When a home user woke their laptop (HP with Windows 10, Office, Defender, Chrome, a few games) this morning, it went straight to the desktop (no password prompt) and the Run command box was open with "control userpasswords2" in it. Nothing else was open.
The computer was used yesterday for routine web surfing, then lid closed. No one had physical access overnight (let's assume a Mission Impossible style break-in did not occur).
Any ideas how that got there, or what to look for? Is there some macro that might cause this? Or is it a remote intrusion?
33 Answers
Your main problem is not what the command line had, but the fact that if that was caused by somebody then they could have done anything (pretty much) that the user account could do - the entry route could have been any vulnerability, or anything that you clicked on - without forensic investigation you can't pin it down.
So, from a basic security best practices perspective you should:
- Format the disk
- Reinstall
- Restore data from backup
If you have network logs you can tell everyone through them to see what happened, but your question makes me think you might not.
Foo Bar specifically asked "any ideas how that got there", not "should I worry about nefarious origins". I just opened MY Run command and "control userpasswords2" is showing. I know nothing of this command, but one thing I am certain of, the last person to use the run command typed it in. In my case, it was an engineer setting up a piece of equipment that utilizes a win 10 PC. I did notice that this computer booted all the way without anyone touching the keyboard. I specifically requested a password access. So I assume what happened in my case was the engineer had removed password for convenience while working, but then forgot to restore before he left. Could be wrong, but a good guess none the less. I do not have any knowledge to help, other than my own experience. I do have a philosophy that helps me, might help you as well. I'm a no-body, no great wealth, no super secret info or access, not a celebrity with potential gossip material, etc. So I ask myself, why would ANYONE waist there time trying to access anything I might have? And my answer has always been, I have no clue! There is nothing to be gained, so I believe I can sheep at night without worrying. I know this is irrelevant, and this post was some time ago, but just wanted to share. Have a great day!
My daughter put it there as a security measure. She works on peoples personal accounts and gets secret information and automatically entered the password to my computer. .
2
