New user created automatically with each restart

Page 4 of 5 FirstFirst ... 2345 LastLast

  1. Posts : 16
    Windows 7 Ultimate 32bit
    Thread Starter
       #31

    Ever since UsernameIssues mentioned that Phantom account, I started to suspect ESET badly. And after reading Greg's suggestion of uninstalling ESET, I knew what to get hold of. And yes Anak, you were spot on. A while ago I disabled the Anti-theft feature, deleted the evil account and restarted. For the first time during the last 8/9 days, there was no other account (other than the ones I created) showing in "Manage Accounts". Next, I enabled the feature again and had to create a Phantom account, with a nice friendly name, once again. Restarted. In the login screen the Phantom account showed up. Next, I deleted this account from the control panel. The next restart gave birth to an awful account in the "Manage Accounts" again, only with a different name.

    When I activated Anti-theft a year back, I had to create a Phantom account which is the standard user account I was having all the time. I think, somehow, ESET lost track of this account and went on creating account on its own. Any way, have to check a few days before I can really breathe a sigh of relief.
      My Computer


  2. Posts : 5,605
    Originally Win 7 Hm Prem x64 Ver 6.1.7600 Build 7601-SP1 | Upgraded to Windows 10 December 14, 2019
       #32

    This.....
    How to revert the status of a device to normal

    To revert a device to a normal state, click I recovered my device. The device will reboot and your normal user account will be re-enabled. After selecting I recovered my device, a device status change confirmation message will appear in a pop-up window which will include additional summary information.
    .... sounds like you can reset the protection.

    Its at the bottom of this page: Activate and configure Anti-Theft protection in ESET Smart Security - ESET Knowledgebase
      My Computer


  3. Posts : 16
    Windows 7 Ultimate 32bit
    Thread Starter
       #33

    .... sounds like you can reset the protection.
    Thats basically resetting the "missing" status of the device - it changes the status of the protected device to "Not missing" and the anti-theft mechanism becomes inactive.
      My Computer


  4. Posts : 4,566
    Windows 10 Pro
       #34

    gregrocker said:
    It's never a good sign IMO when an AV needs a special removal tool since it points to bloatware. I suspect we are seeing an example of that here.
    Just pointing out that every AV has a removal tool. Even Microsoft security essentials. It has nothing to do with bloatware, just making sure all files and keys are removed.

    ij2014 said:
    Ever since UsernameIssues mentioned that Phantom account, I started to suspect ESET badly. And after reading Greg's suggestion of uninstalling ESET, I knew what to get hold of. And yes Anak, you were spot on. A while ago I disabled the Anti-theft feature, deleted the evil account and restarted. For the first time during the last 8/9 days, there was no other account (other than the ones I created) showing in "Manage Accounts". Next, I enabled the feature again and had to create a Phantom account, with a nice friendly name, once again. Restarted. In the login screen the Phantom account showed up. Next, I deleted this account from the control panel. The next restart gave birth to an awful account in the "Manage Accounts" again, only with a different name.

    When I activated Anti-theft a year back, I had to create a Phantom account which is the standard user account I was having all the time. I think, somehow, ESET lost track of this account and went on creating account on its own. Any way, have to check a few days before I can really breathe a sigh of relief.
    That makes a lot of sense. Good spot greg, uni, and anak. The hidden account is so that no matter what an attacker does to a system it hopefully will not be noticed and can follow the users every move who stole it. Then get it back. I hope that solves your issue.
      My Computer

  5.    #35

    MSE doesn't have an additional removal tool, but offers a manual uninstaller that's only for the purpose of removing it if it can't be removed in Programs and Features.

    The bloatware AV's require an additional uninstaller because all of the extra crap they install can't be uninstalled by typical program Uninstall. The classic example is Norton. For years to uninstall it completely required also running the Norton Removal Tool to uninstall your Norton product .
    Last edited by gregrocker; 16 Nov 2014 at 17:35.
      My Computer


  6. Posts : 5,605
    Originally Win 7 Hm Prem x64 Ver 6.1.7600 Build 7601-SP1 | Upgraded to Windows 10 December 14, 2019
       #36

    ij2014 said:
    Anak said:
    This.....
    The device will reboot and your normal user account will be re-enabled.
    Thats basically resetting the "missing" status of the device - it changes the status of the protected device to "Not missing" and the anti-theft mechanism becomes inactive.
    Isn't that what you want?
      My Computer


  7. Posts : 10,485
    W7 Pro SP1 64bit
       #37

    Anak said:
    ij2014 said:
    Anak said:
    This.....
    Thats basically resetting the "missing" status of the device - it changes the status of the protected device to "Not missing" and the anti-theft mechanism becomes inactive.
    Isn't that what you want?
    As I recall, there are 3 states: something like missing, found and test.

