Solved

A mysterious new identity named support showed up in Windows XP

Posted on 2009-04-14
4
316 Views
Last Modified: 2012-05-06
I run Windows XP Pro. Out of no ware a new identity has shown up named Support. I left my computer for a couple of hours today and when I came back and had to log on a second user identity name Support was there. What could cause this? I do have Remote Desktop access to this computer and use it often. Several days ago I had a popup asking for permission for someone to log on to my computer and I denyed it. Nobody else knows my password and I changed it after that popup a few days ago. I have run the antivirus program and no virus found. I installed Malwarebytes Anti Malware and scaned and it found a couple of stareware items but that was all. Any ideas what or where I should be checking or looking for some idea as to what is going on. Thank You
0
Comment
Question by:rehansen
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 92

Accepted Solution

by:
nobus earned 300 total points
ID: 24145276
it looks like someone accessed your pc, and created it...
can any more traces be found?
0
 
LVL 16

Assisted Solution

by:cantoris
cantoris earned 200 total points
ID: 24152221
Are you referring to the account "Support_388945a0" used by the Help And Support Center?

"The Support_388945a0 account is primarily used to control access to signed scripts that are accessible from within Help and Support Services. Administrators can use this account to delegate the ability for an ordinary user, who does not have administrative access over a computer, to run signed scripts from links embedded within Help and Support Services. These scripts can be programmed to use the Support_388945a0 account credentials instead of the users credentials to perform specific administrative operations on the local computer that otherwise would not be supported by the ordinary users account."
0
 
LVL 4

Expert Comment

by:JLuhn
ID: 24270841
You could always disable the support account under computer management.
0
 

Author Comment

by:rehansen
ID: 24915417
This problem was on business computer that stored a good amount of customer information. Because of this I could not mess with it very long. When I found that the solution was not something obvious I had to report it to the companies they do business with. One of them took over the game plan at that point and put their security team on it has they had to know if any information was in jeopardy. I do not know what they all did but I know they searched and monitored for a long time to find an answer.   They are satisfied that no information got out but I had to put in a new computer to replace this one and ship them the old one so they can completely dissect it. I also had to get a different static ip, change the domain name and all user names just as a precaution. This has been a hugh amount of work and a learning experience to say the least.
0

Featured Post

Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article helps those who get the 0xc004d307 error when trying to rearm (reset the license) Office 2013 in a Virtual Desktop Infrastructure (VDI) and/or those trying to prep the master image for Microsoft Key Management (KMS) activation. (i.e.- C…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question