Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 2008 R2 Standard (64 bit) running in a virtual machine. Suddenly from yesterday onwards I am not able to login as administrator. Nobody changed the password. Both in the console as well as using remote desktop I am unable to login. Whenever I login as Administrator I am getting this error:

"The user name or password is incorrect"

Nothing has changed in the machine and I have logged in the past successfully both through console and via remote desktop several time on the same machine.

One strange behaviour I noticed is, I am seeing some additional user accounts if I try to login as other user. The suspicious user account are:

sky$ admin$ SUPPORT_388945a0

Is it created by some malware/virus? Or is it some windows hidden account? Microsoft site says that SUPPORT_388945a0 is:

The Support_388945a0 account enables Help and Support Service interoperability with signed scripts. This account is primarily used to control access to signed scripts that are accessible from within Help and Support Services. Administrators can use this account to delegate the ability for an ordinary user, who does not have administrative access over a computer, to run signed scripts from links embedded within Help and Support Services. These scripts can be programmed to use the Support_388945a0 account credentials instead of the user’s credentials to perform specific administrative operations on the local computer that otherwise would not be supported by the ordinary user’s account. When the delegated user clicks on a link in Help and Support Services, the script executes under the security context of the Support_388945a0 account. This account has limited access to the computer and is disabled by default.

However I am not sure from where this "admin$" and "sky$" came. Anyone has similar experience?

share|improve this question
    
Where and how are you seeing those "additional user accounts"? You may think nobody has changed the password but your description of the problem disputes that. As for those accounts, those with a trailing dollar sign are normally machines, not users. –  John Gardeniers Jan 4 '11 at 10:43
    
a google search for "SUPPORT_388945a0" turns up lots of useful info on that particular account. –  Sirex Jan 4 '11 at 11:16

1 Answer 1

First, check what software exists on that server. Did the software require any special accounts? Are you sure they were recently added?

Where are you seeing these accounts anyway?

If not, second, do not hesitate to disconnect that server from the internet ASAP. Get Microsoft Security Essentials or other AV product on there, do a scan. Check for installed software, check running processes and services.

share|improve this answer
    
It is just running SQL2008 and IIS 7.x and no other software. This new user account icons were appearing when I selected other user in the login screen. It is also not in any domain. –  mks Jan 4 '11 at 11:39
1  
Login and disable those accounts. Check to see if it affects anything? –  hyperperforator Jan 4 '11 at 11:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.