ps237
2009-09-13, 14:03
Hi there everybody.
Due to the nature of the issue, I struggled a lot to pick a section to post (still not sure if this is the correct one). Also, please, bare with me, this post may read as long and ... dull, but I'm not that tech savvy and I could really use some help. Last (but not least), keep in mind that I’m not a native English speaker and trying my best to make this as comprehensive as possible.
I’ve read the instructions for posting and since I’m not sure what sort of problem this is, I’m not posting any logs.
My brother has the Admin Account (renamed to his own name and password protected) and is practically the sole user of his Laptop. A couple of weeks back, Windows didn't recognize him and wouldn’t let him log in with his user name. Instead he was able to log in as "User1" (pre-displayed in the username field) and his own (user/ admin) password.
As this issue struck me as really weird and being the more computer savvy of the two :whistle:), I decided to take a look.
Status is as following:
1. The only two accounts are his (Admin) and Guest (disabled).
2. There is no folder under "Documents and Settings" with his (account/ user) name. Instead there are 2 folders named "User1" and "User1.USER-ST".
3. Task Manager shows "User1" to be the active user (I logged in as that). But, right clicking on "Start" & "Explore" takes you to Start Menu of "User1.USER-ST".
4. The Screen Saver is also password protected. When getting out of that, the message reads as following: “This computer is locked. Only the user USER-ST\User1 (Name) or an administrator can unlock this computer” – Name stands for my brother’s Username (original account).
5. In the Registry and the according entries, DefaultUserName has the 1st name of the above as its entry and DefaultDomainName the 2nd one.
6. I have so far ran: Spybot S&D, Malewarebytes' Anti-Malware (Full Scan), Super Antispyware/ Free Edition (Full Scan), Trojan Remover/ Trial, MRT (Full Scan), VundoFix, RootAlyzer, GMER - all latest versions & with updated DB (where applicable). They all came up empty.
7. I searched the Internet, but couldn’t find anything that applies to this issue (apparently no one had this problem or they knew how to fix it).
8. Laptop (older Compaq model) runs Win XP SP3 (IE7) with all the latest patches and Kaspersky Internet Security 7 with updated DB and fully functional.
9. I installed ThreatFire and SpywareBlaster, after installing Firefox 3.5.2 with some privacy/ security add-ons.
A computer tech guy I know said that Windows sometimes do this sort of thing for no apparent reason – I find it hard to accept that as the answer.
So, is this a virus/ malware related problem? In any case, can it be fixed? If possible, I’d like to restore things the way they were: The functional Admin Account and the disabled Guest.
I’ll have the Laptop for the next couple of days, so any explanations/ advice to deal with the issue in that time frame will be highly appreciated. Thanks in advance for your time & help.
Due to the nature of the issue, I struggled a lot to pick a section to post (still not sure if this is the correct one). Also, please, bare with me, this post may read as long and ... dull, but I'm not that tech savvy and I could really use some help. Last (but not least), keep in mind that I’m not a native English speaker and trying my best to make this as comprehensive as possible.
I’ve read the instructions for posting and since I’m not sure what sort of problem this is, I’m not posting any logs.
My brother has the Admin Account (renamed to his own name and password protected) and is practically the sole user of his Laptop. A couple of weeks back, Windows didn't recognize him and wouldn’t let him log in with his user name. Instead he was able to log in as "User1" (pre-displayed in the username field) and his own (user/ admin) password.
As this issue struck me as really weird and being the more computer savvy of the two :whistle:), I decided to take a look.
Status is as following:
1. The only two accounts are his (Admin) and Guest (disabled).
2. There is no folder under "Documents and Settings" with his (account/ user) name. Instead there are 2 folders named "User1" and "User1.USER-ST".
3. Task Manager shows "User1" to be the active user (I logged in as that). But, right clicking on "Start" & "Explore" takes you to Start Menu of "User1.USER-ST".
4. The Screen Saver is also password protected. When getting out of that, the message reads as following: “This computer is locked. Only the user USER-ST\User1 (Name) or an administrator can unlock this computer” – Name stands for my brother’s Username (original account).
5. In the Registry and the according entries, DefaultUserName has the 1st name of the above as its entry and DefaultDomainName the 2nd one.
6. I have so far ran: Spybot S&D, Malewarebytes' Anti-Malware (Full Scan), Super Antispyware/ Free Edition (Full Scan), Trojan Remover/ Trial, MRT (Full Scan), VundoFix, RootAlyzer, GMER - all latest versions & with updated DB (where applicable). They all came up empty.
7. I searched the Internet, but couldn’t find anything that applies to this issue (apparently no one had this problem or they knew how to fix it).
8. Laptop (older Compaq model) runs Win XP SP3 (IE7) with all the latest patches and Kaspersky Internet Security 7 with updated DB and fully functional.
9. I installed ThreatFire and SpywareBlaster, after installing Firefox 3.5.2 with some privacy/ security add-ons.
A computer tech guy I know said that Windows sometimes do this sort of thing for no apparent reason – I find it hard to accept that as the answer.
So, is this a virus/ malware related problem? In any case, can it be fixed? If possible, I’d like to restore things the way they were: The functional Admin Account and the disabled Guest.
I’ll have the Laptop for the next couple of days, so any explanations/ advice to deal with the issue in that time frame will be highly appreciated. Thanks in advance for your time & help.