User Account

[SacredCultivator]

i Just formatted my computer and installed WinXP x64 Bit on it.. But for some reasonf or the user acounts.. It comes out as 'Administrator' and I can't change the name to my liking and after creatinga new on (As an Administartor) i can't delete the other and I do not want to redo everything to my liking so I was wondering how I can delete the Account I created as the Administrator/ and how to change the name on the Administrator Account(Because when I click it there is no optiont o change name)

[nsane]

installed any updates lately?

edit: you can't delete it, that is weird? ;)

[SacredCultivator]

Well with x64 I have updated everythingt hat WindowsUpdate has... And for that weird part Id o find it weird that as an Administartor creating another Administrator Account, I should be able to Delete the one created..

[nsane]

i've had it happen to me once, but i was able to delete the account and never saw it again. what programs are running on bootup? ;)

[SacredCultivator]

Well ehre is a Log for now:

Logfile of HijackThis v1.99.1

Scan saved at 1:41:31 PM, on 10/28/2005

Platform: Windows 2003 SP1 (WinNT 5.02.3790)

MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:

C:\Program Files (x86)\Eset\nod32krn.exe

C:\Program Files (x86)\Stardock\WinCustomize\WindowBlinds\wbload.exe

C:\Program Files (x86)\Stardock\WinCustomize\CursorXP.exe

C:\Program Files (x86)\SpywareGuard\sgmain.exe

C:\Program Files (x86)\SpywareGuard\sgbhp.exe

C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe

C:\Program Files (x86)\Java\jre1.5.0_05\bin\jusched.exe

C:\Program Files (x86)\Eset\nod32kui.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\AIM\aim.exe

C:\Program Files (x86)\BitComet\BitComet.exe

C:\Documents and Settings\Administrator\Desktop\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://update.microsoft.com/

F2 - REG:system.ini: UserInit=userinit

O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files (x86)\SpywareGuard\dlprotect.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~2\FlashGet\fgiebar.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Java\jre1.5.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\SysWOW64\NeroCheck.exe

O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files (x86)\Stardock\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM

O4 - HKLM\..\Run: [bootSkin Startup Jobs] "C:\Program Files (x86)\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files (x86)\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKCU\..\Run: [CursorXP] "C:\Program Files (x86)\Stardock\WinCustomize\CursorXP.exe" -s

O4 - Startup: SpywareGuard.lnk = C:\Program Files (x86)\SpywareGuard\sgmain.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: Spy Sweeper Fix.lnk = C:\Program Files (x86)\Webroot\Spy Sweeper\SpySweeperFix.bat

O8 - Extra context menu item: Download All by FlashGet - C:\Program Files (x86)\FlashGet\jc_all.htm

O8 - Extra context menu item: Download using FlashGet - C:\Program Files (x86)\FlashGet\jc_link.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files (x86)\AIM\aim.exe

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~2\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~2\FlashGet\flashget.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130481133154

O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll

O20 - Winlogon Notify: EFS - C:\WINDOWS\SYSTEM32\sclgntfy.dll

O20 - Winlogon Notify: WB - C:\PROGRA~2\Stardock\WINCUS~1\WINDOW~1\fastload.dll

O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)

O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)

O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)

O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)

O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)

O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files (x86)\Eset\nod32krn.exe

O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: O&O Defrag - Unknown owner - C:\WINDOWS\system32\oodag.exe (file missing)

O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)

O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)

O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)

O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)

O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)

Woops that won't help much, forgot HiJackThis had a StartUp List thing:

StartupList report, 10/28/2005, 1:44:11 PM

StartupList version: 1.52.2

Started from : C:\Documents and Settings\Administrator\Desktop\HijackThis\HijackThis.EXE

Detected: Windows 2003 SP1 (WinNT 5.02.3790)

Detected: Internet Explorer v6.00 SP1 (6.00.3790.1830)

* Using default options

==================================================

Running processes:

