Software

Ask something
Question Locked

Have I been hijacked?

0 helpful
13 replies

by lmac1947

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I can't seem to change the startup using msconfig. I get a message saying I need administrator rights. I am the admin.

When I go to cmd>Net User I get the following: Administrator ASPNET GUEST
HelpAssisrant IUSER_MARK IWAM_MARK
ms support_388945a0

When I log onto (Windows XP Pro SP3) I see only MARK, me, the supposed admin, and a guest account. I click on MARK and enter my password and Windows boots up. Why is ASPNET showing as the admin when I use Net User? Thanks

13 replies

by thumbsup2

You may have the only user account login and have Administrator 'Rights' on that account, but you are not THE Administrator. In WinXP Pro, there is a built in hidden account which uses the name 'Administrator' when logging in.

The other stuff (ASPNET) is built in so Tech Support can remote into your computer should you invite them to do so.

Don't go messing with the stuff you've found. You could render your computer totally worthless.

As for messing with MSCONFIG, you 'should' need to log in as THE Administrator to change it. After all, if the common user with Admin Rights could access it, what good would it be?

And, by the way, if you had been hijacked, you wouldn't see any signs of it in the areas you're looking. ;)

by older mycroft

I do ! :D

[i]A little knowledge is a very dangerous thing!![/i] ;)

by ic-it

(through the Control Panel) and see if the Mark account is a part of the Administrators group.

If it is you SHOULD be able to open MSCONFIG (and the administrator account is not hidden in Pro, it may not have a password).

Sometimes the ASP.NET account is creacted by HP printer software.
A couple of years ago it was noted that a HP printer update created a MSConfig access issue just as you described. Sometimes the change still takes affect even though it stated access denied.
You can use a program like Spybot (advanced mode - Tools -Startup to make your changes (and to remove the HP startup items).

by lmac1947

I found out that the ASPNET account is installed by NetFramework. I was told that if I don't use it I can remove it. I did and nothing has changed. I can go into msconfig, I can remove check boxes on items I don't want in startup but when I hit ok I still get the message that I don't have admin rights.

I forgot to also mention in first post that I can't boot into any of the safe modes. I get a blue screen with:
STOP 0X0000007B(0XF792E5224, 0XC0000034,oX00000000, 0X00000000)

There is a lot of info on the net about this stop but nothing I have tried has solved my safe mode prob. Thanks to all.

by lmac1947

Of the 5 antivirus scans and 3 malware scans I found nothing but adware and cookies. I removed all of them.

I did receive a notice from Microsoft about a security update, see KB952069, concerning media players. I installed the update. It relates to older players which, I did install an older one to get a simple player without all the fluff of version 11; media player 4.

The computer seems to run fine and is not slow, but I still can't check anything in the start menu of msconfig without getting the admin message, nor start the computer in any of the safe modes, which I could do before, so something is amiss. Thanks

by darryl~

Okay, when you typed in the Net User command, it displayed the existing account on your computer, they are:
Administrator
ASPNET
GUEST
HelpAssistant
IUSER_MARK
IWAM_MARK
ms support_388945a0

By looking at the IUSER_MARK & IWAM_MARK accounts,you obviously have named your computer Mark....you CAN NOT have a user name with the same spelling as your computer name

You can also view the user accounts in XP Pro by right clicking "My Computer"....click "Manage"....click "Local Users and Groups"...."users"....most people disable the Guest & Support accounts.

****Please confirm in here that there IS NOT a "Mark" username****

****Please confirm there is an "Administrator" account****

I suspect because you see a "Mark" account & a "Guest" account, you are using the "Welcome Screen" & "Fast User Switching" to log in & you most likely have renamed the Administrator account to "Mark" & the "Guest" account is enabled.

If you turn off Fast User Switching & the Welcome Screen under "User Accounts" in the Control Panel....reboot....you should get a loging window that will allow you to type the user name & password (the same as most workplace networks/schools are set up)....

Type Administrator for username
Type the password you have been trying for the "Mark" account for the password

It should let you in.....if not, try leaving the password field blank (don't even type any spaces) for the Administrator account & see if that will get you logged in.

Let us know how you make out.

Darryl

by lmac1947

I do not have a check box for fast user switching. I belong to a workgroup named, "WORKGROUP", but NOT to a domain, which if I did would remove the check box. I Repeat, I do NOT belong to a domain, and I don't have a check box for fast switching.

Computer Name: HAL
Name Full Name
Administrator ms
Guest OFF
HelpAssistant Off Remote Desktop Asst Acct
IUSER-MARK Internet Guest Account
IWAM-MARK Launch IIS Process Account
ms ms
SUPPORT-388945a0 CN=Microsoft Corp=Redmond etc. etc
This is a vendor account for help and support.

The registered name for this installation of WIN XP Pro SP3 is: ms This is an OEM version.

My two issues: 1. I can't change startup items in msconfig>startup ALTHOUGH, using RegCure, I can.
2. I can't boot into any of the 3 safe modes. I get a STOP 24 Blue Screen.

Otherwise, the computer seems to work ok. But, something is not right. I love a good mystery. Thanks to all.

by darryl~

can you change it from the "welcome" login?

That will give you the ability to "type" the login account.

Under "My Network Places"...you do have "Client for Microsoft Networks"...right?..Right click My Network Places...Properties...Right click your LAN connection...Properties.

Workgroup....Domain...doesn't really matter here....it would appear that your Administrator account is messed up......when you right clicked My Computer....went to Manage....Users...etc.....did you have an "Administrator" account? Was it spelled exactly "Administrator"?

I did XP support for MS when it first came out (pre SP1)....I've had a fair bit of experience with issues like this....I've seen these type of things before.....they're "solveable"....I wish MS was ;)

by thumbsup2

... As it turns out, the Office 2007 Compatibility Pack was blocking changes to certain administrative settings. Once that was uninstalled, I found the problem was that the InCD module of NERO was causing the BSOD when trying to get into safe mode. After uninstalling InCD, the problems went away. I then reinstalled the Office 2007 Compatibility Pack and the administrative functions which were previously blocked were no longer that way.

If you can give us the specifics of the BSOD, perhaps we could help you track this critter down.

by lmac1947

Thanks for the reply. If I try to boot into any of the 3 safe modes I get the BSOD and:

I'm leaving out the leading zeros:
STOP: 7B(0xF792E524, 34, 0, 0)

The last item to load is: agp440.sys I renamed it and copied another one from a working computer, but it still hangs at that point.

I removed NERO 8 some time ago and all it's leftovers that I could find. I'm ready to use a repair install, but have had problems doing that in the past. Thanks to all.

This discussion is closed to new replies.