I had to enable "Show hidden hidden files" in order to install Wizcrafts' latest Spam Filters for Mailwasher.
There are two new users there. They were created dated today, when I first switched the computer on.
What are they?
Hi Syncopator.
Any chance you are running Eset security? It has been known to create users as part of it anti theft settings.
If not that I would check with the security product you are using to see if it is using same strategy.
But be something totally different but I recall this is one cause.
Ken
Hello Ken.
I occasionally use Eset's on-line scanner, the last time a few weeks ago. Nothing from Eset permanently installed.
I'm using BullGuard and Malwarebytes. There's nothing I can see in either of their settings which I can associate with this. Besides, today is the first time I've seen this phenomena.
I am thinking I should uninstall these two new id's and reboot to see if it happens again.
I would first look in the event viewer, I'm thinking security section. See if there are events for the creation of users, you have date and time, and see if that gives anymore detail.
Any chance any other security product was stuck in? You know when you update flash and they included a bonus, like McAffee.
Not sure on deleting but if something needs I assume it will re-install.
There's quite a lot of events recorded in the security section at that time, but I don't understand the significance of any of them.
Quite a few under the Task Category are User Account Management, but I see nothing referring to creation of users.
Thank you Bree.
Why, since I hadn't run Eset's online scanner for at least a few weeks, would those folders appear now?
Have a look in the Task Manager's 'Start-up' tab and see if any Eset-related processes are still there. 'Services' could be worth a look too.
It may not be Eset. I had just mentioned. Usually it come as part of Anti Theft and I'm pretty sure you have to install. You've said you used the online scanner which I assume installs nothing.
The time in your screenshots in first post do not show when the folders and files in them have been created. The time shows when they have been last modified.
The fact that all of them show exactly the same time (13:40 / 1:40 this afternoon), most probably you booted then, strongly hints that Eset might be the culprit and in that case you should just leave them as they are; if they are what esteemed fellow members here suggest made by Eset to add an additional security layer, it would be logical that they would be accessed / modified every time you boot.
Quote