Mysterious random user account created after power failure.

[WaterKiwi]

After a power outage (Computer lost all power as well as the circuit for the room) I restarted my Windows 7 desktop to find a new user account there that I did not create. It has a random name "ohlascdrxvzd".

It does not list in the C:/Users folder, but is listed in the Control Panel: User Accounts - Manage Accounts, and on startup it is listed in the Account selection buttons.

I will delete the account from the control panel and restart the computer... I am not expecting it to go away as I have this exact problem (with a different random named user account) on another PC that lost power instead of shutting down correctly as well.

More after restart...


After the restart the Account no longer lists in the buttons to select User account on startup, but it is still listing in the Control Panel: User Accounts - Manage Accounts.


Arrrrrgh! ^ _ ^

Now I am ready to receive help.


Update info:

It is a "Standard user" permissioned account

I have not logged into the account.

The Guest account is turned off.

 

[gregrocker]

Could be created by a bloatware security suite or Updates to access the PC for auto updating.

I would uninstall any bloatware AV to install and run a full scan with free recommended Microsoft Security Essentials.

In addition I'd install free scanner, decline trial, update and run a full scan with Malwarebytes and SUPERAntiSpyware.com - Downloads

Then check System Files with SFC /SCANNOW Command

 

[WaterKiwi]

I have a clean install running Eset Antivirus - No infections found.

I have Malwarebytes already installed up to date and scanned (see the No malicious files report below).

I have run Vipre Rescue - VIPRE Rescue - VIPRE Computer Recovery Solution with no Infected files found.

I'm not running an Nvidia updaters as I have an AMD Radeon HD 7900 Video Card... nor is there an UpdatusUse user account on this system.

The account literally was created automatically at the restart after the power failure.

Is it possible that Windows would create a user account incase the primary account was corrupt when recovering from a hard shut down power loss?

Also note: Before the Power failure I was logged into an Administrator account - that account is not corrupt and works just fine still.




Here are the results from Malwarebytes.

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free anti-malware download

Database version: v2013.10.31.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16721
Soothe :: SOOTHE-PC [administrator]

10/31/2013 1:35:42 PM
mbam-log-2013-10-31 (13-35-42).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 234034
Time elapsed: 3 minute(s), 19 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)






I'm currently running SFC - I'll report after it's finished.


SFC reports:

"Windows Resource Protection did not find any integrity violations."



Downloading and running http://www.superantispyware.com/ now.

Report to follow...

SuperAntiSpyWare only found tracking cookies... deleted.


Finishing Scans then Deleting the user account "ohlascdrxvzd" again and shutting down and restarting Windows 7.

Report when restart finishes.

 

[Layback Bear]

When you power went off did you have something plugged into the computer using USB port.
Sometimes goofy things happen when card readers, external hard drives ect. are attached.

 

[WaterKiwi]

Restarted... again..

The user account "ohlascdrxvzd" is back again.

I did have several USB devices plugged in:

Drobo

UPS

Keyboard and mouse

 

[Layback Bear]

If you are sure your computer is clean I would recommend using a Restore Point before the power went off.
Any time your computer is on and sometimes off a power surge can cause all kinds of problems.

If you don't already I recommend using a quality Surge Protector.

 

[WaterKiwi]

Surge Protector UPS failed.

Strangest part... Restore is and was enabled for Operating system and was setup to create restore points every time Software was installed or updated... but - all restore points are gone... none exist now. <sigh>

 

[WaterKiwi]

Is there a way to find out what software created the user account?

 

[gregrocker]

Surge Protector UPS failed.

Strangest part... Restore is and was enabled for Operating system and was setup to create restore points every time Software was installed or updated... but - all restore points are gone... none exist now. <sigh>

There is a strange anomaly showing up lately where System Restore says no points have been saved yet in System Protection it is enabled for C. However when you click on Configure no disk space is apportioned. This is why I suggested checking first thing for infection or damage to System files.

Go to System Protection, highlight C, see if any space is apportioned for Restore Points. I'd set mine to 10% if you can afford it.

System Protection - Change Disk Space Usage

Monitor System Protection to see if this changes and if so , uninstall Eset and install MSE to compare the difference.

 

[WaterKiwi]

Dang... it was set to 0.. hence why no system restore points were ever made.

<sadness>

 

[gregrocker]

That is not the default setting. Someone or something changed it to 0.

Did you ever have another OS multi-boot set up with Win7?

I suggest setting it to 10% if you can afford it, then monitor it. If it changes again, uninstall ESET and try MSE to compare.

 

[WaterKiwi]

Is there a way to find out what software created the user account? Or why it is locked or auto created everytime I restart the computer?

 

[WaterKiwi]

I'm gonna boot into safe mode and delete the account and see if it comes back.

 

[gregrocker]

Is this the original Alienware factory preinstalled Win7 which is the worst possible install one can have?

If so I'd do what most tech enthusiasts do and Clean Reinstall - Factory OEM Windows 7 following the steps given to get and keep a perfect install. This will resolve the problem and many others caused by the preinstalled bloatware and duplicate utilities that interfere with better versions built into Win7.

 

[WaterKiwi]

Yes, original install. Ran fine for nearly 12 months until this power loss.

Interesting point: I booted into Safe Mode and delete the offending User profile. Then restarted and booted into safe mode again... The account did not appear. Then I booted into regular windows and the offending account was recreated.

I think I am going to vanilla this OS as I no longer trust it. . . unless anyone else knows how to resolve this issue.

 

[WaterKiwi]

That is not the default setting. Someone or something changed it to 0.

Did you ever have another OS multi-boot set up with Win7?

I suggest setting it to 10% if you can afford it, then monitor it. If it changes again, uninstall ESET and try MSE to compare.

No never had another OS multi-boot. It is set to 10% now.

I have had things get through MSE... I trust ESET far more than any other AntiVirus.

 

[Layback Bear]

To me with all the problems you are having my suggestion would do as Greg recommended back in post #14.

http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html#post1839164

Kill two birds with one stone. You will get rid of that pesky account plus get a proper working Windows 7.

Take a couple reads through the Tutorial By Greg. Greg has helped thousands do a clean install.

Hopefully no hardware was damaged with the power surge.
Gregs off line at the present but he is never gone long.
Do pickup up a surge protector.
Good night to you.

 

[WaterKiwi]

To me with all the problems you are having my suggestion would do as Greg recommended back in post #14.

http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html#post1839164

Kill two birds with one stone. You will get rid of that pesky account plus get a proper working Windows 7.

Take a couple reads through the Tutorial By Greg. Greg has helped thousands do a clean install.

Hopefully no hardware was damaged with the power surge.
Gregs off line at the present but he is never gone long.
Do pickup up a surge protector.
Good night to you.

Thank you, Yes - that is my plan.. I do have a UPS/Surge Protector, but it failed... bad battery I should have replaced last month when I thought about it. No surge hit the computer, but the battery back up only had 30 seconds worth of power, not enough time to shut down.

Clean install in T minus 2 days. ^ _ ^

 

[Computer0304]

Backup all files and try a clean install... but dont do it before someone else reccomends too.

 

[WaterKiwi]

Backup all files and try a clean install... but dont do it before someone else reccomends too.

Thanks for the recommendation. I am that someone. <smile>

I have done clean "vanilla" installs before, many times... Just never ran into the original problem from this post.

I am actually finished with the Clean install and I am now setting up software and doing configuration stuffs.

All is well... Just a lot of extra work to get to the place where I trust my PC again. Also, the UPS now has a shiney new battery!

Great community for Windows 7 here.. I will be back for help and/or to help others.