Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Could a virus create duplicate accounts in Windows XP? Said duplicate accounts have same rights (admin...), same name, but the folder name under C:\Documents and Settings\ is OrignalName-CJP[RandomLetters]. If so, what virus would do that?

Further behaviour description: All account files (from My Documents, Desktop, etc) are in the -CJP folder, not the original user's folder, thus indicating that login effectively occurs in CJP account, even if the account selected in the logon screen is the original name.

share|improve this question
It may not be a virus, it could be a temporary profile created by XP because the original user profile is corrupt. Did you scan for viruses yet? – Moab Apr 11 '11 at 1:05
@Moab I have, found one Trojan, but removal wasn't 100% successful. I was just wondering if that in itself could be a virus. My main symptom is somewhat unrelated, will post in another question. – MPelletier Apr 11 '11 at 1:28
When in doubt, back up important data and do a clean install of the OS. – Moab Apr 11 '11 at 1:32
@Moab Definitely working that angle. Thanks :) – MPelletier Apr 11 '11 at 1:33
which trojan? it might be related to the issue - since there appears to be a trojan of that name according to google – Journeyman Geek Apr 11 '11 at 3:28
up vote 0 down vote accepted

The "RandomLetters" are probably a temporary computer name under which the accounts were created (and using the other accounts of the same name as templates). I'm guessing that either a virus or SpyWare was attempting to set up a backdoor, or an update ran amock and this extraneous account creation was an unintended side-effect.

When an account, say "Administrator" for this example, already exists on a computer, and then you login to a network account by the same name, a local account called "Administrator.NETWORK_NAME" gets created to avoid a conflict with the local account that doesn't have that trailing computer name.

I've also noticed that accounts are sometimes created with this network or computer name added after a account of the same name was previous deleted by the data files remained. Obviously this is caused by Windows re-creating the account in a manner that doesn't conflict with another account of the same name (especially since some files in the user's "Documents and Settings" profile directories can't be deleted).

share|improve this answer
Any idea which viruses or spyware do this sort of behavior? – avi Jan 17 '12 at 8:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .