Has my computer been compromised?

Discussion in 'Windows Desktop Systems' started by henryvuong, Jun 15, 2006.

  1. henryvuong

    henryvuong OSNN One Post Wonder

    Messages:
    2
    When I check the "Users and Passwords" in the Control Panel, I see two new strange user accounts. They are "IUSR_STATION-2" and "IWAM_STATION-2". Station-2 is the name of my computer. When I click the Properties button, they are described as "Built-in account for anonymous access to Internet Information Services out of process applications", they belong to the guests group. I never created those acounts. I deleted them, but every time I reboot, they show up again.

    My guess is, some spyware has found its way to my computer and created those accounts for hackers for later malicious acts. I don't know how to deal with it. I'm running Windows 2000 Pro, SP4. I have Zone Alarm firewall, Norton Antivirus, and Windows Defender Beta 2 running as well. This computer is networked with two other ones, and the other ones don't have this problem.

    Can someone give me some advise? Thanks.
     
  2. xsivforce

    xsivforce Prodigal Son Folding Team

    Messages:
    8,547
    Location:
    Texas, USA
    By default, the IUSR_computername and IWAM_computername account is included in the Windows user group Guests when IIS is installed on the server.
     
  3. Admiral Michael

    Admiral Michael Michaelsoft Systems CEO Folding Team

    I can concur with that. I use IIS and those accounts are tied to IIS so if you did install IIS then DON'T delete them.
     
  4. henryvuong

    henryvuong OSNN One Post Wonder

    Messages:
    2
    That answers my question. Thanks.