Strange Virus: Constantly creating new user accounts

[Golden]

I had the same problem, contacted Eset and it turns out, the version of smart security 6 is creating the phantom user.

Yours is a different problem entirely - ESET Smart Security 6 was released after the data of the original problem discussed above, and is a known issue discussed elsewhere on the forum

 

[drockmd]

Would you be kind enough to point me to the thread where it shows how to handle the issue in case I still have a virus?

 

[Golden]

Would you be kind enough to point me to the thread where it shows how to handle the issue in case I still have a virus?

Start your own thread describing your issue - that way its easier for everyone to stay focused on the issue.

 

[michaelward]

I have exactly the same problem as the original post. Phantom user accounts appearing. The names of the current ones are:
atiibxtgx
jqrycozk
Im not sure but they seem to appear when i reboot windows after i have previously booted in mac OS. This might just be a coincidence of rebooting.
I have logged a support request with Eset. Will wait and see if they come back with anything useful.

 

[NimrodYanai]

Sorry to bump this post. Here's the situation: I am having a phantom user created once in a while. It happened a few monthes ago, I changed all my passwords on another computer (though there seem to have been no unusual activity in any account anywhere...), did complete scans with ESET and Malwarebytes, and when that didn't work - did a full formatting and reinstall of my Windows 7.
The user account name is cfspwpsd, normal account (no admin).
After the format everything was fine for a couple of months... Now it suddenly returned! It's the same user name as a few months back.
I redid all the checks, an online ports check, used Kaparsky TDSkiller for rootkits, and now found this thread and followed the instructions, eventually using combofix to see if it works. Here is the log files for the TDSkiller and Combofix.
Now here's the thing: I used to already have a phantom user for ESET theft protection. This new account is ON TOP of that account.

Anyone have any idea what's going on?

Thanx a lot for the help!

 

[NimrodYanai]

OK guys, never mind.
It seems that ESET changed their anti-theft settings online. Once I was asked to create a phantom user and I did, and now they changed the settings to create a phantom user automatically every X minutes if it doesn't exist yet... I stumbled on to it randomly online. I was able to change the automatic name to a different, less random one. Doesn't seem to be a virus after all, and all is well. Sorry to have bothered you.

 

[SCs47]

Although this post started 3 years ago, but maybe the problem is not completely cleared up even today. I had the same problem now in July 2015, and searched the Internet for solutions, but have not found any really satisfying result. Then I called the ESET Antivirus Technical Helpdesk, since I also have this antivirus software. It turned out that the additional user account was created by the ESET AntiVirus software's Antitheft module under certain circumstances. If someone still has the same problem, please contact the technical helpdesk of ESET. The solution is quite easy, if one follows their advice.