Unknown user keeps being added Windows 7
Thread Starter
Joined: Mar 2009
Posts: 47
Likes: 0
From: MAN UK
Unknown user keeps being added Windows 7
A user profile named 'Marc' keeps being added onto my PC. When I click it, it leads to a roaming profile All my firewalls are on. Any suggestions from my cleverer ppruners?Cheers, Rob
Administrator
Joined: Mar 2001
Aviation Qualifications: PPL
Posts: 8,121
Likes: 686
From: Twickenham, home of rugby
Is this a work or home PC?
Do you know anyone called Marc who may have logged on to your PC at some point, either directly or using Remote Desktop?
AFAIK, the only way a true roaming profile can be created is with a domain user account* - is your PC a member of a domain?
If the answers are: home, no and no, then malware jumps to the top of the list of suspects.
SD
* There is a kludge to get pseudo-roaming profiles to work in workgroups, but it's not officially recognised my MS - and I think you'd know if you had implemented it!
Do you know anyone called Marc who may have logged on to your PC at some point, either directly or using Remote Desktop?
AFAIK, the only way a true roaming profile can be created is with a domain user account* - is your PC a member of a domain?
If the answers are: home, no and no, then malware jumps to the top of the list of suspects.
SD
* There is a kludge to get pseudo-roaming profiles to work in workgroups, but it's not officially recognised my MS - and I think you'd know if you had implemented it!
Thread Starter
Joined: Mar 2009
Posts: 47
Likes: 0
From: MAN UK
Hi, thanks for reply 
the answers are home, no and no, so will have to look into the malware route 
It has also started rebooting itself at random intervals, after making a clicking sound, don't know if that is a hardware separate issue though!
Cheers, Rob
the answers are home, no and no, so will have to look into the malware route It has also started rebooting itself at random intervals, after making a clicking sound, don't know if that is a hardware separate issue though!
Cheers, Rob
Joined: Mar 2002
Posts: 4,569
Likes: 1
From: Florida
Have you ever had it checked either home, shop or over the internet ?
Remember my story a year ago about the helpful HP fixit crew that was called via a phone listing.
Malware may not show up that kind of log-in change
Remember my story a year ago about the helpful HP fixit crew that was called via a phone listing.
Malware may not show up that kind of log-in change
Joined: Jan 2004
Posts: 1,032
Likes: 0
From: Far away from LA
check your wife's boyfriend name... LOL...
this being said, did you just notice it ?
Did you buy the PC new ? Sometimes chaps in computer store, do not do a clean install, and keep the "roaming profile" for installs, with a recent update the conditional trigger ( 0 to 1) might get updated, and the said profile becomes visible on the welcome page.
in the registry one shall find the entry of the "boyfriend" and delete the user from there..
this being said, did you just notice it ?
Did you buy the PC new ? Sometimes chaps in computer store, do not do a clean install, and keep the "roaming profile" for installs, with a recent update the conditional trigger ( 0 to 1) might get updated, and the said profile becomes visible on the welcome page.
in the registry one shall find the entry of the "boyfriend" and delete the user from there..
Thread Starter
Joined: Mar 2009
Posts: 47
Likes: 0
From: MAN UK
Ha thanks CL300! I bought it used to replace a broken laptop, it was cheap plus had 40,000 songs on a separate HD 
just strange how the user re-appeared after I deleted it..
Anyway rang local 'PC guy' today at work, he didn't turn up
...thanks for info - would check registry, but wouldn't know what I am doing!
Cheers, Rob
just strange how the user re-appeared after I deleted it.. Anyway rang local 'PC guy' today at work, he didn't turn up
...thanks for info - would check registry, but wouldn't know what I am doing!Cheers, Rob
Administrator
Joined: Mar 2001
Aviation Qualifications: PPL
Posts: 8,121
Likes: 686
From: Twickenham, home of rugby
I bought it used to replace a broken laptop, it was cheap plus had 40,000 songs on a separate HD just strange how the user re-appeared after I deleted it..
You have no idea what other nasties could be lurking in there.
SD
Joined: Jul 2003
Posts: 1,092
Likes: 10
From: uk
Our computer at work was taken over by a virus that created a new user account. We couldn't get rid of using virus scanners. Locked us out of everything.
Got it back by.clicking ...my computer..Local disc...Security.
And discovered there was a new user with a Russian name.
I highlighted then denied all permissions on that user.
We regained control and was then able to run a virus scan which found and removed it.
Might be similiar situation?
Got it back by.clicking ...my computer..Local disc...Security.
And discovered there was a new user with a Russian name.
I highlighted then denied all permissions on that user.
We regained control and was then able to run a virus scan which found and removed it.
Might be similiar situation?
