Screensaver logs me off and Administrator on

Malware forum can't find malware and suggest I post here.

XP w/SP3. Story: Came to work and I was logged on as Adminstrator in the screensaver. This is strange since I am the only person to know this password. I suspected a virus and ran SuperAntispyware with no luck. Ran Malwarebytes and it found the virus and deleted it. Upon reboot it returned. I did some searching on cache.txt virus and found that the cache.txt in the Offline web pages directory belonged to the Morto Worm Virus. I followed the Malware removal steps here at MajorGeeks and also remove the registry keys found on different web sites to remove the virus. I reran the SuperAnti, Malware, Combofix, RootKit, and MGtools and all appeared good. I also turned off the screensaver and reset the password. Last night I turned on the screensaver and found this morning I was again logged off and administrator logged on. I reran superantispyware and malwarebytes and all the scans show clean. I also log in through terminal services from home. The PC also still appears a little sluggish.

I need help so that the screen saver does not log me off and the administrator on so I lose work. I am not sure if it is the remote services.

This one is beyond me at the point so let me know what to try on how to get it fixed. Thanks for the help in advance.

 

Greetings, whanenbu.

Interesting problem. What happens if you do not enable a screensaver - does the log off still occur? And, do the same symptoms present when the machine is running in Safe Mode?

 

When the screen saver is disabled it has not happened since I removed the malware. I re-enabled the screensaver and it happened. Usually during the day it work propertly. It is when I go home at night and came in in the morning it happens. It is something like a timed response. I haven't tried it in safe mode.

 

Is the screensaver in question one of the default Windows .scrs, or is this a 3rd-party program? I'm assuming you've tried a different screensaver for troubleshooting purposes - correct?

I'm interested in seeing the results of the Safe Mode test.

Also, if the culprit is a default saver, you might try changing the Power scheme to Presentation (always on) in case the root cause has something to do with hibernate/sleep.

 

Yes, it is the default windows.scr (can't locate that name). Changed to pipes and it still happens. Power scheme has been alway on. I will do some quick testing again and then set it to safe mode before I leave tonight.

 

I set the screen saver to 1 minute and it worked properly all day. Going home I booted into safe mode wtih network connection and reset the screensaver. To my surprise, no matter what I did it will not save and reverts to 1 minute. This is strange. I am letting it run all night and tomorrow I will see where it is.

 

In safe mode it appears all is ok other than I can not safe the settings. Back in regular mode. I will have to continue experimenting. Any suggestion or registry key settings may be helpful.