Windows 10: New unknown users have appeared in my Users folder.

I have Autoruns downloaded. Which of the exe files should I use? My Windows 10 is version 1703 (OS Build 15063.296)

 

Ran that, thank you.

Can't see Eset anywhere.

I did, though, find something left over from BitDefender, which I uninstalled a few weeks ago.
It's in the HKLM\System\CurrentControlSet\Services section, and is called Trufos Mini-Filter-Driver, BitDefender S.R.L

I presume I can get rid of it?

 

Its strange that ESET has done this, news to me. Have you tried any attempts to delete/erase the said usernames on your computer via administrator's tools if you've got it?

 

I can't say that deleting a key in registry is good or bad. If the software has been uninstalled I think risks are reduced.

That said I would make a backup of my registry and understand how to restore.

Very strange that there is nothing in services, startup or Autoruns.

Did you do a word / string search for eset in Registry?

It might be worth running Hitman Pro as just one more set of eyes.

When you were reviewing Autoruns did you see any security software that you were unaware of, McAffee, Bitdefender etc.

If you go to folders in File Manager and look at security who is it assigning permissions too?

Ken

 

Problem solved. I should have thought of this earlier, but I had very recently installed an anti-ranwomeware program - forget what it was called. Anyway, I uninstalled it and the extra user names disappeared.As I mentioned before, Bitdefender was on the machine but I uninstalled it a few weeks ago. There was an entry in Autoruns which was associated with Bitdefender. I uninstalled it, but it's still there in Autoruns with a "File not found" there too.

 

Excellent. If you could look into that ransomware name and post we can add it to our list of things that add users. Take care.

 

Sorry Ken, the name has completely gone from my memory. I saw it mentioned on one of the various advice and help sites and thought I'd give it a try. I can remember only a little of what its icon looked like. I'll have a fiddle with a graphics program and see if can produce something (vaguely) similar.




There, that's the best I can think of. Something similar to it anyway.

 

Thanks.

Edit 1:

Maybe this

​

 

Yes Ken, that was it.

I didn't do a very good likeness did I ?

I wonder if those addresses were "honey traps" as mentioned by Bree in post #6.

 

Actually your likeness was great. It got me to it in one guess. Bree knows his stuff. I would go with it. Not sure how they would be used in a ransomware attack.

It is just an arms race. The good guys do this, the bad guys respond and up the ante. Good guys respond and the dance goes on.

 

Now we have a name we can check its FAQ...

https://ransomfree.cybereason.com/fa...-7a4150b6-8a0b

...yep, look like they are.

 

Thank you Bree. Unless you advise otherwise I think I will re-install it.

 

I haven't used it, so can't advise either way. There's a thread discussing it on SevenForums...

https://www.sevenforums.com/system-s...free-tool.html

 

An interesting link Bree. Got me thinking.