Virus creates creates username.username acct.

[pcdoc4christ]

Hey, anyone:

I've been posting in ComputerHope's Windows and Hardware forums for a little over a year.  This is my first visit to the Virus and Spyware forum.  

A coworker of mine turned on his PC this morning (it's a Windows 2000 SP4 system) and all of his icons, documents, favorites and IE settings were back to the default settings.  He logged on with the same user account name (Jeff).  He does not use a password.  A look at the Control Panel applet Users and Passwords shows only Jeff, Guest and Administrator as the user accounts.

We checked the Documents and Settings folder and found all of his icons, documents, etc. in the subfolders of the Jeff folder.  There was a Jeff.Jeff folder with all of the default settings (however, three is no Jeff.Jeff account in Users and Passwords).  He also received a message that Windows Update had finished installing files.

Does anyone know of any virus that creates a new account for the user with the same name but does not delete the folder for the old account?

Thanks in advance,
Doc

[pcdoc4christ]

I did some experimentation by creating a new account, deleting it, and creating another account with the same name as the old one.  This created a folder in Documents and Settings with the format username.computername.  The computer name for his system was the same as his user name.

It looks like the virus simply deleted his user account and then recreated a new account with the same name.  If anyone knows of a virus known for doing this, please let me know.

Thanks,
Doc

[Fed]

Hi Doc, good to see you.
A question, could your friend not be telling you all the facts?
It sounds like the results of starting up with 'Last Known Good Configuration'.
Either way an online scan wouldn't hurt, if he survives Panda & Ewido he should be OK.

Online Virus Scan and Spyware Scan
http://www.pandasoftware.com/products/activescan.htm

Highly recommended second Online Malware Scan
http://www.ewido.net/en/

[pcdoc4christ]

Thanks Fed.

 8-)