Unknown Auditing entity

[rzn6jw]

There is an unknown (to me) entry in my C: drive Security/Advanced/Auditing properties box (see the attached image - the entry in question is the first entry, the S-1..... entry).

Does anyone know what this entry is and if I can get rid of it?

Thanks.

 

[Jacee]

What does it say if you click 'edit' on the entry? It could be your profile/identity

 

[rzn6jw]

All it says is in the attached. There is no other information to display. Makes me wonder if this is a virus/trojan/malware, etc, since it has full control over everything.

 

[Golden]

Mmm...that looks like a classic Recycler reference. Is this a work PC, or home PC?

Usually, the Recycler folders are Read-Only....but there was a Recycler virus going around a while back.....is that correct Jacee?

Found this, but not sure of its applicability :

Remove Recycler Virus - What it is and How to Conduct a Recycler Virus Removal

Regards,
golden

 

[rzn6jw]

This is a home PC - Win 7 64-bit Pro. I've run IOBit, MalwareBytes, and NIS 2012 and all come up clean.

 

[rraod]

This is a Security identifier for one of your previous user which you/system might have created in earlier windows on this disk and you might have upgraded this hard drive with new OS (like from winXP to Win 7).

The old user name is deleted with the upgrade but the NTFS file system retains the SID of the previous users in the form (S-1-5-21-3894458719-3405545046-3428966848-1000) in the Access Control Lists (NTFS permissions) for all the old retained folders and files.

Open the Regedit and expand the HKey_Users and you will find entries of keys with such names.

As these are the Security identifiers of old users which does not exist now, it is safe to delete them from the NTFS permissions for all folders.