Windows 10: New unknown users have appeared in my Users folder.

I had to enable "Show hidden hidden files" in order to install Wizcrafts' latest Spam Filters for Mailwasher.

There are two new users there. They were created dated today, when I first switched the computer on.

What are they?













:)

 

Windows 10 has renamed my Users folder and I can't change it back

Hello Angus_Podgorney -

Can you create a new user account on the computer? Because the software you used appears to have renamed your user folder, it might be easier to create a new user and copy the contents of the old user folder to the new user.

Does that make sense?

 

windows 10 Surface Book

No it doesn't. Thank you for trying but your answer didn't work and quite frankly very confusing. It is the reason people are frustrating with MS. My question is simple. Why can I create/save a file in the User/Name folder and it does not appear in the
MYPC folder

Example

User/SB/Documents/123.xls

MyPC/Documents/123.xls does not appear

I can create a new folder in User/SB and the new folder will not appear in MYPC

Also OneDrive is syncing with MYPC and not User/SB

 

Hi Syncopator.

Any chance you are running Eset security? It has been known to create users as part of it anti theft settings.

If not that I would check with the security product you are using to see if it is using same strategy.

But be something totally different but I recall this is one cause.


Ken

 

Hello Ken.

I occasionally use Eset's on-line scanner, the last time a few weeks ago. Nothing from Eset permanently installed.
I'm using BullGuard and Malwarebytes. There's nothing I can see in either of their settings which I can associate with this. Besides, today is the first time I've seen this phenomena.

I am thinking I should uninstall these two new id's and reboot to see if it happens again.

 

I would first look in the event viewer, I'm thinking security section. See if there are events for the creation of users, you have date and time, and see if that gives anymore detail.

Any chance any other security product was stuck in? You know when you update flash and they included a bonus, like McAffee.

Not sure on deleting but if something needs I assume it will re-install.

 

There's quite a lot of events recorded in the security section at that time, but I don't understand the significance of any of them.
Quite a few under the Task Category are User Account Management, but I see nothing referring to creation of users.

 

If it was Eset then no actual user accounts were created, just folders that look like users. Eset creates dummy files and folders as 'honey traps' for malware. The idea is that if these get attacked it can identify and deal with the malware before the real users folders are lost.

 

Thank you Bree.

Why, since I hadn't run Eset's online scanner for at least a few weeks, would those folders appear now?

 

Have a look in the Task Manager's 'Start-up' tab and see if any Eset-related processes are still there. 'Services' could be worth a look too.

 

It may not be Eset. I had just mentioned. Usually it come as part of Anti Theft and I'm pretty sure you have to install. You've said you used the online scanner which I assume installs nothing.

 

The time in your screenshots in first post do not show when the folders and files in them have been created. The time shows when they have been last modified.

The fact that all of them show exactly the same time (13:40 / 1:40 this afternoon), most probably you booted then, strongly hints that Eset might be the culprit and in that case you should just leave them as they are; if they are what esteemed fellow members here suggest made by Eset to add an additional security layer, it would be logical that they would be accessed / modified every time you boot.

 

Ken. Bree, Kari,

Thank you all for your interest.

I looked at Task Manager and saw nothing I can associate with Eset in either Start-up or Services.

If what your say is correct Kari, I wonder why I didn't see these extra users when I opened up the Users folder to install new filters in Mailwasher, i.e. with "Show hidden files and folders" enabled?

 

Out of curiosity I rebooted and looked again at the Users folder. There are extra ones again but they now have different names.

 

Since you didn't see Eset in services or Start-Up might I suggest you look at Autoruns,(download) part of Sysinternals and see if you can find something Eset may have installed. Actually this will give a view into all sorts of things. I wouldn't change anything with proper backups in place.

I guess you could also search your registry looking for the word Eset. No real need to say it but when in the registry caution is always recommended.