Windows 10: New unknown users have appeared in my Users folder. Solved

Page 1 of 3 123 LastLast
  1.    10 Jun 2017 #1

    New unknown users have appeared in my Users folder.


    I had to enable "Show hidden hidden files" in order to install Wizcrafts' latest Spam Filters for Mailwasher.

    There are two new users there. They were created dated today, when I first switched the computer on.

    What are they?

    Click image for larger version. 

Name:	hidden users.jpg 
Views:	63 
Size:	23.3 KB 
ID:	138846

    Click image for larger version. 

Name:	Acndqa2.jpg 
Views:	63 
Size:	44.0 KB 
ID:	138847

    Click image for larger version. 

Name:	Qhimo.jpg 
Views:	63 
Size:	52.0 KB 
ID:	138848
      My ComputerSystem Spec


  2. Posts : 6,958
    Windows 10 Pro x64 Build 1709
       10 Jun 2017 #2

    Hi Syncopator.

    Any chance you are running Eset security? It has been known to create users as part of it anti theft settings.

    If not that I would check with the security product you are using to see if it is using same strategy.

    But be something totally different but I recall this is one cause.


    Ken
      My ComputerSystem Spec

  3.    10 Jun 2017 #3

    Hello Ken.

    I occasionally use Eset's on-line scanner, the last time a few weeks ago. Nothing from Eset permanently installed.
    I'm using BullGuard and Malwarebytes. There's nothing I can see in either of their settings which I can associate with this. Besides, today is the first time I've seen this phenomena.

    I am thinking I should uninstall these two new id's and reboot to see if it happens again.
      My ComputerSystem Spec


  4. Posts : 6,958
    Windows 10 Pro x64 Build 1709
       10 Jun 2017 #4

    I would first look in the event viewer, I'm thinking security section. See if there are events for the creation of users, you have date and time, and see if that gives anymore detail.

    Any chance any other security product was stuck in? You know when you update flash and they included a bonus, like McAffee.

    Not sure on deleting but if something needs I assume it will re-install.
      My ComputerSystem Spec

  5.    10 Jun 2017 #5

    There's quite a lot of events recorded in the security section at that time, but I don't understand the significance of any of them.
    Quite a few under the Task Category are User Account Management, but I see nothing referring to creation of users.
      My ComputerSystem Spec


  6. Posts : 6,468
    10 Home x64 (1709) (10 Pro on 2nd pc)
       10 Jun 2017 #6

    Syncopator said: View Post
    ... I see nothing referring to creation of users.
    If it was Eset then no actual user accounts were created, just folders that look like users. Eset creates dummy files and folders as 'honey traps' for malware. The idea is that if these get attacked it can identify and deal with the malware before the real users folders are lost.
      My ComputersSystem Spec

  7.    10 Jun 2017 #7

    Thank you Bree.

    Why, since I hadn't run Eset's online scanner for at least a few weeks, would those folders appear now?
      My ComputerSystem Spec


  • Posts : 6,468
    10 Home x64 (1709) (10 Pro on 2nd pc)
       10 Jun 2017 #8

    Have a look in the Task Manager's 'Start-up' tab and see if any Eset-related processes are still there. 'Services' could be worth a look too.
      My ComputersSystem Spec


  • Posts : 6,958
    Windows 10 Pro x64 Build 1709
       10 Jun 2017 #9

    It may not be Eset. I had just mentioned. Usually it come as part of Anti Theft and I'm pretty sure you have to install. You've said you used the online scanner which I assume installs nothing.
      My ComputerSystem Spec


  • Posts : 13,766
    Windows 10 Pro
       10 Jun 2017 #10

    Syncopator said: View Post
    Thank you Bree.

    Why, since I hadn't run Eset's online scanner for at least a few weeks, would those folders appear now?
    The time in your screenshots in first post do not show when the folders and files in them have been created. The time shows when they have been last modified.

    The fact that all of them show exactly the same time (13:40 / 1:40 this afternoon), most probably you booted then, strongly hints that Eset might be the culprit and in that case you should just leave them as they are; if they are what esteemed fellow members here suggest made by Eset to add an additional security layer, it would be logical that they would be accessed / modified every time you boot.
      My ComputerSystem Spec


  •  
    Page 1 of 3 123 LastLast

    Related Threads
    I don't remember when, but I availed myself of the free Windows 10 upgrade sometime back. I was using 8.1 and I had, at some point, moved C:\Users and all its associated folders to E:. Everything has worked fine and Win10 didn't have a problem. I...
    Unable to see folder C:\users\all users in User Accounts and Family Safety
    Using win10 - 64bit Logged into cmd prompt as admin. Cannot see C:\users\all users with the following cmd's Folder does not show in normal File Explorer window Run TREE cmd and the All Users folder does not show. Run DIR cmd for C:\users...
    Hi All, I've recently setup a clean install of Win10 onto a new system. Prior to this I backed up my 'Users' folder from the old setup (also Win10) onto my d:\ drive, on a second HDD. Now that the system is up and running, I've noticed that the...
    How to Unlock "Users\All Users\Documents folder in User Accounts and Family Safety
    The general method to change ownership is not working Please suggest some other method
    Only just recently downloaded win10 and everything is fine, however in going to edit the tag information for an audio track I noticed two additional "Groups or user names" in my list which weren't there when I was running win7. The first one is...
    Our Sites
    Site Links
    About Us
    Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

    Designer Media Ltd
    All times are GMT -5. The time now is 17:55.
    Find Us