Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Good day to you all.

I suspect, with almost undeniable certainty, that the VirtualXP is at fault.

For the past 6 months--surely longer--I have been coming back to my office to find that there are "new" elements in my computer as I come in: either one or two new users (or clones of them), a up and running Filezilla server, and a fully functioning version of uTorrent. the users are usually named "Ascll"and "Support", and always appear in that order. Sometimes, I will come to the office and find several "Supportxxxxx" accounts ("x" standing for any which sort of numbers) active in my system.

I have neither installed, nor authorized the activation or installation of any of these. No one has installed them or created the accounts (we have cameras in the office).

My suspicion of the VirtualXP's involvement on this is that, I did not run the VXp in my W7x64 host for around 3 months--as I did not require the application used in it for such time--and not once did any of these "new elements" appeared.

Second day after I re-started VXp, they came back.

I started using Process Explorer v15.12 (http://technet.microsoft.com/en-us/sysinternals/bb896653) to monitor the system's activity, and found that when my "new guests" are active, even without VXp running, there are two, sometimes three winlogon.exe and their respective WmiPrvSE.exe services running. I go into User accounts, delete the unauthorized users along with their files; I have gone as far as actually opening "C:\Users" and "shredding" the account containing folders, 'til I made sure they where gone--with the System Restore service off, of course. I have ran all security anti malware/spyware/virus I have to no avail, in either the host W7x64 or the VXp.

Time to use VXp came back, so did my "guests".

It has even happened, several times, that while I am working with the computer--regardless of having ran VXp or not--and I would get a "Another user is trying to log on", etc. Which I would deny. Sometimes I would come in my office and get the "Another user is logged on, wait for authorization" or so; I would either "get permission" to log on, or would have to "power-button-force" the computer to shut down so I could login to my own account.

This morning, before I started writing this, I killed both new" accounts in the usual manner, and found the systrem Restore Service activated--I turned it off and rebooted before I left for the weekend. Well into writing this post, I discovered that Process Monitor registered an operational WmiPrvSE.exe service, running, even after I had killed, deleted and shredded the accounts/files/containing folder.

I have been using a Dell Inspiron 580s, Windows 7 Pro, x64 + Virtual XP(1 user), Intel i3 550 @ 3.2GHz, 4GB RAM.

Any suggestions, ideas, prognosis, diagnosis?

Thank you.

share|improve this question
2  
You didn't install FileZilla or uTorrent? If you don't use these apps, I'm suspicious as to how they got there. Is the Windows firewall enabled? Do you have antivirus protection? –  Jim G. Jan 31 '12 at 5:30
1  
I'm unsure what VirtualXP is. Can you provide more information about the application. It sounds like an insecure, remote-access program. Is it? –  Ben West Oct 6 '12 at 20:53

1 Answer 1

Sorry, I can't post a comment for some reason..

@Ben West - I'm pretty sure he means Windows XP in Virtual Box that is offered with Windows 7 by Microsoft.

This is odd behaviour. Is your Windows XP VM sandboxed/isolated from your host machine or can you access the filesystem of the host machine? Windows 7 and XP up to date on patches?

These mystery users are on the host system? They appear under "net user" when run from cmd on Windows 7?

Have you checked Security Audit logs in Event Log to check which account create such user?

Do you have the ability to run a software firewall? This may show the incoming connection attempts and allow you to block them. I'd be curious to see a "netstat -a" when a user is connected as well.

As an added precaution, you may want to change any administrator passwords.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.