Computer help! Users logging in as temporary account!

9/15/2014 | raybbr

[raybbr]

I downloaded the trial version of Malwarebytes last week. I ran a complete scan and quarantined then removed all the malware found.

My PC is running W 8.1. I've had no issues till now.

After I restarted the computer I tried logging into my wife's account to check something and it would only allow me to log in as a temporary user. This happened to all the user accounts.

Also, I remember that after restarting my PC and logging into my account, which is an admin account, the desktop was blank and all my tiles were gone. I restarted again and logged in and it seemed okay. This is after running MB. The PC was okay till after I ran the scan and repair.

I have since had to go in and delete the profile registry keys for the users and reload data into the profiles. Luckily I saved data before I took actions. I am about 95% convinced that MB did something to the registry profiles. If not perhaps there is another explanation but I can't find it. If so, then perhaps the logs will show where the action took place. I still have two profiles that are affected and have not been changed yet. It seems that a .bak extension is added to the profile each time it's accessed for the first time post MB cleaning.

I should note that after the scans a "winspeed.dll" malware warning kept coming up. I tried uninstalling but it didn't seem to work. However, the alert has not come up again.

[raybbr]

Any thoughts?

I notice that when I log off there is a program that holds up the process but it has no name. Usually there it tells the name of the process delaying the log off. This one doesn't.

[raybbr]

Tech ping

[raybbr]

I posted a thread at the Malwarebytes forum: https://forums.malwarebytes.org/index.php?/topic/157171-users-can-only-log-in-as-temporary-users/

[NonValueAdded]

Obviously, you have been declared malware. Enjoy eternity in the bit bucket.

[ShadowAce]

[Ray76]

disconnect from the network

safe boot

[TexasGator]

” I am about 95% convinced that MB did something to the registry profiles. “

You said you ran the scan AFTER you had a problem. Perhaps whatever caused the ‘problem’ did something?

[molson209]

You said you ran the scan AFTER you had a problem. Perhaps whatever caused the ‘problem’ did something?

this

[molson209]

check your restore points and try restoring from one a few days or week back

[mmichaels1970]

Occasionally, malware will corrupt essential files within the user profile. Sometimes, it will change permissions on the registry keys that allow you access to the profile.

When the computer is "cleaned", occasionally these corrupted files are quarantined or removed completely.

Try going to this link, especially steps 2 and 3.

I've had to run sfc /scannow from an administrative command prompt occasionally after cleaning. Another thing is to check the permissions on the registry keys in HKLM\Sofware\Microsoft\WindowsNT\CurrentVersion\ProfileList. I've seen malware hijack the permissions of these keys which once cleaned, need to have permissions reset to allow the operating system to gain access to them.

Trouble with malware is that there could be several different causes for this problem. Just going to take some digging.

[mmichaels1970]

check your restore points and try restoring from one a few days or week back

Very well may be re-triggering the malware by doing a system restore. If I were to run system restore, I'd make real sure I picked a restore point that was clearly before the malware took hold.

[roamer_1]

You are still infected. stop screwing with stuff until you are sure you are clean.

What do you use for antivirus?

[Bubba_Leroy]

What site did you download Malwarebytes from?

There are several pirate sites that come up if you do a Google search for Malwarebytes. If you download the program from one of those sites it will come loaded with spyware.

You can safely download it from either of these sites:

https://www.malwarebytes.org/mwb-download/

or

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

[cynwoody]

I would backup personal files, scratch the filesystem, and reinstall the OS and applications.

The problem is, after a malware attack, there is no good way to be sure you're rid of it. At least not without doing a lot more work than a scratch and reinstall entails.

As for backing up beforehand, a good way is to burn a CD image of Linux, such as a recent release of Ubuntu or Knoppix. Then you can boot from the CD, mount the hard drive read-only, and copy off whatever you need.

Another way is to install the OS afresh into a different system folder or partition. Then boot that system and do your backup.

A third way is to remove the hard drive and install it into a healthy machine. Then use the healthy machine to browse extra drive and take off whatever.

A fourth way is target disk mode, in which your machine starts without booting its OS but, instead, via firmware, makes its disk drive mountable on another machine via Firewire or other high-speed interface. Macs have it. I don't know if any PCs do, however.

[Carriage Hill]

MalwareBytes recognizes and treats Win-8.x as malware.

[catnipman]

Your data should still be safe in their original login id profile folders but the profile registry hives must have been trashed. That happens from time to time, but unusual for all to go at once, which makes me wonder about OS damage, like a missing OS file.

You could try making new profiles and copying the data from the old profile folders.

Better yet, try to do a system restore BEFORE your ran malwarebyes, though as a safety measure backup all your data files.

Of course, I’m assuming you have access to an admin account; if not, you’ll have to try the system restore from BIOS if possible.

[miliantnutcase]

Corrupted Windows profile. Probably happened during the process of cleaning the infected files. I would google “remove temp profile windows 8.1”. It will involve the removal of a registry as well for the temp profile.

[spel_grammer_an_punct_polise]

Most importantly, one should be VERY careful with any program that promises to ‘rid your system of malware’! Most of them remove valid registry entries.

[free_life]

Boot to USB stick or CD with Malwarebytes or Superantispyware, make sure they are legit copies of MB and SAS and up to date. Scan and clean pc. Then run an up to date antivirus program from bootable USB or CD and scan system.

[raybbr]

You said you ran the scan AFTER you had a problem. Perhaps whatever caused the ‘problem’ did something?

I did? Didn't think I'd said that. No, the problem came after the scan.