To get rid unknown user account and some probs related

[senritsu]

Hi. After a disk check on C drive, I noticed every newly added/modified/copied files are shared with an unknown user with e.g SID S-1-5-5-0-126229 who has permissions for read and read & execute. The six numbers at the back are always different after logon. Previously, I tried to connect to a public unsecured (computer-to-computer) network which could be the cause of it. It is very troublesome to manually delete the shared user @ file security tab for every files, so can someone help me to totally remove this user/s? My OS is windows vista. Thanks.

Ways I tried:

- System restore

- Off file sharing, public folder sharing @ network and sharing center (other sharings were already off)

- Remove the unknown user permission from the files @ files and folders I'm sharing. (except c:\Users\kllz\Tracing\WindowsLiveMessenger-uccapi-0.uccapilog is attached with the unknown user every logon)

- Remove the unknown user/interactive user permission from c:\Users\Public\Desktop

Some weird problems come up after:

- firefox couldnt be opened (uninstalled and reinstalled turns out to be fine)

- windows live messenger options changed unknowingly

- laptop speaker suddenly having static noises, spoilt?

[senritsu]

Forgot to add, I noticed that whenever I open internet explorer, there will be 2 iexplore.exe in the processes, is it normal? When I tried to close one, the browser will be closed totally.

[YoKenny1]

senritsu for your information Internet Explorer will invoke a new iexplore.exe process for each tab opened.

Automatic crash recovery

Tab isolation

If a website or add-on causes a tab to crash in Internet Explorer 8, only that tab is affected. The browser itself remains stable and other tabs remain unaffected, thereby minimizing any disruption to your browsing experience.

Crash recovery

If one or more of your tabs unexpectedly closes or crashes, your tabs are automatically reloaded and you are returned to the site you were on before the crash.

http://www.microsoft.com/windows/internet-...ures/safer.aspx

[senritsu]

Thanks for the info but it is 2 processes for 1 tab.

[YoKenny1]

You will have one for the first IE then one for each tab.

[senritsu]

Eh? 1st IE = one tab right?

Anyway..... can someone help me with the unknown user? It is scary with an unknown user using my com when i dont even know any transactions or logging to any sites with password is safe....

Did a full malwarebytes scan but nothing is infected. Does malwarebytes detect rootkits for the free version?

[noknojon]

The free and paid versions have the same Database -

Rootkits are not usually detected by Malwarebytes scans (as far as I know) -

[AdvancedSetup]

Yes we do detect and remove many rootkits. Paid or Free. The paid version has features to help prevent you from becoming infected in the first place.

http://www.malwarebytes.org/mbam.php

[senritsu]

Thanks but no one can assist me in getting rid of the unknown user? =(

[AdvancedSetup]

You can review the following link but it is probably due to an account that was improperly deleted and will require manual changes to remove the entries but be careful you don't lock out your own account.

Well-known security identifiers in Windows operating systems

http://support.microsoft.com/kb/243330

You can also try this but typically it will not remove items like this.

Please download and run the following fix from Microsoft How do I restore security settings to the default settings?

When completed please reboot your computer.

[senritsu]

Hmm... no account was deleted and I have only one admin account with the guest account off. Unless check disk deleted the admin account and recreate again?? Since it is only after check disk that newly added/modified/copied files on the desktop were shared with that SID which seems to be a logon session but dont know if it could be a real user. Yup I have checked that it only occurs on the desktop except this file at c:\Users\kllz\Tracing\WindowsLiveMessenger-uccapi-0.uccapilog which I have to manually remove the shared SID in the file security at every logon. Is it safe to keep it as it is??

[ONT]

Hi

May be your system is infected. Run one of online scan from

http://www.itsecurity.com/features/free-on...s-tools-101207/