weird new user account windows 7

[pontifex]

Recently I noticed there is a new user account on my laptop named vhrfnwuz. I did not create this account and no one else lives here or has access to create the account.

If I delete the account it comes back on reboot.
I've also set it to deactivated but it reactivates on reboot.

I'm running windows 7 and I keep it up to date. I also use Eset Antivirus, MalwareBytes Anti-malware (paid version), Windows Security Essentials, and MalwareBytes Anti-Exploit.

I've run scans with all of those and even some other apps but nothing is ever found.

I've read online that some programs will create an account to update themselves, like Nvidia does or did this at one point. I don't think I have any Nvidia software on my laptop though.

I've also read that a lot of people who run Eset have this problem so wondering if it might be from that?

I saw in some forums people run net user <username> to get more details.
Like in the case of Nvidia creating it, it shows Nvidia in the comment line but on mine it is blank.

It shows that it's never logged on and its only part of the users local group (not administrators) so that's a plus.

Any ideas?

 

[bononos]

That doesn't sound normal at all. Did you try using a rescue disk? It has a better chance of detecting hard to find/clean viruses.

 

[Puffnstuff]

Eset creates a phantom account for anti-theft purposes and it is normal so I would contact their customer support and ask them first before doing anything to that account.

 

[pontifex]

it looks like eset anti-theft is a separate program?

I am using eset smart security 8. I don't see an anti-theft option in it.



edit, nm it is enabled.

I checked the anti-theft settings and that account name is the exact same name of the phantom account in Eset. so Eset is the culprit here and it's not something malicious.

thanks!

 

[TheGardener]

I was curious and found this.

http://help.eset.com/antitheft/en-US/index.html?issue_no_fakeuseraccount.htm