is no David when I navigate to
C:/Windows/Users. Nor is there a user David in user profiles. I looked at the
System Security Log and have alot of Event ID #4625. I don't know if this mean
anything or not. What should I be looking for. Have I been Hacked?

Any Help Would be Appreciated


My System SpecsSystem Spec
.
15 Apr 2015   #2
paul1149

Linux Lite 3.2 x64; Windows 7, 8.1
 
 

There would only be a folder structure for the account if there's been a log in. Right-click on Computer and select Manage, then select Local Users.... See if there's a David there, double-click on it and see what User Groups he's a member of. Especially if he's an admin it should be deleted asap.
My System SpecsSystem Spec
15 Apr 2015   #3
Layback Bear

Windows 7 Pro. 64/SP-1
 
 

Is this computer on a network or domain??

Is this computer a business or corporate computer??
My System SpecsSystem Spec
.

15 Apr 2015   #4
skora

Windows 7 Pro 32 bit
 
 

Computer is part of a workgroup. Computer is my home pc. It has been unplugged from the net since 1:00. Under users there is a David as a member of Administrators, Home Users and Users. also listed under users are Administrator, Guest, HomeGroupUser$ and my 3 actual accounts.
My System SpecsSystem Spec
15 Apr 2015   #5
Layback Bear

Windows 7 Pro. 64/SP-1
 
 

I would suggest you contact your I.T. department and notify them of your problem.

David might be a I.T. department member in your computer doing things.
My System SpecsSystem Spec
15 Apr 2015   #6
groze

W7 32 bit, Linux Mint Xfce 18 64 bit
 
 

Quote   Quote: Originally Posted by Layback Bear View Post
I would suggest you contact your I.T. department and notify them of your problem.

David might be a I.T. department member in your computer doing things.

Why would he contact the I.T. department if it is home computer unless somehow the computer is connected to his work place via vpn?

I searched google, there different theories on the case.
Protection software
The computer was connected to work by vpn
Someone has access via remote assistance
Spyware program
Virus program
Fake telephone calls from windows techinal service or similar name got access via remote assistances.


I would check with you work place to see if anyone is named David before doing any fixes.
My System SpecsSystem Spec
16 Apr 2015   #7
Layback Bear

Windows 7 Pro. 64/SP-1
 
 

I have no idea what work group a computer is hooked to.
The computer could be hooked to a computer across the world somewhere using a Cloud network or domain.

That is why I asked if the computer was a corporate or business computer.

Anyway if the computer is work grouped only to home computers their is a good chance of a infection that got into the computer. I would also check the other home computers to see if they are having any problems.

What has got me confused is that a infection seldom is so obvious that if will show itself in the fashion that skora is having. Normally they hide very well and make you look for them.
They normally don't jump up on the screen and and say HI I'm David.

It could also be someone in the home playing a joke.

skora I would run security scan like Malwarebytes and Eset on line scan and see if they find something.

https://www.malwarebytes.org/lp/lp4/...FQiRaQodvJwArg

Free Virus Scan | Online Virus Scanner from ESET
My System SpecsSystem Spec
16 Apr 2015   #8
paul1149

Linux Lite 3.2 x64; Windows 7, 8.1
 
 

It takes an administrative account to create an administrative account. Perhaps one of your other three accounts has done this, or had it done to them while they were online. There is not enough information given here to really get down to what possibly happened.
My System SpecsSystem Spec
16 Apr 2015   #9
skora

Windows 7 Pro 32 bit
 
 

I ran Malwarebytes, nothing found.

Only other home computer is a macbook. No one else in my house would even
know where to begin to make another user account. No cloud network or domain.
I'm no expert, but from what I found the event viewer, if I'm deciphering correctly
it appears that 3 different ip addresses were trying to "log in"numerous times...
218.94.113.98, 61.177.119.229, 12.251.116.246. After googling the first ip, it appears
to have a "malicious activity" connected to it. The thing that throws me off is if in fact
they were smart enough to get past my router, and past my account log ins, why would
they make a user account that can be noticed on login.
My System SpecsSystem Spec
16 Apr 2015   #10
Layback Bear

Windows 7 Pro. 64/SP-1
 
 

From post #9
Quote:
why would
they make a user account that can be noticed on login.
That is the puzzling part.

With those I.P. address you are infected in my opinion.

Run this program and see if it finds anything.

Free Virus Scan | Online Virus Scanner from ESET


I will see if I can find you a security person to give a hand.
My System SpecsSystem Spec
Reply

 Mysterious User Account Icon on Login Screen - Have I been Hacked?




Thread Tools




Similar help and support threads
Thread Forum
increase the size of user account pic on login screen
hello guys i am the only user on my laptop i want the small pics to be likehttp://www.blogsdna.com/wp-content/uploads/2009/04/windows-7-logon-for-windows-xp.jpgtohttps://www.sevenforums.com/attachments/tutorials/5895d1237182813-log-screen-change-log_on_screen.jpg + also remove the blurry effect on...
Customization
Unable to See User Account on Login Screen
I have two user accounts on my PC - Staff and Administrator. I loaded Win7 a few days ago and created the Staff account. Earlier today, I changed the Staff account from an Administrator to a Standard account. I was logged on as Staff when I did it. I then logged off and back on and when I...
General Discussion
One last try, Get rid of User Account picture on login screen.
Hi 7forum! This is my last resort, so please help me! I have after a long time searching ended up here on this forum. What I want to do is simply to remove the picture & frame on my login screen, only the password, my name, switch user should be left on the screen. To clarify, I don't...
Customization
New user account not appearing on login screen
I have added a new user account to my computer, but for some reason it is not appearing on the logon screen. Help?
Customization
login screen phantom user account
when my windows 7 32-bit laptop starts up and displays the login screen there is an account that it seems to want to default to called ./user when the OS was loaded that was the original user account. since then that account has been deleted, however it is still showing up on the login screen. i...
General Discussion
Move the User Icon on the login screen
I used the tutorial to change what the default logon screen is, which is super awesome that it was so easy to change... but I was wondering if its easy to move the size/position of the user icon? Any info would be great! Cheers
Customization


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 16:20.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App