Strange Virus: Constantly creating new user accounts

[Jimmyman]

Yes, I ran the Windows defender offline from a bootable CD. Yeah, I'm also not going to be doing much with this computer until I can hopefully get this problem solved and I'm trying not to use the internet, and if I do, it'll be from my cellphone on a portable hotspot with WPA2 protection. I have also disconnected pretty much everything from my computer, including my 2 TB external hard drive, webcam, printer, etc.

 

[Golden]

Good idea Jimmyman - just wait for Jacee's next advice.

 

[Jimmyman]

Okay, I also noticed that the user accounts now come back after awhile in Windows from when I delete them, with a new name but the same picture. Any thoughts?

 

[Golden]

Thats the malware at work - wait for Jacee to advise before doing anything further.

 

[OldMX]

Lol, grab a live distro like ubuntu or mint and backup your files, then wipe the disk clean, I wouldnt trust that system even when 10 applications say its clean.

 

[Jacee]

Download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.

 

[Jimmyman]

I uninstalled my ESET computer anti-virus. I was trying out the Eset Release Candidate 6 and I enabled anti-theft protection. I think Eset might have a bug in that release though. The reason I think so is because when anti-theft is enabled, the computer would keep creating a false user account when restarted for an attacker to access instead of seeing the real user's account and this was supposed to protect the original user's files and settings from the attacker. The computer might have messed up and thought I was the attacker, or else something else is playing with those settings and messing it up. Since I last posted, several threats were removed with superspyware software and MSE caught a "severe" java virus and qurantined it. Thanks for all the help so far.

 

[Jacee]

Un-install all old java, you can also use Javara JavaRa | SingularLabs

Next, download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

• Double click combofix.exe and follow the prompts.
• When finished, it will produce a log for you.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
***A guide and tutorial on "How to use Combofix" can be found here:
ComboFix: A guide and tutorial on using ComboFix

IF CF won't run:
During the download, rename Combofix.exe to sVchost.exe

 

[Jimmyman]

That's some dangerous advice. I tried it and then none of my internet browsers worked (Chrome, Firefox, Internet Explorer) and some files I had were deleted as well. Are you sure combofix.exe is a safe program because it sure didn't seem to detect any viruses, just set a lot of registry values for deletion and delete a lot of files! Thankfully, I did a Windows system restore after combofix ran to minimize the damage and then still had the combofix log file. Thanks for the help but I hope that there is a better way to find malware on my computer!

 

[Golden]

Jacee is a trained malware removal specialist, and has received Microsoft MVP status for her work in this area, and she wouldn't recommend Combofix lightly.

I have no idea what the system restore would have achieved - possibly its simply restored the malware back to your computer.

You are better waiting for her advice. If you don't want to do that, then I recommend a clean install of Windows using the diskpart clean all to wipe the disk prior to installation.

Good luck,
Golden

 

[Jacee]

Download CKScanner by askey127 from HERE
Important - Save it to your desktop.
Doubleclick CKScanner.exe and click Search For Files.

After a very short time, when the cursor hourglass disappears, click Save List To File.
A message box will verify the file saved.

Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

 

[Jimmyman]

Hey, I don't have the problem anymore! No more user accounts are being created. I think that combofix helped fix my problem. Thanks for all the help everyone!

 

[Golden]

? How so? You did a system restore after you ran Combofix.

 

[Layback Bear]

Damn I hate it when 2 and 2 doesn't equal 4. What infection did combofix report and what did you do to rid yourself of it?

 

[Jimmyman]

I'm not exactly sure how combofix helped fix it. I think that the virus was either caused by that eset bug beforehand or it may have been cleaned out by Malware bytes or MSE beforehand, but just not completely cleaned out when I quarantined the virus and deleted it. It must have been in my temporary files or something but combofix helped fix that.

On second thought though, it may have been gone awhile ago and I didn't recognize it until now because I never really restart my computer that much and wouldn't have noticed untill combofix ran and made me restart my computer.

Thanks for all the help though guys. If you want to check out the combofix report Layback Bear, please look at the log file I uploaded on a previous post.

 

[Jacee]

ComboFix found and 'fixed' many infected files ... most possibly associated with P2P file sharing.

If you did a system restore after using ComboFix, they're still on your computer.

I'm kind of wondering why you didn't post the CKFiles.txt that I asked for. (need I ask more? :sarc: )

If you're going to go about using an infected computer, then uninstall ComboFix by:
(For Vista / Windows 7 users)
Copy/paste ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

 

[Jimmyman]

The CKscanner gave me these results:

c:\program files\gimp 2\share\gimp\2.0\patterns\cracked.pat
c:\program files (x86)\far cry\objects\glm\shipwreck\brokenwall\swr_mp_wall_ceiling_cracked_400.cgf
c:\program files (x86)\far cry\objects\glm\shipwreck\brokenwall\swr_mp_we_400z300xcrack.cgf
c:\program files (x86)\far cry\textures\decal\crack_broken\bulletspray.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\bulletspray_ddn.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\concrbrok.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\concrbrok02.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\crack.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\crack02.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\crack03.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\crack04.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\crack05.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\crackbroken6.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\crackbroken7.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\crackbroken8.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\crackbroken9.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\dirty021broken.dds
c:\program files (x86)\far cry\textures\decal\crack_broken\exploded.dds
c:\program files (x86)\far cry\textures\decal\noalpha\crackbroken_w.dds
c:\program files (x86)\far cry\textures\glm\corporate_buildings\wall\concr_d14crack.dds
c:\users\steven\desktop\stuff\steven\desktop\stuff 3\important stuff\articles and pictures\how to articles\driveway_cracking__how_to_concrete_resurface_quickly_and_easily.txt
c:\users\steven\desktop\stuff\steven\desktop\stuff 3\important stuff\articles and pictures\how to articles\dry__cracked_heels_-_how_to_handle_.txt

I don't know if combofix did anything then. The MSE or MB must have fixed the problem beforehand then and then I just didn't notice it until Combofix restarted my computer.

 

[Layback Bear]

Thanks for your help Jacee.

 

[Golden]

No wonder you have issues - cracked software is sure to be the cause of much of your trouble.

 

[drockmd]

Just so there is a solid resolution to this post, since it was driving me crazy for 2 weeks. I had the same problem, contacted Eset and it turns out, the version of smart security 6 is creating the phantom user.

If you sign up for their Anti theft feature, they create the phantom user so they can access your computer in case it is stolen. So the ComboFix didnt actually fix it, it just happened to be the troubleshooting step you tried right after uninstalling Eset SS6.