Invisible Administrator?

I like helping out local friends and neighbors at cleaning their computer problems up as it keeps me learning new things but I'm not a computer programmer in anyway shape or form. I only use other company's software to find the problems and remove the nasty buggers as they are found (hopefully not having to do many manual procedures). Well today I came across a new one for me that I was hoping you all could lead me in the right direction on.

The computer I looked at today had the ussual trojans, malware and such with 1 key logger. Using various programs like Ewido, SuperAntiSpyware, Pestpatrol, PcCillan and various other this computer looked crystal clean but I went to install Microsoft's Baseline Security Analyzer 2 to give it another angle to check from. When I tried to install it, it said this area was used by another folder and couldn't install???? Not even an option to overwrite??? So I went into Explorer with show all hidden files and folders selected and there was no file named as such. So I tried installing this program under a different file path with the same result and still got the same. So I gave up and instead installed Microsoft's Baseline Security Analyzer 1 and it installed without a hitch but after running it I found 1 thing I didn't like. It said there was more than 2 administrators on this computer. I immediately went to the control panel under user accounts and there was 1 and only 1. It was Dayle (administrator). No other active accounts at all. So I went back into Baseline Security Analyzer and clicked results for more than 2 administrators and here was the result:

Administrator
S #### ### ### ####
Dayle

Administrator is normal. Obviously Dayle is normal. But the S with all the numbers behind it is not nor is not being allowed to install Microsoft's Baseline Security Analyzer 2 for the above reason and I have no idea on how to proceed from here. Can anyone point me in the right direction to get this figured out please.

Thanks in advance for any reasonable reply's.

 

I was able to do the scans in safe mode without any problems and SpyBot did find quite a few things. I just finished with the Panda scan so I am posting the first 3 reports now and will continue as per instructions to the best of my ability.

 

Problems are still present so here are the GetRunKey and ShowNew logs. I will be doing the Hijack this log next.

 

Attatched is the HijackThis log. Does anybody see anything on here that shouldn't be. Appreciate any help on this in getting the last pieces of crud that couldn't be removed that were in the previous logs.

 

Another thing that I was wondering on this computer is that PcCillan keeps popping up a window saying that 10 unknown computers are currently connected to this computer. I'm not familiar with PcCillan but what exactly does this mean and should I list these as not trusted. It says something about one should find out and list each as trusted or not trusted,,,thnx for that one. How would one do that.

Also Microsoft Baseline Security Analyzer 2 still won't install on this PC as it states that area of the computer is being used by another folder,,,what's up with that, I don't have problems with that program any where else.

And Microsoft Baseline Security Analyzer 1 is still saying that there is a 3rd administrator with the name (S ### ## #### #####) yet I can not find that administrator anywhere on this computer. Can someone make any sense of that?

 

Just so anyone who cares knows, I was able to follow the entire instructions in order and perform operations as per instructions.

Thnx in advance for any insite on any remaining problems or any insite on any questions I had.

Thnx, and goodnite now!!

 

Ok, so the PcCillan question. Forget it, I now understand it as a normal function of the program that was never finished so disregard that one.

 

Well I did what you recommended but the only thing that was still on this computer was:
03 - Toolbar: (no name) - {BA52B914-B692....ect...

so removed that one but the rest were gone. Last time I was here on this computer I noticed that a part of PC-cillan was turned off which was a protection against malware and spyware. I'm guessing it may have taken care of the rest on it's own in the last 2 days.

Really the computer is running pretty good now and I thank you for the response and taking the time to look at the logs for this computer. Attatched is the requested 2 logs.

Oh, and as for installing Microsoft's Remote Desktop Connection 6.0 in the paste it is possible but we are not positive on that as this computer was owned by another family member last year.

Thnx again.

 

What a brain fart. I totally forgot to check and see if Microsoft's Remote Desktop Connection 6.0 was installed on that computer. I'll have to check next time I stop over there.

 

Okay, here are the 2 log files done in normal start mode not in safe mode.

As far as the extra administrator, yes it's still there but I'm starting to believe more and more that it does have something to do with remote assistance. I have learned that the previous owner had some remote assistance done in the past. The Microsoft program you referred to is not on this computer but I'm assuming their are several such programs companies use that could leave this remnant in the computer.

Unless you see anything else I think I'll leave well enough alone for now as the computer is running good.

Thnx again,
Peace