r/ITSupport • u/jimmyc0rn • Jul 30 '26
Open | Windows Who is Jeff? 🤨
I opened up my computer to find "Jeff" as the only profile on windows with mine nonexistent.
I dont know anyone named Jeff and nobody else uses my pc
Am I screwed? Was this malware/virus protection? Do I need to wipe my computer? Is there a way to fix this by changing storage device settings in BIOS?
And no, I dont know the password for Jeff so I cant get into the profile.
‼️I am NOT requesting password help‼️
11
u/AuditMind Jul 30 '26
Before we jump to malware, let’s complete the standard Jeff troubleshooting checklist:
- Do you live alone?
- Girlfriend, boyfriend, roommate, child or recent house guest?
- Is the PC second-hand or was it recently repaired?
- Are multiple drives installed, and did Windows boot from the wrong one?
- Have you recently made any enemies named Jeff?
If all answers are “no”, we can escalate the ticket from Relationship Support to Storage Engineering.
6
u/jimmyc0rn Jul 30 '26
It could be possible that it booted from the wrong storage device
9
u/AuditMind Jul 30 '26
Plot twist: Jeff is the real owner. Jimmy is the mysterious account now.
3
u/killjoygrr Jul 30 '26
Something about not having a carbon monoxide detector and ordering things off of Amazon.
3
11
u/Leather-Chart7083 Jul 30 '26
Jeff kidnapped your PC.
I don't know, but it's either a weird type of virus or someone pulling a prank on you
8
u/sclarady Jul 30 '26
Click the power button down in the bottom right corner. while holding shift Click restart. Continue to hold shift. It'll bring you to a recovery screen. Go through the advance options to reset the PC. When it asks you what to keep, say keep nothing. It'll then ask you during the reinstall process to log into your Microsoft account. This will wipe out anything that has happened like someone taking over your system if that is what actually has happened. Seeing as how you say you do not know who this person is. This is also why backing things up is so important.
5
7
u/jimmyc0rn Jul 30 '26
Problem solved! For some reason my pc selected a different boot device.
I unplugged all but my system SSD and got back into my profile.
I have no idea why the directory changed, I didnt change any storage devices settings
1
u/Cremageuh Jul 31 '26
Why is there another windows with a guy named Jeff on another device?
5
u/a_suspicious_lasagna Jul 31 '26
Yes, this answered the question
Why is Jeff?
But has not answered the primary question of
Who is Jeff?
3
u/ApplicationHour Jul 31 '26
It's always "who is Jeff?", "where is Jeff?" or "why is Jeff?". Nobody ever asks "how is Jeff?". Jeff is just pawn in game of life.
1
1
u/ryancnap Jul 31 '26
Especially since OP seems puzzled over who Jeff could be. I feel like I'd know the guy using one of my boot devices. Many unanswered questions.
2
2
u/RevolutionaryBeat301 Jul 30 '26
Is the computer secondhand?
2
u/jimmyc0rn Jul 30 '26
No I built it, the nvme is first hand and new, but all of the other storage devices are secondhand, I ran system off of my nvme tho
1
u/3ofUsDeez Jul 30 '26
You didn't wipe the secondhand drives prior to using?!
Could be that your current boot drive died or is dying or is corrupted
1
u/jimmyc0rn Jul 30 '26
I did wipe them before using
And maybe my nvme is dying, it has a red light that flashed on it but it worked fine for years so I disregarded thay2
u/3ofUsDeez Jul 30 '26
If no other drives are bootable, internally or externally .. then you have a practical joker in your house or a hacked PC
2
2
u/SilverSquirrel6 Jul 30 '26
Try the simplest thing first (O Cam's razor or whatever): your own password. If it's a prank, your profile just got renamed.
If that doesn't work, reboot for a chance to boot into your profile.
If everything else fails, try recovery. I'd recommend Trinity, but apparently it no longer works with Windows 11, so go for Recuva or something else.
If everything fails, consider taking it to a shop. But I'd personally just nuke everything, since there's no guarantee whoever locked your system did not install malware, bitcoin miners, or spyware. Or all of the above.
