0

Today I was through folder information and, when I switched to the security tab, I observed that there were 5 users listed there. In this list, there was also a user called "yupgyzmhuma". I tried searching it on google, but there was no information about it. So, whatever it is, it can't be something common to all Windows computers, otherwise I would have found information about it, right? Then, I looked through my girlfriend's laptop and found only 4 users, the only one missing being "yupgyzmhuma". The user has no privileges, so if it was created by malware, I don't know what it could do. I have Eset Antivirus Installed on my computer. Most probably, it's not something bad, but I am still curios about what it's origin might be. Sorry, if I am off-topic![enter image description here]1

  • What is drive D - local drive or external connected drive? Also what makes you say the account has no permissions? you are only providing a screenshot of file system permissions from one folder on one drive of your computer. – HackneyB Feb 23 at 16:58
  • It's a local drive. Yeah, I suppose it wouldn't make sense to have an account without privileges anywhere. Apparently, it was a user created by eset, for anti-theft functionality – DragonRider Feb 23 at 22:47
0

Two potential explanations. One, malware could have created the account. Two, ESET has some anti-theft functionality which creates what they call phantom accounts.

The account name seems random so I would not expect to find that account name by googling it.

Suggestions for malware path:

  • ensure you scan the computer fully with your antivirus
  • learn more about the account - check the local group membership, see if there are any services set to run under it, or search your registry for this string. All require some knowledge of system administration. If you open command prompt and run the net user command for the account, you will also be able to see when the account was created, logged onto and group membership. This could lead to attributing the account creation to your system install date, or antivirus install date, or that one time 6 months ago when you browsed to a porn site and some malware made your browser run weird.
  • depending on outcomes above, deal with any risks of leaving the account there, having a virus and anything else applicable

Suggestions for ESET path:

  • get ESET support to help you explain if their software does this, especially if you have anti-theft software from them
  • I ran the command net users yupgyzmhuma and observed that the creation date ad hour corresponds to me installing eset. And, like you suspected, eset does have anti-theft functionality. So, maybe that is it's purpose, after all. Thanks a lot for the help! – DragonRider Feb 23 at 22:41
  • yup - yes gyz - guy's huma- human... yep, the guy's a human..... – drtechno Feb 24 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.