Good day to you all.
I suspect, with almost undeniable certainty, that the VirtualXP is at fault.
For the past 6 months--surely longer--I have been coming back to my office to find that there are "new" elements in my computer as I come in: either one or two new users (or clones of them), a up and running Filezilla server, and a fully functioning version of uTorrent. the users are usually named "Ascll"and "Support", and always appear in that order. Sometimes, I will come to the office and find several "Supportxxxxx" accounts ("x" standing for any which sort of numbers) active in my system.
I have neither installed, nor authorized the activation or installation of any of these. No one has installed them or created the accounts (we have cameras in the office).
My suspicion of the VirtualXP's involvement on this is that, I did not run the VXp in my W7x64 host for around 3 months--as I did not require the application used in it for such time--and not once did any of these "new elements" appeared.
Second day after I re-started VXp, they came back.
I started using Process Explorer v15.12 (http://technet.microsoft.com/en-us/sysinternals/bb896653) to monitor the system's activity, and found that when my "new guests" are active, even without VXp running, there are two, sometimes three winlogon.exe and their respective WmiPrvSE.exe services running. I go into User accounts, delete the unauthorized users along with their files; I have gone as far as actually opening "C:\Users" and "shredding" the account containing folders, 'til I made sure they where gone--with the System Restore service off, of course. I have ran all security anti malware/spyware/virus I have to no avail, in either the host W7x64 or the VXp.
Time to use VXp came back, so did my "guests".
It has even happened, several times, that while I am working with the computer--regardless of having ran VXp or not--and I would get a "Another user is trying to log on", etc. Which I would deny. Sometimes I would come in my office and get the "Another user is logged on, wait for authorization" or so; I would either "get permission" to log on, or would have to "power-button-force" the computer to shut down so I could login to my own account.
This morning, before I started writing this, I killed both new" accounts in the usual manner, and found the systrem Restore Service activated--I turned it off and rebooted before I left for the weekend. Well into writing this post, I discovered that Process Monitor registered an operational WmiPrvSE.exe service, running, even after I had killed, deleted and shredded the accounts/files/containing folder.
I have been using a Dell Inspiron 580s, Windows 7 Pro, x64 + Virtual XP(1 user), Intel i3 550 @ 3.2GHz, 4GB RAM.
Any suggestions, ideas, prognosis, diagnosis?