# Virus/malware modified my Computer Administrator user account? (Picture provided)



## NightFelix (Nov 30, 2008)

Everything goes fine until this morning.

This morning, when I boot my computer, nothing happen but until reach the "Welcome" screen, a user account name "pywl$" ask me for password? I was totally surprise because nobody use my computer except myself and I never set a new user account and password.

I was unable to load into my desktop without the password! But with my computer knowledge, I boot my windows in Safe Mode and remove the password. Now I can safety load into my Desktop without any problem BUT... It no longer able to load into my original user account(Administrator) but instead of load into my new user account(pywl$).

I only able to select my "Administrator" account in safe mode but in normal mode I cant select but giving me another account(pywl$). So I change my logon and logoff options into Classic Logon Prompt. So I can key in my Username: Administrator and Password: <no password> without any problem.

This is my original Computer Administrator user account.









And this my duplicated Computer Administrator user account by virus/malware. (The original name is "pywl$" but I renamed it to "Test")









But the problem is I can't remove the privilege or delete the "Test" account! Now I was logon with my "Administrator" account.









And the delete button seems to be not at there!










Any idea of this? I never have this kind of problem before so please teach me what to do. Thank you!


----------



## NightFelix (Nov 30, 2008)

Sorry, I have double post because I was unable to edit my first post. If there any info need me to provide, I will post here asap. And one more thing, am I post in the correct section? Should I repost in the general-computer-security section? Any online moderator can help me to move this thread?


----------



## Nexxtech (Nov 29, 2008)

If you have your operating system Disk, I would reformat your hard drive and boot to a clean install. Upload your files you want saved to www.YourFileLink.com. Sounds like you have a hard to detect virus. Save yourself the frustration reformat. You may have already tried this but try "Avast virus cleaner tool", or "Trend Micro's Housecall". Good luck!


----------



## wicked74 (Nov 30, 2008)

I hope you dont have banking info or anything like that on your laptop. if you do i would not let that computer online until its clean "format"


----------



## NightFelix (Nov 30, 2008)

Thank you guys who helping me out. I going to format my computer next week but not today because I was too busy lately. I have found the solution on others forum that taught me to delete the Test(pywl$) user account by using cmd.


----------

