I am getting a family of computer that randomly log users off during the day. After the logoff, the user name box shows administrator no matter who was formerly logged on.
I believe it is malware but no tools have turned anything significant up that is in common with other systems experiencing the same issue.
When the user is logged off, it will keep logging them off if they attempt to log back in for about 10 - 15 minutes after which it returns to normal.
There are no other symptoms other then a bit of slowness(but the computers are fairly old) and I already checked the Userinit and Shell Reg values, they were correct. I can rule out an internal malicious user as well since their computer skill for each user is very low and I can't find any evidence in the way.
The event logs show nothing interesting either. There is also nothing in the power profile to cause this, users are logged off in the middle of typing some times.