Appearing and Disppearing User Account

[blazah99]

Hi, I have a bit of a strange problem. I encountered a user account on my computer which I didn't recognize (SuperDuperstdw36) and because it was logged in an password protected I couldn't delete it. So I shut down my computer, turned it back on, and it wasn't there. I logged into my user account to check to go delete it but it wasn't there, nor was any user directory for it navigating my drive, all of which has me pretty concerned. I'm not sure how to handle this particular problem as it appears nothing is there, but I fear my computer has been hacked. I'm running on a an old dell with win7 professional 32-bit OS.

 

[ICIT2LOL]

Hello and welcome blazah have you run any security scans on this machine if not try these and delete any rubbish they come up with.


http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

download from bleeping computer

also scroll down the the TDSS Killer and run it form here Free Malware Removal Tools

 

[AdvancedSetup]

If there was a new user created there will be an entry for it in the Registry. There is no way they could wipe all tracks of it in time with you shutting down the computer.

This Registry key will have a list of accounts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

 

[blazah99]

I ran the 4 anti-spyware/malware programs and cleaned up what they found. However looking at the registry in the ProfileList I see 6 entries in the profileimagepath. I took a look at my other computer to see compare the differences (Both windows 7, first with prob is a 32bit Professional, second is a 64bit Home Premium) and they are as follows:

Win7 Professional 32bit;
%systemroot%\system32\config\systemprofile , C:\Windows\ServiceProfiles\LocalService , C:\Windows\ServiceProfiles\NetworkService , C:\Users\*my account* , C:\Users\*mothers account* , and C:\Users\Administrator .

Win7 Home Premium 64bit;
%systemroot%\system32\config\systemprofile , C:\Windows\ServiceProfiles\LocalService , C:\Windows\ServiceProfiles\NetworkService , C:\Users\*my account* , C:\Users\*account the store put on as it was a floor model when purchase* , and C:\Users\DefaultAppPool .

I exported the ProfileList to a text file because I'm not sure if the other data is relivent or not, however if needed i can dropbox/link the text file here for viewing. I'd also like to completely remove the account the store put on but thats another problem and not critical at the moment.

Also worth noting is when I went to view the registry on the win7 32bit machine the explorer.exe crashed, which isn't normal, and I'm thinking/wondering if its related. I looked at my event logs and saw their was a few special logins today after I had ran the 4 malware removal software.

I took the liberty of saving the most recent event logs from Applications, Security, and Audit beginning from the last startup (both table data and detail data) but the text is quite long and I'm not sure if they would be of use. Should I dropbox the event log text files and link them here for viewing?

 

[Jacee]

I encountered a user account on my computer which I didn't recognize (SuperDuperstdw36) and because it was logged in an password protected I couldn't delete it.

Windows 7 Home Premium 64bit;
%systemroot%\system32\config\systemprofile , C:\Windows\ServiceProfiles\LocalService , C:\Windows\ServiceProfiles\NetworkService , C:\Users\*my account* , C:\Users\*account the store put on as it was a floor model when purchase* , and C:\Users\DefaultAppPool

So in a 'nut-shell' they sold the floor computer to you "as is" and didn't restore the system to it's original settings?

 

[blazah99]

I encountered a user account on my computer which I didn't recognize (SuperDuperstdw36) and because it was logged in an password protected I couldn't delete it.

Windows 7 Home Premium 64bit;
%systemroot%\system32\config\systemprofile , C:\Windows\ServiceProfiles\LocalService , C:\Windows\ServiceProfiles\NetworkService , C:\Users\*my account* , C:\Users\*account the store put on as it was a floor model when purchase* , and C:\Users\DefaultAppPool

So in a 'nut-shell' they sold the floor computer to you "as is" and didn't restore the system to it's original settings?

That would be correct however that is on my other computer (64bit OS), the one that didn't have SuperDuperstdw36 (the 32bit OS) user account. The 64bit OS machine store's account is "Kiosk" which I've known about for some time but been unable to do anything about it as its hidden and password protected.