Solved 2nd user account at login screen, Should I be worried?

[Rhaxia]

Hi Everyone!

I noticed that I have an additional account shown at my login screen. It's not a user account I created, and it doesn't show up under Control Panel>User Accounts. The only thing that shows up in the User Accounts page is my user account (shown as admin), and a guest account (shown as off).

I'm wondering if I should be worried about this second user account shown at the login screen, or if there was a way to remove/hide this 2nd user account from showing up at the login screen? I'm not sure how it came/shown up in the first place. I'm hoping someone can explain this issue to me and/or help! Thanks!

 

[UsernameIssues]

Your forum system specs indicate that you use Avast for your antivirus app. However, did you ever use ESET? If so, then please see this post. If not, then use Windows (file) Explorer to see is there is a user folder (C;\Users\username) for this additional account. If there is a user profile folder for this additional account, then the date on that folder and its sub-folders might give you a clue about how long the user account has been active.

 

[Rhaxia]

Your forum system specs indicate that you use Avast for your antivirus app. However, did you ever use ESET? If so, then please see this post. If not, then use Windows (file) Explorer to see is there is a user folder (C;\Users\username) for this additional account. If there is a user profile folder for this additional account, then the date on that folder and its sub-folders might give you a clue about how long the user account has been active.

Hi UsernameIssues! I have never heard of nor have used ESET. I have checked to see if there was a user folder under C:\Users for that extra account, and there isn't one, just my user folder and a public one.

 

[UsernameIssues]

If you only see two folders
(similar to this):



Then please follow the steps here:
http://www.sevenforums.com/tutorials/394-hidden-files-folders-show-hide.html
For step 2, also uncheck Hide protected operating system files:




Then the Users folder should look more like this:



If there are no odd folders in there, then let's wait for others to post ideas for you.


You can set the folder options back to the way that you had them - if you wish.

 

[Hacb]

what is the name of the account

 

[Rhaxia]

If you only see two folders
(similar to this):

View attachment 367926

Then please follow the steps here:
http://www.sevenforums.com/tutorials/394-hidden-files-folders-show-hide.html
For step 2, also uncheck Hide protected operating system files:

View attachment 367927


Then the Users folder should look more like this:

View attachment 367928

If there are no odd folders in there, then let's wait for others to post ideas for you.


You can set the folder options back to the way that you had them - if you wish.

Thank you for your help so far!

I just checked the user folder again just now, using the instructions you gave me, and I still didn't see a user folder with the name of the 2nd account shown at the login screen on my computer.

 

[Rhaxia]

what is the name of the account

Hi Hacb! The name of the 2nd account shown on the login screen is called "FDS Running"

 

[Hacb]

are you on a school or work issued mchine, they can often have other logins from the servers they use

 

[Rhaxia]

are you on a school or work issued mchine, they can often have other logins from the servers they use

It's my own personal computer.

 

[Hacb]

hmmm... that is different then. i'll get back to you when i think of something

 

[UsernameIssues]

I was hoping to find a user folder with some log info about why the account was made.

Since there is no user folder, let's look in the Event logs:

Start > right click on Computer
Select Manage from the context menu
Once the Computer Management window opens...
...expand the tree as show below

...select the Security log (via regular click)
(wait for the middle pane to populate with data before the next step)
...then right click on the Security log
...and select Find... from the context menu.

Once the search dialog box appears, enter FDS Running and click on Find Next.


Maybe that will give us a date/time when the account was created.

Maybe you can tie that to some software that was installed or updated.

 

[Rhaxia]

hmmm... that is different then. i'll get back to you when i think of something

Thanks!

 

[Rhaxia]

I was hoping to find a user folder with some log info about why the account was made.

Since there is no user folder, let's look in the Event logs:

Start > right click on Computer
Select Manage from the context menu
Once the Computer Management window opens...
...expand the tree as show below
View attachment 367932
...select the Security log (via regular click)
(wait for the middle pane to populate with data before the next step)
...then right click on the Security log
...and select Find... from the context menu.

