Mysterious User Account Icon on Login Screen - Have I been Hacked?

[skora]

My pc sits where I walk by it everyday. My screen saver is a digital clock.
I walk by it today and it is sitting at the login screen with a new user Icon.
The icon is listed as "David" as the user. I don't know any David's nor have
ever had a David as a user on this pc. There is no David when I navigate to
C:/Windows/Users. Nor is there a user David in user profiles. I looked at the
System Security Log and have alot of Event ID #4625. I don't know if this mean
anything or not. What should I be looking for. Have I been Hacked?

Any Help Would be Appreciated

 

[paul1149]

There would only be a folder structure for the account if there's been a log in. Right-click on Computer and select Manage, then select Local Users.... See if there's a David there, double-click on it and see what User Groups he's a member of. Especially if he's an admin it should be deleted asap.

 

[Layback Bear]

Is this computer on a network or domain??

Is this computer a business or corporate computer??

 

[skora]

Computer is part of a workgroup. Computer is my home pc. It has been unplugged from the net since 1:00. Under users there is a David as a member of Administrators, Home Users and Users. also listed under users are Administrator, Guest, HomeGroupUser$ and my 3 actual accounts.

 

[Layback Bear]

I would suggest you contact your I.T. department and notify them of your problem.

David might be a I.T. department member in your computer doing things.

 

[groze]

I would suggest you contact your I.T. department and notify them of your problem.

David might be a I.T. department member in your computer doing things.

Why would he contact the I.T. department if it is home computer unless somehow the computer is connected to his work place via vpn?

I searched google, there different theories on the case.
Protection software
The computer was connected to work by vpn
Someone has access via remote assistance
Spyware program
Virus program
Fake telephone calls from windows techinal service or similar name got access via remote assistances.


I would check with you work place to see if anyone is named David before doing any fixes.

 

[Layback Bear]

I have no idea what work group a computer is hooked to.
The computer could be hooked to a computer across the world somewhere using a Cloud network or domain.

That is why I asked if the computer was a corporate or business computer.

Anyway if the computer is work grouped only to home computers their is a good chance of a infection that got into the computer. I would also check the other home computers to see if they are having any problems.

What has got me confused is that a infection seldom is so obvious that if will show itself in the fashion that skora is having. Normally they hide very well and make you look for them.
They normally don't jump up on the screen and and say HI I'm David.

It could also be someone in the home playing a joke.

skora I would run security scan like Malwarebytes and Eset on line scan and see if they find something.

https://www.malwarebytes.org/lp/lp4/02_r/?gclid=COiDvIKl-sQCFQiRaQodvJwArg

Free Virus Scan | Online Virus Scanner from ESET

 

[paul1149]

It takes an administrative account to create an administrative account. Perhaps one of your other three accounts has done this, or had it done to them while they were online. There is not enough information given here to really get down to what possibly happened.

 

[skora]

I ran Malwarebytes, nothing found.

Only other home computer is a macbook. No one else in my house would even
know where to begin to make another user account. No cloud network or domain.
I'm no expert, but from what I found the event viewer, if I'm deciphering correctly
it appears that 3 different ip addresses were trying to "log in"numerous times...
218.94.113.98, 61.177.119.229, 12.251.116.246. After googling the first ip, it appears
to have a "malicious activity" connected to it. The thing that throws me off is if in fact
they were smart enough to get past my router, and past my account log ins, why would
they make a user account that can be noticed on login.

 

[Layback Bear]

From post #9

why would
they make a user account that can be noticed on login.

That is the puzzling part.

With those I.P. address you are infected in my opinion.

Run this program and see if it finds anything.

Free Virus Scan | Online Virus Scanner from ESET

I will see if I can find you a security person to give a hand.

 

[NoelDP]

Try this -
Open an Elevated Command Prompt, and run the following commands

REG QUERY HKU
DIR C:\Users
DIR C:\Users /AH

post the results


Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.