Missing/disabled user accounts after restart

[Syther101]

Ok so my Mum called me up today. She had turn her computer on this morning after it working fine yesterday to find the login Window only showing the option for "Other user" and that was it.


Normally her account would be the only account on the screen and she would simply eneter her password and be done.


When she called I presumed she had just entered her password wrong too many times and the account had been locked or something.


Upon getting home I entered Windows 7 recovery mode to use the command line the enable the Administrator account so I could get logged in as typing her username manually into the "Other user" dialog along with the account password didn't work.


When prompted to enter a valid user to use the recover mode it was strange as her User was listed here but nowhere else. Entering her username and password here got me into the recovery mode options fine.


First I used net user to see if her user was listed which it was not. (Yet I had just used it to use the command line).


I then used this command to enable the Administrator user:

net user administrator /active:yes

and set a new password using:

net user administrator test

I then restarted the computer in safe mode and attempted to login as the Administrator user. Upon typing in the user information I was again greeted with a message saying the Administrator user was still disabled.

After a bit more research I gave up and used a System restore point to the day before.

My question is what would cause something like this to happen as I'm worried it may have been a virus or perhaps something to do with the update she received and probably installed the last time the computer was working?

Thanks very much for any help you can provide

 

[Layback Bear]

I'm not expert but yes it could be a infection. Some infection try to stop admin. accounts so you can't download help or use some programs to clean the computer.
It never hurts to scan for infection with several programs.

I would also look in user account and see if their are strange account that haven't been there before.

 

[Syther101]

I'm not expert but yes it could be a infection. Some infection try to stop admin. accounts so you can't download help or use some programs to clean the computer.
It never hurts to scan for infection with several programs.

I would also look in user account and see if their are strange account that haven't been there before.

Thanks for the reply .

As soon as I got the machine up and running after the system restore I did a flash scan with Malwarebytes to check over the currently running process to see if anything was bad, I then inspected the startup processes my self with Autoruns to which I couldn't see anything out of the ordinary. I then let Malwarebytes and MSE do a full scan of the computer to which nothing turned up.

My guess is she was probably in a hurry and turn the computer off during an update or something and managed to bugger it. None the less I will keep and eye on the machine over the next few days as she is also known for getting a lot of spam emails with bad attachments so it could have also been that but she is normally pretty good with not clicking them.

EDIT: Ow and yeah I checked over the user accounts. Nothing out of the ordinary there ether. Made a new administrator account simply called "Admin" so that I can login if her user goes missing again in the future.

 

[Layback Bear]

Well turning off the computer during updated can mess of all kinds of things.
The programs you used for scans are very good but here is another one I use and trust.

Free Online Virus Scanner | ESET