Has my computer been compromised?

[henryvuong]

When I check the "Users and Passwords" in the Control Panel, I see two new strange user accounts. They are "IUSR_STATION-2" and "IWAM_STATION-2". Station-2 is the name of my computer. When I click the Properties button, they are described as "Built-in account for anonymous access to Internet Information Services out of process applications", they belong to the guests group. I never created those acounts. I deleted them, but every time I reboot, they show up again.

My guess is, some spyware has found its way to my computer and created those accounts for hackers for later malicious acts. I don't know how to deal with it. I'm running Windows 2000 Pro, SP4. I have Zone Alarm firewall, Norton Antivirus, and Windows Defender Beta 2 running as well. This computer is networked with two other ones, and the other ones don't have this problem.

Can someone give me some advise? Thanks.

 

[xsivforce]

By default, the IUSR_computername and IWAM_computername account is included in the Windows user group Guests when IIS is installed on the server.

 

[Admiral Michael]

I can concur with that. I use IIS and those accounts are tied to IIS so if you did install IIS then DON'T delete them.

 

[henryvuong]

That answers my question. Thanks.