Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: New user created automatically with each restart

15 Nov 2014   #31
ij2014

Windows 7 Ultimate 32bit
 
 

Ever since UsernameIssues mentioned that Phantom account, I started to suspect ESET badly. And after reading Greg's suggestion of uninstalling ESET, I knew what to get hold of. And yes Anak, you were spot on. A while ago I disabled the Anti-theft feature, deleted the evil account and restarted. For the first time during the last 8/9 days, there was no other account (other than the ones I created) showing in "Manage Accounts". Next, I enabled the feature again and had to create a Phantom account, with a nice friendly name, once again. Restarted. In the login screen the Phantom account showed up. Next, I deleted this account from the control panel. The next restart gave birth to an awful account in the "Manage Accounts" again, only with a different name.

When I activated Anti-theft a year back, I had to create a Phantom account which is the standard user account I was having all the time. I think, somehow, ESET lost track of this account and went on creating account on its own. Any way, have to check a few days before I can really breathe a sigh of relief.


My System SpecsSystem Spec
.
15 Nov 2014   #32
Anak

Microsoft Community Contributor Award Recipient

Win 7 Home Premium 64bit Ver 6.1.7600 Build 7601 - SP1
 
 

This.....
Quote:
How to revert the status of a device to normal

To revert a device to a normal state, click I recovered my device. The device will reboot and your normal user account will be re-enabled. After selecting I recovered my device, a device status change confirmation message will appear in a pop-up window which will include additional summary information.
.... sounds like you can reset the protection.

Its at the bottom of this page: Activate and configure Anti-Theft protection in ESET Smart Security - ESET Knowledgebase
My System SpecsSystem Spec
16 Nov 2014   #33
ij2014

Windows 7 Ultimate 32bit
 
 

Quote:
.... sounds like you can reset the protection.
Thats basically resetting the "missing" status of the device - it changes the status of the protected device to "Not missing" and the anti-theft mechanism becomes inactive.
My System SpecsSystem Spec
.

16 Nov 2014   #34
andrew129260

Windows 10 Pro
 
 

Quote   Quote: Originally Posted by gregrocker View Post
It's never a good sign IMO when an AV needs a special removal tool since it points to bloatware. I suspect we are seeing an example of that here.
Just pointing out that every AV has a removal tool. Even Microsoft security essentials. It has nothing to do with bloatware, just making sure all files and keys are removed.

Quote   Quote: Originally Posted by ij2014 View Post
Ever since UsernameIssues mentioned that Phantom account, I started to suspect ESET badly. And after reading Greg's suggestion of uninstalling ESET, I knew what to get hold of. And yes Anak, you were spot on. A while ago I disabled the Anti-theft feature, deleted the evil account and restarted. For the first time during the last 8/9 days, there was no other account (other than the ones I created) showing in "Manage Accounts". Next, I enabled the feature again and had to create a Phantom account, with a nice friendly name, once again. Restarted. In the login screen the Phantom account showed up. Next, I deleted this account from the control panel. The next restart gave birth to an awful account in the "Manage Accounts" again, only with a different name.

When I activated Anti-theft a year back, I had to create a Phantom account which is the standard user account I was having all the time. I think, somehow, ESET lost track of this account and went on creating account on its own. Any way, have to check a few days before I can really breathe a sigh of relief.
That makes a lot of sense. Good spot greg, uni, and anak. The hidden account is so that no matter what an attacker does to a system it hopefully will not be noticed and can follow the users every move who stole it. Then get it back. I hope that solves your issue.
My System SpecsSystem Spec
16 Nov 2014   #35
gregrocker

 

MSE doesn't have an additional removal tool, but offers a manual uninstaller that's only for the purpose of removing it if it can't be removed in Programs and Features.

The bloatware AV's require an additional uninstaller because all of the extra crap they install can't be uninstalled by typical program Uninstall. The classic example is Norton. For years to uninstall it completely required also running the Norton Removal Tool to uninstall your Norton product .
My System SpecsSystem Spec
16 Nov 2014   #36
Anak

Microsoft Community Contributor Award Recipient

Win 7 Home Premium 64bit Ver 6.1.7600 Build 7601 - SP1
 
 

Quote   Quote: Originally Posted by ij2014 View Post
Quote   Quote: Originally Posted by Anak View Post
This.....
Quote:
The device will reboot and your normal user account will be re-enabled.
Thats basically resetting the "missing" status of the device - it changes the status of the protected device to "Not missing" and the anti-theft mechanism becomes inactive.
Isn't that what you want?
My System SpecsSystem Spec
16 Nov 2014   #37
UsernameIssues

W7 Pro SP1 64bit
 
 

Quote   Quote: Originally Posted by Anak View Post
Quote   Quote: Originally Posted by ij2014 View Post
Quote   Quote: Originally Posted by Anak View Post
This.....
Thats basically resetting the "missing" status of the device - it changes the status of the protected device to "Not missing" and the anti-theft mechanism becomes inactive.
Isn't that what you want?
As I recall, there are 3 states: something like missing, found and test.

I don't think that ESET thinks that the device is missing... so there will be no button to push to change the computer from missing to found. The OP's normal user account on this computer is already enabled. See post #1 where the OP seems to be using a normal admin account to delete the phantom standard account.

If the device were in the missing mode, then all normal accounts would be hidden. Only the phantom standard user account will be on the Welcome screen - and since that account has no password - the computer boots straight to the desktop for that phantom account. The OP could not delete the phantom account while logged into that account... hence my guess that the OP is using a normal admin account for the actions mentioned in post #1.


