Users suddenly become user SYSTEM?

Pondy
Pondy W/ Alumni Posts: 2 Security Scout
in WithSecure Elements Endpoint Protection

Dear sir/madam,

 

We have a very weird problem since f-secure protection service for business is active on our systems.

Sometimes when i'm logged on, the windows desktop environment "refreshes" (like taskbar and windows etc. disappears, and appears again) and then the user is suddenly logged on as user SYSTEM.

When I look into the task manager I see that i'm still logged on myself, but in the start menu you see that windows recognizes me as SYSTEM.

The programs that i had open still shows installer when i look into the processes, but when I open new programs, the programs indeed starts as user SYSTEM. That's not good :)

I'm almost sure this is because of the f-secure software, because this is the only change in the last couple of months on our systems and I only have seen this strange behaviour since f-secure psb is active on our systems, or it must have been a recent windows update?

 

Can anyone help me with this?

As you can see in the task manager i'm logged on as 'Installer', but when I open the startmenu I see the user 'SYSTEM', and also when I run new programs like calculator they run as user 'SYSTEM'.

 

fsecure_issue1

 

fsecure_issue2.png

Comments

  • fedool
    fedool W/ Staff, W/ Article Coordinator Posts: 162 W/ Staff

    Hello,

     

    This is definitelly not good. Please run our support tool (from start menu) to collect logs and send them to me as private message.

     

  • Pondy
    Pondy W/ Alumni Posts: 2 Security Scout

    I've sent the logs to you. Unfortunatly I already restarted the system when i ran the log tool, but as soon as i see the problem again i will run the diag-tool again with the logged on SYSTEM-user. (I already seen the problem twice this week on 2 different systems, so I think the problem will occur again some time).

This discussion has been closed.

Categories