Unknown user keeps being added Windows 7
 

:uhoh: A user profile named 'Marc' keeps being added onto my PC. When I click it, it leads to a roaming profile :uhoh: All my firewalls are on. Any suggestions from my cleverer ppruners?

Cheers, Rob

Is this a work or home PC?

Do you know anyone called Marc who may have logged on to your PC at some point, either directly or using Remote Desktop?

AFAIK, the only way a true roaming profile can be created is with a domain user account* - is your PC a member of a domain?

If the answers are: home, no and no, then malware jumps to the top of the list of suspects.

SD

* There is a kludge to get pseudo-roaming profiles to work in workgroups, but it's not officially recognised my MS - and I think you'd know if you had implemented it!

Hi, thanks for reply :ok: the answers are home, no and no, so will have to look into the malware route :(

It has also started rebooting itself at random intervals, after making a clicking sound, don't know if that is a hardware separate issue though!

Cheers, Rob

Just guessing - someone being clever with WiFi ?

checked devices connected to wifi and all ok, though the laptop's ip(?) address has changed one digit from last time I looked, is that any concern? I have little knowledge, vulcanised!

Schizophrenic alter ego? :}

In the Run box, type "control userpasswords2" and tell us what you see...

Have you ever had it checked either home, shop or over the internet ?

Remember my story a year ago about the helpful HP fixit crew that was called via a phone listing.

Malware may not show up that kind of log-in change

Typed that in the run bow (Windows key+R) and it could not find anything!
:ugh:

Frankly, with that kind of intrusion I would be backing up any data I needed, changing my router and blowing away my PC.

...along with changing any passwords on internet banking etc.

check your wife's boyfriend name... LOL...

this being said, did you just notice it ?

Did you buy the PC new ? Sometimes chaps in computer store, do not do a clean install, and keep the "roaming profile" for installs, with a recent update the conditional trigger ( 0 to 1) might get updated, and the said profile becomes visible on the welcome page.

in the registry one shall find the entry of the "boyfriend" and delete the user from there..

Ha thanks CL300! I bought it used to replace a broken laptop, it was cheap plus had 40,000 songs on a separate HD :) just strange how the user re-appeared after I deleted it..

Anyway rang local 'PC guy' today at work, he didn't turn up :oh: ...thanks for info - would check registry, but wouldn't know what I am doing!

Cheers, Rob

And you wonder why odd things happen... :ugh:

You have no idea what other nasties could be lurking in there.

SD

Our computer at work was taken over by a virus that created a new user account. We couldn't get rid of using virus scanners. Locked us out of everything.
Got it back by.clicking ...my computer..Local disc...Security.
And discovered there was a new user with a Russian name.
I highlighted then denied all permissions on that user.
We regained control and was then able to run a virus scan which found and removed it.

Might be similiar situation?