Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Could a virus create duplicate accounts in Windows XP? Said duplicate accounts have same rights (admin...), same name, but the folder name under C:\Documents and Settings\ is OrignalName-CJP[RandomLetters]. If so, what virus would do that?

Further behaviour description: All account files (from My Documents, Desktop, etc) are in the -CJP folder, not the original user's folder, thus indicating that login effectively occurs in CJP account, even if the account selected in the logon screen is the original name.

share|improve this question
    
It may not be a virus, it could be a temporary profile created by XP because the original user profile is corrupt. Did you scan for viruses yet? –  Moab Apr 11 '11 at 1:05
    
@Moab I have, found one Trojan, but removal wasn't 100% successful. I was just wondering if that in itself could be a virus. My main symptom is somewhat unrelated, will post in another question. –  MPelletier Apr 11 '11 at 1:28
1  
When in doubt, back up important data and do a clean install of the OS. –  Moab Apr 11 '11 at 1:32
    
@Moab Definitely working that angle. Thanks :) –  MPelletier Apr 11 '11 at 1:33
    
which trojan? it might be related to the issue - since there appears to be a trojan of that name according to google –  Journeyman Geek Apr 11 '11 at 3:28
show 3 more comments

1 Answer 1

up vote 0 down vote accepted

The "RandomLetters" are probably a temporary computer name under which the accounts were created (and using the other accounts of the same name as templates). I'm guessing that either a virus or SpyWare was attempting to set up a backdoor, or an update ran amock and this extraneous account creation was an unintended side-effect.

When an account, say "Administrator" for this example, already exists on a computer, and then you login to a network account by the same name, a local account called "Administrator.NETWORK_NAME" gets created to avoid a conflict with the local account that doesn't have that trailing computer name.

I've also noticed that accounts are sometimes created with this network or computer name added after a account of the same name was previous deleted by the data files remained. Obviously this is caused by Windows re-creating the account in a manner that doesn't conflict with another account of the same name (especially since some files in the user's "Documents and Settings" profile directories can't be deleted).

share|improve this answer
    
Any idea which viruses or spyware do this sort of behavior? –  avi Jan 17 '12 at 8:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.