After users logs into network, second 'user' attempts to log in

[bmcclurg]

I have a user whose laptop running XP Pro is logging into an NT domain. It's been working fine until this morning. When the user logged he was authenticated, and immediately his machine tried to log in as a second user but it used the wrong password. The second user has an account on his laptop, and is a legit domain account. Because of the incorrect password, the domain account is consequently locked out (I've set up '3 tries and you're locked out' as a security feature on this network, and when this second logon attempt occurrs, it tries about 8 times within 2 seconds.) I suspect somehow a service is trying to logon using the second user account as it starts, but I don't know how to identify which service it is without going through every service listed as an automatic startup. One other possibilty- this machine was using NetSwitcher, but when I turned it off it made no difference.
Any suggestions would be appreciated. Thanks.

 

[bcastner]

Boot the machine to Safe Mode (hit F8 early and often), logon as the local Administrator.

Enable the native XP firewall.

http://support.microsoft.com/?kbid=283673

Review closely and entries in:

1. Control Panel, Scheduled Tasks
2. Start, Run, msconfig
(look at the Startup and Services tabs)

I does not matter if you have an antivirus program in place, follow the steps to use the Trend Micro and Panda online antivirus scans from this FAQ, and then run the cwshredder, SpyBot and AdAware tools also linked there: faq608-4650

It would scare the heck out of me if one of my workstations acted this way.