XP Pro user accounts missing - new one added

Discussion in 'Software' started by seanomac, Aug 21, 2009.

  1. seanomac

    seanomac Private E-2

    Hello. My mother called with a problem and I don't really know where to start. I'm sure she has some kind of virus or malware, but I can't log in to try to remove it. She rebooted her computer today and when the login screen appeared, her account and the administrator account had disappeared. There is now an account for someone else and it is password protected!! I thought she could reboot in safe mode, but this also requires her to log in and she only gets this random person's account.

    Has anyone seen something like this before? Is there a way to log in and delete this new account and restore her account as well as admin? Is there a way to perform a system restore without being logged in? I'm lost.

    Thanks.
     
  2. captcha

    captcha Private E-2

    Use this to clear the password from that account and then log in. I would unplug any network connections as it appears she has been compromised.
     
  3. hrlow2

    hrlow2 MajorGeek

    How and where did she get the machine? Used from a store or from a friend?
    Do you or she know the person who has the account?
    What (if any) defenses were in place to let something like that happen?
    Had she used any type of registry cleaner(which I don't recommend)?May have removed something that it didn't need to.
     
  4. thesmokingun

    thesmokingun MajorGeek

    is this in the welcome screen? if so, you can hit ctrl-alt-del twice to bring up the traditional login screen and login that way.
     
  5. seanomac

    seanomac Private E-2

    Thanks for the replies. Here is a little update. I don't live there, so I've been trying to help her troubleshoot over the phone.

    The computer is about 5yrs old. A family friend built it for her. She basically uses it to surf the internet and despite the antivirus programs I load and the warnings I give her, she seems to get infected with something every month. About 3-4 months ago I wiped out the whole computer and reloaded XP Pro and installed Symantec to help with these problems.

    I'm not sure of the history of this problem, but she rebooted and now her login and the Admin login are missing. There is an account called TS and it is password protected. The only thing related to TS I could think of was Terminal Server. I remembered she could CNTL ALT DEL and get her login that way. This appears to work, of course now she can't remember her password!!! I'll check in with her today to see if she was successful in remembering it. Senility is not a good thing.

    Does anyone know what this TS account might be or how it would get there?
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds