Unknown User Account

EddieB1106 said:

It seems I get an unknown account with my name after a windows update. I tried the above suggestion but still get the other account as it seems to have priority. Can I just delete those couple of users or will it cause problems? In the new TEMP directory there is only one file in AppData and it's dd.ttf and the xxQBdata has quite a bit, 197 MB.
Volume in drive C has no label.
Volume Serial Number is 4936-1D66


Directory of C:\Users\xxQBDataServiceUser23


09/20/2019 08:32 AM <DIR> .
09/20/2019 08:32 AM <DIR> ..
09/29/2017 08:46 AM <DIR> Desktop
10/27/2017 04:10 PM <DIR> Documents
09/29/2017 08:46 AM <DIR> Downloads
09/29/2017 08:46 AM <DIR> Favorites
09/29/2017 08:46 AM <DIR> Links
09/29/2017 08:46 AM <DIR> Music
09/29/2017 08:46 AM <DIR> Pictures
09/29/2017 08:46 AM <DIR> Saved Games
09/29/2017 08:46 AM <DIR> Videos
0 File(s) 0 bytes
11 Dir(s) 120,786,731,008 bytes free

Ahh the Junction directory I see. For me this is a corrupt install and could lead to an infected USB stick containing the Windows ISO. Or even a disc.

This has been bugging me for a few months now, actually a few years
It all started from when I first installed Windows 7 or 8, cant remember the date exactly. This type of file system really gets on my nerves and feels untrust worthy.
The Task Schedular in modern operating systems was never originally intended to be abused but for me it is totally the opposite. Seems inevitable that at some point you will pick up a Trojan and be totally unaware of it. The TEMP files i see in your User list, shouldnt normally be there. So send them to a CD or DVD for analysis and remove them from the PC.

Dont want to make you paranoid like me, but It looks like you have a roaming profile writing to itself all within the Default User account. Windows 'Maintainance' and 'Servicing' abuse all through the Default User profile.
Call it possibly syncing all of your data into the Default User profile and vice versa. You wont see the Junction file abuse whilst being locked out of ownership of the C drive. Group Policy setting changes could have taken place.
Take ownership of the C drive and have a damn good look about.

Change folder options and show all files and folders and make sure you can see protected files. But do not force all folders to view the same.
Now do a check out of your own 'desktop.ini' file/files on your machine. A fresh install highlights a lot at this point. Use File Explorer and change the view to 'Details' and add 'Folder Name' to the top custom options.

Search the whole of the C drive for 'desktop.ini'. When that lot is finished, have a look at the added 'Folder' location of the found 'desktop.ini' If you have a very very very long link passing through the Default User profile using the Junction directory, you may possibly have some form of Malware on the machine.

It may look like this. DefaultUser/Application Data/Application Data/Application Data/Application Data/Application Data/ApplicationData/ApplicationData. I would check out what initial Windows packages were installed and also WinX

Have a good read on the desktop.ini file system and abuse, worms.

Peace out

Edit: Microsoft got some pretty powerful stuff quietly sniffing away :-(