Once the search dialog box appears, enter FDS Running and click on Find Next.
View attachment 367934

Maybe that will give us a date/time when the account was created.

Maybe you can tie that to some software that was installed or updated.

I'll try this now and see what comes up!

EDIT: I just tried it, and nothing popped up.

Though, I went back to the login screen to make sure I had the 2nd account name correct, and I noticed the name of the anti-theft/tracking software I use (which shows up at the login screen), that the 2nd login account, has initials that match the name of anti-theft/tracking software I use. I'm guessing that the 2nd account is associated with it. Though, I don't understand why it would be necessary for the anti-theft/tracking software to have a user-esque account login at the login screen.

 

[UsernameIssues]

In post #2, I provided a link to this thread http://www.sevenforums.com/system-security/279775-tcp-flooding-attack.html#post2303020 Admittedly, if you did not install software from ESET, then you had little reason to click thru to that link.

Here is one of my screenshots in that thread:

Your software might not behave exactly like the description provided by ESET's software, but some of reasons for having this account are detailed in the screenshot above.

 

[Rhaxia]

In post #2, I provided a link to this thread http://www.sevenforums.com/system-security/279775-tcp-flooding-attack.html#post2303020 Admittedly, if you did not install software from ESET, then you had little reason to click thru to that link.

Here is one of my screenshots in that thread:

Your software might not behave exactly like the description provided by ESET's software, but some of reasons for having this account are detailed in the screenshot above.

I see. I have never used ESET, but if it's a security-type software, than the software I'm using probably works somewhat the same way as described in the image. I did receive the software through my university when I was a student (I'm no longer a student now though), as they were giving away free temporary licensed software for a few years. The 2nd account showed up at the login screen just recently, just never realized that the two were related until now.

 

[UsernameIssues]

ESET is company that offers an antivirus app that used to (and maybe still does) include the anti-theft module described in that screenshot. I'm not sure if ESET wrote the code for that module or if ESET bought the module from another company. Maybe you have the same software - just from a different company - the software would have a different name and maybe slightly different features.

Maybe each temporary license has expired and all computers under that temp license have been silently marked as missing by the company that offered the software deal. Marking the laptop as missing should trigger the creation of that second account. However, to be effective, all normal account(s) should have been hidden from the log on screen. The computer should have booted straight to the desktop of this second user. That second user should not have admin rights and should not be able to get to the files from "normal" account(s).

If the web based interface to this software has a test mode (e.g. simulates a lost laptop) I would suggest that you test to see if the software is still functional. If it is no longer functional, then uninstall that software.

 

[Rhaxia]

ESET is company that offers an antivirus app that used to (and maybe still does) include the anti-theft module described in that screenshot. I'm not sure if ESET wrote the code for that module or if ESET bought the module from another company. Maybe you have the same software - just from a different company - the software would have a different name and maybe slightly different features.

Maybe each temporary license has expired and all computers under that temp license have been silently marked as missing by the company that offered the software deal. Marking the laptop as missing should trigger the creation of that second account. However, to be effective, all normal account(s) should have been hidden from the log on screen. The computer should have booted straight to the desktop of this second user. That second user should not have admin rights and should not be able to get to the files from "normal" account(s).

If the web based interface to this software has a test mode (e.g. simulates a lost laptop) I would suggest that you test to see if the software is still functional. If it is no longer functional, then uninstall that software.

I see, thank you for the explanation! I think this makes sense to me now. I'll have to check and see if the software license is still valid. Thank you for helping me in figuring this all out, I really appreciate it! Marking this thread as solved!

 

[UsernameIssues]

You are welcome.

I know how scary having another account show up must be.

 

[Rhaxia]

You are welcome.

I know how scary having another account show up must be.

I agree!

Thank you once again for helping me!