When I was playing with that test mode, I could see all of the accounts (the normal ones and the phantom one). But maybe I was rushing things a bit. Maybe if I had given the test some more of my time - it might have hidden the normal accounts and been like a real test of a missing computer.

Either way - I think that we can say that the phantom account is not malicious. The OP can uninstall and re-install ESET's software to see if that fixes the issue. Or live with the extra account. Or contact ESET for diagnostics of their app. I'm not sure that we will know the answer as to why the phantom account is being created at times when it should not be.

:::back to lurking:::
My System SpecsSystem Spec
16 Nov 2014   #38
Anak

Microsoft Community Contributor Award Recipient

Win 7 Home Premium 64bit Ver 6.1.7600 Build 7601 - SP1
 
 

Good explanation UNI I don't have ESET or have ever used it, and I am attempting to offer educated explanations. It's nice to have someone here with the experience using it.
My System SpecsSystem Spec
17 Nov 2014   #39
ij2014

Windows 7 Ultimate 32bit
 
 

Quote   Quote: Originally Posted by Anak View Post
Quote   Quote: Originally Posted by ij2014 View Post
Quote   Quote: Originally Posted by Anak View Post
This.....
Thats basically resetting the "missing" status of the device - it changes the status of the protected device to "Not missing" and the anti-theft mechanism becomes inactive.
Isn't that what you want?
No Anak, for, my device was always in the "Not missing" state
My System SpecsSystem Spec
17 Nov 2014   #40
ij2014

Windows 7 Ultimate 32bit
 
 

Quote:
I don't think that ESET thinks that the device is missing... so there will be no button to push to change the computer from missing to found. The OP's normal user account on this computer is already enabled. See post #1 where the OP seems to be using a normal admin account to delete the phantom standard account.

If the device were in the missing mode, then all normal accounts would be hidden. Only the phantom standard user account will be on the Welcome screen - and since that account has no password - the computer boots straight to the desktop for that phantom account. The OP could not delete the phantom account while logged into that account... hence my guess that the OP is using a normal admin account for the actions mentioned in post #1.
Absolutely correct UNI. It's just an admin account from which I used to delete that creepy account - it's only later that we learnt it was a phantom account generated by ESET on its own. And the state of my device was always "Not missing".


Quote:
Either way - I think that we can say that the phantom account is not malicious. The OP can uninstall and re-install ESET's software to see if that fixes the issue. Or live with the extra account. Or contact ESET for diagnostics of their app. I'm not sure that we will know the answer as to why the phantom account is being created at times when it should not be.
Phantom account is created so that if the device is stolen, photos and screenshots and perhaps other info from the stolen device can be seen from an online ESET account (which might help in tracking down the stealer), provided the stolen device connects to net. And regarding uninstall and re-install, UNI, perhaps you have missed this post of mine:

Quote:
Ever since UsernameIssues mentioned that Phantom account, I started to suspect ESET badly. And after reading Greg's suggestion of uninstalling ESET, I knew what to get hold of. And yes Anak, you were spot on. A while ago I disabled the Anti-theft feature, deleted the evil account and restarted. For the first time during the last 8/9 days, there was no other account (other than the ones I created) showing in "Manage Accounts". Next, I enabled the feature again and had to create a Phantom account, with a nice friendly name, once again. Restarted. In the login screen the Phantom account showed up. Next, I deleted this account from the control panel. The next restart gave birth to an awful account in the "Manage Accounts" again, only with a different name.

When I activated Anti-theft a year back, I had to create a Phantom account which is the standard user account I was having all the time. I think, somehow, ESET lost track of this account and went on creating account on its own. Any way, have to check a few days before I can really breathe a sigh of relief.
My System SpecsSystem Spec
Reply

 New user created automatically with each restart




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
System restore points not being automatically created
Hello Everyone - it's been a while since I posted here, so I apologize for any errors I may make. I have a Dell Inspiron Core I5 Windows 7 SP1 PC with Norton internet security. My question is: what are the rules that govern when the system will make automatic restore points. I've read...
Backup and Restore
Created admin User but can see on 'Switch User" cntrl/alt/del
Hello Interestingly on boot up I see "another user" but the picture is blank, with a frame around it (I can see through it to the boot wallpaper that I have changed to prove) .. Who is another user? Please help as I have been on the 2 days now:o
System Security
Where are the pictures that automatically get created in GameExplorer
My problem is: I know the GameBox pictues are in> C:\Users\Username\AppData\Local\Microsoft\Windows\GameExplorer But what about pictures that automatically get created in GameExplorer, these are not in the C:\Users\Username\AppData\Local\Microsoft\Windows\GameExplorer folder. Where do I find...
Gaming
User accounts created but not able to logon - No user profile
I am a lab technician for Microsoft classes at a community college. One of our students somehow messed up his hard drive. The computer is running Windows 7 Enterprise SP1 64-bit. The system has two administrator accounts and one standard user account. I am still able to logon with those accounts...
General Discussion
Automatically open a created folder
So one cool thing I liked about vista was that it switched (aka opened) the folder you just created. I know for some this was probably annoying depending on what you were doing but it fit my usage scenarios perfectly. I am hoping it is nothing more than a registry setting but I havenít been able...
Customization
Administrator folder automatically created!
Administrator forlder automatically creared! http://img15.imageshack.us/img15/9172/win7administratorproblejw8.jpg As you can see above, there are 3 Administrator folders! 1. Administrator_ploc.WINDSTORY7 <- this is qhat I installed 2. Administrator_ploc <- I don't know who made...
General Discussion


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 19:52.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App