W7 user account being created at logon - how to fix

Hi Guys,
I have a standalone W7 PC that recently create an additionla user account when the regular user logs in. If I remove the additional user (using cpanel-users) it disappears until the next time the main user logs in.

If I remove the errant user and boot into safe mode it is not created. If I then boot into normal mode it is recreated.

The machne is running eset which has detected nothing untoward, I'm just running a Sophos independent Boot AV (BAV) scan but it has not completed yet.

Has anyone else seen this type of behaviour before and can someone give me a good steer please.

TrevorWhiteIT ConsultantAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AdrienneSperberTech Support CoordinatorCommented:
TrevorWhiteIT ConsultantAuthor Commented:
Does a temporary profile create a different username ???
This is creating a consistent 'random' user name like mcoqipg (the same spelling) for each incarnation. I thought temp profiles used the same user name but the profile was obtained from a set of defaults when the OS couldn't load the current one.

The scan is flagging up a lot of Mal/phish-A infections (Sophos parlance!) I'm waiting for this to finish and then will look again.

Will read your link above in the meantime.

Thanks for your time.

TrevorWhiteIT ConsultantAuthor Commented:
Hi Adrienne,
The answers.Microsoft artical refers to a situation where the user is prompted that he is neing logged in with a temporary profile. This is not my situation . . .

A new account (icon at least) is created when the main user logs in - there is no system or other warning.

Thanks for your time though - anyone else have any clues about this ???

10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

Pradeep DubeyConsultantCommented:
You have to scan your pc as it is infected with virus.

Once full system scan completed please add remove program and startup list (for startup list open msconfig and navigate to the startup tab).

All unwanted application should be removed and also startup items.

Also i recommend windows security essential to be installed on the machine (its lite and reliable)
TrevorWhiteIT ConsultantAuthor Commented:
Thanks Pradeep
As mentioned I am running the Sophos AV which has already deteceted 35 instances of Mal/Phish-A which have now been removed.

I'll report back if this has fixed the issue - likely I'll need to do some more fix up too. I'll record here if so.

TrevorWhiteIT ConsultantAuthor Commented:
Well I seem to have the same problem.
I have performed my normal cleanup operations using ccleaner and spybot after running the Sophos independent boot scanner with virus remove turned on - found 35 instances of Mal/Phish-A.

Anyone have any ideas here either had experience or can suggest a way forward ????


You said you are using ESET as your antivirus software.
If you have enabled anti-theft feature of ESET then an phantom account is being created as you have described.

Just disable the anti-theft feature of ESET.
Open ESET Window > Setup > Anti-theft.

Also check your anti-theft account settings at my.eset.com

Note: There is no way to enable ESET Anti-theft feature without the use of phantom account.

With Regards,

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
TrevorWhiteIT ConsultantAuthor Commented:
Hi Gentle0000,
Thanks indeed for your post, and I can indeed confirm this was the case. I discovered this a short while after my last post but haven't been able to conclude here.
For your trouble to post here please accept the points.

TrevorWhiteIT ConsultantAuthor Commented:
A little late for me as I had found this out already but had not reported back.
But the answer was 100% accurate. Unfair not to award points.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 7

From novice to tech pro — start learning today.