Windows 10: [RESOLVED] Windows 10 suddenly creates strange -unknown- user names?

As stated in the title, all of a sudden my SSD-WIN10PRO - booted in VMware - is creating unknown usernames e.g.:














I've disabled above user for now.





Even though working with a booted SSD in VMware for many years, I've never seen this before. I have no idea why or what is causing this, every time deleting the account, but it keeps coming back with another username. I can't manage to find a direction to check what process is responsible for this. Help much appreciated.

Cheers

:)

 

How to reassign ownership/permission from one user (deleted) to another systematically in Windows 10

Hi Roland,

The Account Unknown user account is an user account that was created and then deleted at some point. This usually appears because "S-1-5-21......." is no longer stored as user account.

For more information about Account Unknown, please check the following thread:

• Account Unknown (S-1-5-21-873648000-3141518872-1301144625-1010)
  
• Build 14955 - unknown account has suddenly appeared. This thread is
  locked from future replies

Feel free to post back should you need further help.

 

Windows 10, start bar going wonky, flickering in windows, wallpaper disappearing, etc

While you are in Device Manager see if you have any errors or Unknown Devices flagged in there.

What happens if you create and test with another Windows user rather than your current user?

Create a user account Windows 8.1 or 10

http://windows.microsoft.com/en-au/windows/create-user-account#create-user-account=windows-8

 

When does it come back? Immediately or when you reboot? You could have a look in Event Viewer for Event ID 614 (New user created) and see if it gives any clue.

You could also have a look in AutoRuns and see if there is a start up task that is creating a user on startup/logon. Look under "Everything" after selecting "Hide Microsoft Entries" on the "View" tab and see if there is anything odd looking. Like in this case...https://answers.microsoft.com/en-us/...7-59e78ce027ec

Probably a virus/malware scan would be wise also.

 

Hi, thanks so much for your quick reply, much appreciated. It's even copying my own user account "username" to "username1". I need to boot without internet connection and review your options. Oh boy, what's happening? I'll send in a ticket at ESET forums ASAP. This is really spinning out of control now! *Shock

Will report back asap!

Cheers

 

1. No event ID 614 (New user created).

2. Running ESET "in depth scan" as admin now.





To be continued...

Cheers

 

3. Running WD Periodic Scanning at the same time now....

 

Have you thought about you system being hacked.....because that sure does look like it has been. There should never ever under any circumstances that you have mysterious user accounts created unless (you/owner) created them.

Either your VM or main system has been compromised....and it looks to be remotely. Run every spyware/malware/junkware and AV you have and see what they report. I've had some success with "Norton Power Eraser" for hard to get rid of and deeply embedded malicious software. And even then there's no guarantee that it's gone.

The only sure way is to format the drive and do a clean install......which I would recommend doing after you've tried everything else.

 

Yes, for 101% I'm thinking about the possibility of being hacked/compromised, but I'm running the advised checks maintenance first now step-by-step.

2a. ESET SS reported a clean system!

 

Update | Work in progress!

3a. WD Periodic Scanning returned clean!

4. Ran Process Explorer, and turned on the VirusTotal check -> found 3 issues, but for all processes only 1 AV Engine detected it! ESET reported all clean, so no worries?





- The 2nd is a process from Speccy System Info v1.29.714 (64) application, blocked it with ESET firewall.

 

*** this is an integrated copy of the one I posted on my 3 forums in question ***

UPDATE! | SOLVED!

Because I killed the internet connection as soon as I saw the account added, I was not able to check the Anti Theft (AT) status.

ESET, a big thank you to you! It was indeed caused by the AT ghost account, I changed it immediately to another and for me much more recognisable ghost-name! I apologize for my panic-attack.

Pff guys, I'm really sorry for stirring up things around here

, never had encountered this issues before, since I use ESET AT.

For now all-systems-are-GO! A very BIG thank you for all who tried to help me solve this headache issue!

Note to self: keep better track of your system thingies & RTFM!

Cheers