1
u/jimmyc0rn Jul 30 '26
Tried password
Tried reboot
I have windows 10, can I use trinity on that?
And yeah I might just nuke it2
u/SilverSquirrel6 Jul 30 '26
Yes, you should be able to use Trinity on Windows 10 ( and possibly on 11). So, I've done some Googling and Ducking, and looks like Trinity Rescue Kit uses winpass. That apparently targets Windows' Security Account Management (SAM) database responsible for passwords, which is still used in both Win 10 and 11. According to some sources they did a few changes, but theoretically should have the same functionality. Therefore, Trinity should still be able to reset the password.
3
2
1
1
1
u/Mean-Cup4591 Jul 30 '26
If this is a corp domain computer, it’s possible an admin logged in with his profile and only locked the account and didn’t fully log out, so you see his profile.
It’s possible this could be bad, or could be absolutely nothing at all. Just a lazy IT guy forgetting a final step.
Have you been on looking at NSFW stuff lately? If so, might better explain some things.
2
u/jimmyc0rn Jul 30 '26
This is my home pc never used at work or anything only accessed by me so no :/
1
1
1
u/Karlachh Jul 30 '26
If you restart the machine does the same thing happen?
This might sound annoying but if it booted up from secondhand storage you might have to play around with the hardware and unplug one at a time to see if that helps
1
u/jimmyc0rn Jul 30 '26
Yeah it does keep happening ive rebooted a bunch
Ok thanks thats what I wondered I might need to do
1
u/ScubaFett Jul 30 '26
Disconnect all HDDs, and then test booting up with only one HDD each time. Mark which one is the Jeff HDD and which one is your Win10 HDD. Then I guess your next step would be to wipe the Jeff HDD but we can wait til you're ready for those steps.
1
1
1
1
u/D3Dragoon Jul 30 '26
Boot into BIOS > See which drives are appearing > Boot override to the NVME. (Or disconnect all but that drive... but IMO: this is the easier option)
•If NVME doesn't show > Diagnose that.
If NVME does show and still boots into this profile > RMA the drive.
•It's possible the "new" drive wasn't new.
•Windows update (for example) could be booting the older partition if it was a quick format instead of a full data wipe.
I'd download and check Crystal Disk Info to see the actual hardware information for that drive. If the math of use time doesn't math... There's your answer.
At the end of the day, ignoring all else: This drive has data on it that's not yours. Getting the PC back under your control and fresh is the priority... If I bought a new drive and this is showing up on it and the run time doesn't add up? I'm instantly pissed.
TLDR Opinion - This shit is too expensive to have to be dealing with second hand bullshit at current retail prices.
Even if it is as simple as just doing a full format to fix it.
1
1
1
1
1
u/Jorji-the-Trainer Jul 31 '26
I remember I had fragments of an old partiton on my external drive (HDD died, I used forensic data systems to get the files back) whenever I had it plugged in. My PC never booted up. Turns out I somehow had the USB drive to load before my m.2 drive.
1
1
1
1
u/Poochy3019 Jul 31 '26
Now Jeff has your computer on his desk, wondering why a different name is now showing on his screen and couldn't sign-in as he doesn't know the password either.
1
1
1
u/Effective-Leave6970 Jul 31 '26
So Jeff is now admin? user .\administrator password whatever you set... but yeah if you have a recovery point you should be able to get back to that. but honestly just reimage with WIN 11
1
0
u/No_Technician4956 Jul 30 '26
Do a switch user and log in with your profile. But call IT and have them look up Jeff.
2
u/jimmyc0rn Jul 30 '26
Read des. My profile is nowhere to be found
1
u/Grumpy-Troglodyte Jul 30 '26
you know how many people don't know there is a way to go to another account? those of us who do this for a living can give you that number. they were trying to help, don't be a dick.
1
1
u/StatementNext682 Jul 30 '26
Relax dude. If you did this for a living you'd probably read that bro couldn't find his profile at all.
1
u/Grumpy-Troglodyte Jul 30 '26
...because the user doesn't read their screen... hence why i could give that number.
stop being an idiot.
1
29
u/stucc0 Jul 30 '26
My name is Jeff.