Peripheral nodes have only one account level: Admin, not even a "user" account.
However, peripherals are things like RFIDs, toasters and fridges. Cars have a pilot program, as such, I wouldn't treat them as a peripheral nodes (they're too complex, compared to my reading of peripheral nodes). The rules on peripheral nodes can be found on page 48 of Unwired.
Additionally, if you do rule that it's a peripheral node, I can't think of anyone who wouldn't slave their car to their commlink immediately on purchasing the thing. Then, the techno can't hack it without a physical connection or by hacking the owner's commlink. Heck, even if it weren't a peripheral node, most anyone with a little tech-savvy would probably still slave their car to their commlink, it's basic security 101. Slaving can be found in Unwired, pages 55 and 59.
At the end of the day, you are the GM, you decide what kind of node a device is, its matrix attributes, and its security responses.
As to the Suppression sprite power, it works automatically to delay the alert by rating/2 (round up) combat turns. However, as FastJack pointed out, without a security or admin account (and if you don't consider it a peripheral node after reading Unwired, he needs to declare what he's hacking for) he wouldn't know the alert existed to squash it.
In fact, with suppression, since the alert isn't generated until after the suppression time is over, he still couldn't squash it before it went off, it doesn't exist yet to kill.
On top of that, if the Crack sprite is in, then he isn't in, if the Crack sprite wasn't told to disable any alerts after hacking in, it won't hack in. Remember, the minute the crack sprite goes after that car, it's on remote task (pg 241, SR4A) and if it's unregistered, it does what it was last commanded then departs. So, if he told it "hack that car" it'd hack in, then de-compile itself and he'd be back at square one without his crack sprite. If he told it "hack in, disable any alarms, and create an account for my use" it would do those three tasks (assuming he had three tasks owed) and de-compile itself.
If it is registered, it'd hack in, and wait for him to give it new orders via the Sprite-Technomancer link (pg 241, SR4A). And remember, hacking in and creating an account is two tasks, regardless of whether or not the sprite is registered. Three if it's going to disable alarms, as well (the suppression happens for free since it's an "always on" feature, but the disabling is a separate task).