KTFOD Unwanted log in

[Jim]

Somehow a phantom log in has appeared called KTFOD.
It has admin rights but does not appear to create folders etc.
I delete it and reappears after a cold reboot only.
It is not a virus, have tried ad aware, spybot, pest patrol, bhodemon etc.
I changed the rights to limited user with a password, but it still comes
back as an admin user on cold reboot. No search on the hard drive reveals
anything.
I have deleted all temp internet files in ie6 and cookies, and all tmp and
temp files in Windows.
Most curious and although not life threatning a damn nuisance.
Any ideas?
Jim

 

[Deryck Henson]

Jim,

First of all, the products you listed are not Anti-Virus
programs. So what you need to do is scan it with Norton
Anti-Virus, McAffee, etc. and see what pops up. But, if it
isn't a virus, try only editing the account. Change it
from Admin down to something like Guest or User and then
edit the security settings of all your folders (or the
whole drive) and place the KTFOD user on the Deny list of
all actions (Read, Write, etc.). Then, reboot, and if
something goes wrong, revert the settings on the folders,
reboot, and then if its still screwed, revert the changes
on the account.

Good luck bro,
- Deryck Henson

 

[Jim]

Hi Deryck
Yes, I scanned with Norton, nothing, changed the account to user
which is ok until I cold reboot then it reverts to admin rights again!
Will try the Deny list then let you know what happens.
I am FAT32!!
Thanks for your help so far
Jim

 

[Jim]

Hi Deryck
I have just disabled the account, and all seems ok at the moment!!
Wonder how it got onto the machine, I can't be the first thats for sure!!
Will let you know if it happens again!
Jim

 

[Mingo6RS]

I've been having the same problem with the "ktfod" user account and
too took the same steps you have only to have it return. Norto
anti-virus 2004 Professional found nothing, but it looks like a hacke
to me. Let me know if you find a solution. I will let you knoe if
find anything out
-
Mingo6R
Domingo River