C:\Program Files (x86)\Eset\nod32krn.exe

C:\Program Files (x86)\Stardock\WinCustomize\WindowBlinds\wbload.exe

C:\Program Files (x86)\Stardock\WinCustomize\CursorXP.exe

C:\Program Files (x86)\SpywareGuard\sgmain.exe

C:\Program Files (x86)\SpywareGuard\sgbhp.exe

C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe

C:\Program Files (x86)\Java\jre1.5.0_05\bin\jusched.exe

C:\Program Files (x86)\Eset\nod32kui.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\AIM\aim.exe

C:\Program Files (x86)\BitComet\BitComet.exe

C:\Documents and Settings\Administrator\Desktop\HijackThis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:

[C:\Documents and Settings\Administrator\Start Menu\Programs\Startup]

SpywareGuard.lnk = C:\Program Files (x86)\SpywareGuard\sgmain.exe

Shell folders Common Startup:

[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]

Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

Spy Sweeper Fix.lnk = C:\Program Files (x86)\Webroot\Spy Sweeper\SpySweeperFix.bat

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = userinit

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SunJavaUpdateSched = "C:\Program Files (x86)\Java\jre1.5.0_05\bin\jusched.exe"

NWEReboot =

NeroFilterCheck = C:\WINDOWS\SysWOW64\NeroCheck.exe

LogonStudio = "C:\Program Files (x86)\Stardock\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM

BootSkin Startup Jobs = "C:\Program Files (x86)\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs

nod32kui = "C:\Program Files (x86)\Eset\nod32kui.exe" /WAITSERVICE

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

CursorXP = "C:\Program Files (x86)\Stardock\WinCustomize\CursorXP.exe" -s

--------------------------------------------------

File association entry for .HTA:

HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = %SystemRoot%\system32\mshta.exe "%1" %*

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*

HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files (x86)\SpywareGuard\dlprotect.dll - {4A368E80-174F-4872-96B5-0B27DDD11DB2}

--------------------------------------------------

Enumerating Download Program Files:

[Office Update Installation Engine]

InProcServer32 = C:\WINDOWS\opuc.dll

CODEBASE = http://office.microsoft.com/officeupdate/content/opuc3.cab

[WUWebControl Class]

InProcServer32 = C:\WINDOWS\SysWOW64\wuweb.dll

CODEBASE = http://update.microsoft.com/windowsupdate/...b?1130481133154

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:

*No scripts set to run*

Windows NT checkdisk command:

BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':

PendingFileRenameOperations: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_iu14D2N.tmp|||C

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\syswow64\SHELL32.dll

CDBurn: C:\WINDOWS\syswow64\SHELL32.dll

WebCheck: C:\WINDOWS\SysWOW64\webcheck.dll

SysTray: C:\WINDOWS\SysWOW64\stobject.dll

--------------------------------------------------

End of report, 5,088 bytes

Report generated in 0.031 seconds

Command line options:

/verbose - to add additional info on each section

/complete - to include empty sections and unsuspicious data

/full - to include several rarely-important sections

/force9x - to include Win9x-only startups even if running on WinNT

/forcent - to include WinNT-only startups even if running on Win9x

/forceall - to include all Win9x and WinNT startups, regardless of platform

/history - to list version history only

[nsane]

don't see anything unusual, very weird. hopefully somebody else knows something, cause i'm as lost as you now :unsure:

[Lite]

Your HJT log looks fine from a really quick glanse over, if you really want i will have a proper look at it, but lets see the other options....

The default windows "Adminstrator" account cannot be altered in name etc . Its a system account. You can create other accounts, correct?

[SacredCultivator]

@Lite

Yeah I can create other Administrator Accounts... But that is the weird part on my Old x32bit.. The Administrator was titled as my name 'Chris La' but now it just says Administrator so I am pondering about what i might have changed or whatnot to have it that way and not being able to have it be my name opposed to Administartor. You can take your time looking it over because I mean it isn't something that is affecting my performance or anything so whenever you find the time I apprecaite it.

[Lite]

But you would have ALWAYS had this "Adminstrator" account in the background on your computer - for well "Adminsrative" purposes, it cannot be physically edited. Its kinda like "root" under linux.

[SacredCultivator]

That I do not know because on my x32 when i went to User Accounts the only ones listed were Chris La and Guest (Off)

So... *Shrug*

[Lite]

If you still have a copy of windows (32 bit) just see that the admin account exists:

Start > Run > control userpasswords2