    I don't think that ESET thinks that the device is missing... so there will be no button to push to change the computer from missing to found. The OP's normal user account on this computer is already enabled. See post #1 where the OP seems to be using a normal admin account to delete the phantom standard account.

    If the device were in the missing mode, then all normal accounts would be hidden. Only the phantom standard user account will be on the Welcome screen - and since that account has no password - the computer boots straight to the desktop for that phantom account. The OP could not delete the phantom account while logged into that account... hence my guess that the OP is using a normal admin account for the actions mentioned in post #1.


    When I was playing with that test mode, I could see all of the accounts (the normal ones and the phantom one). But maybe I was rushing things a bit. Maybe if I had given the test some more of my time - it might have hidden the normal accounts and been like a real test of a missing computer.

    Either way - I think that we can say that the phantom account is not malicious. The OP can uninstall and re-install ESET's software to see if that fixes the issue. Or live with the extra account. Or contact ESET for diagnostics of their app. I'm not sure that we will know the answer as to why the phantom account is being created at times when it should not be.

    :::back to lurking:::
      My Computer


  8. Posts : 5,605
    Originally Win 7 Hm Prem x64 Ver 6.1.7600 Build 7601-SP1 | Upgraded to Windows 10 December 14, 2019
       #38

    Good explanation UNI I don't have ESET or have ever used it, and I am attempting to offer educated explanations. It's nice to have someone here with the experience using it.
      My Computer


  9. Posts : 16
    Windows 7 Ultimate 32bit
    Thread Starter
       #39

    Anak said:
    ij2014 said:
    Anak said:
    This.....
    Thats basically resetting the "missing" status of the device - it changes the status of the protected device to "Not missing" and the anti-theft mechanism becomes inactive.
    Isn't that what you want?
    No Anak, for, my device was always in the "Not missing" state :)
      My Computer


  10. Posts : 16
    Windows 7 Ultimate 32bit
    Thread Starter
       #40

    I don't think that ESET thinks that the device is missing... so there will be no button to push to change the computer from missing to found. The OP's normal user account on this computer is already enabled. See post #1 where the OP seems to be using a normal admin account to delete the phantom standard account.

    If the device were in the missing mode, then all normal accounts would be hidden. Only the phantom standard user account will be on the Welcome screen - and since that account has no password - the computer boots straight to the desktop for that phantom account. The OP could not delete the phantom account while logged into that account... hence my guess that the OP is using a normal admin account for the actions mentioned in post #1.
    Absolutely correct UNI. It's just an admin account from which I used to delete that creepy account - it's only later that we learnt it was a phantom account generated by ESET on its own. And the state of my device was always "Not missing".


    Either way - I think that we can say that the phantom account is not malicious. The OP can uninstall and re-install ESET's software to see if that fixes the issue. Or live with the extra account. Or contact ESET for diagnostics of their app. I'm not sure that we will know the answer as to why the phantom account is being created at times when it should not be.
    Phantom account is created so that if the device is stolen, photos and screenshots and perhaps other info from the stolen device can be seen from an online ESET account (which might help in tracking down the stealer), provided the stolen device connects to net. And regarding uninstall and re-install, UNI, perhaps you have missed this post of mine:

    Ever since UsernameIssues mentioned that Phantom account, I started to suspect ESET badly. And after reading Greg's suggestion of uninstalling ESET, I knew what to get hold of. And yes Anak, you were spot on. A while ago I disabled the Anti-theft feature, deleted the evil account and restarted. For the first time during the last 8/9 days, there was no other account (other than the ones I created) showing in "Manage Accounts". Next, I enabled the feature again and had to create a Phantom account, with a nice friendly name, once again. Restarted. In the login screen the Phantom account showed up. Next, I deleted this account from the control panel. The next restart gave birth to an awful account in the "Manage Accounts" again, only with a different name.

    When I activated Anti-theft a year back, I had to create a Phantom account which is the standard user account I was having all the time. I think, somehow, ESET lost track of this account and went on creating account on its own. Any way, have to check a few days before I can really breathe a sigh of relief.
      My Computer


 
Page 4 of 5 FirstFirst ... 2345 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 06:14.
Find Us