How JustAnswer Works:
  • Ask an Expert
    Experts are full of valuable knowledge and are ready to help with any question. Credentials confirmed by a Fortune 500 verification firm.
  • Get a Professional Answer
    Via email, text message, or notification as you wait on our site. Ask follow up questions if you need to.
  • 100% Satisfaction Guarantee
    Rate the answer you receive.
Ask Richard Your Own Question
Richard, Software Engineer
Category: Software
Satisfied Customers: 38375
Experience:  Software Systems Specialist.
Type Your Software Question Here...
Richard is online now

I am running Windows 10 on a Surface Pro 3. I have started

Resolved Question:

I am running Windows 10 on a Surface Pro 3. I have started getting random new user accounts created, with names such as 'utfvvcpkfyed'. The mystery accounts have no password. I have eset and Malwarebytes installed, which have identified no threats. Can
you tell me what is happening?
Submitted: 1 year ago.
Category: Software
Expert:  Richard replied 1 year ago.
Hi there and welcome
This can occur from installed programs, that create user accounts in order to access the system
If you delete the account, does it stay deleted?
Customer: replied 1 year ago.
yes but another one appears - with a different name. When I first noticed this last night there were at one time 2 extra users. How can I identify the cause and stop it happening?
Expert:  Richard replied 1 year ago.
What did you install around the time this started?
Customer: replied 1 year ago.
To my knowledge nothing new for about 2 or 3 weeks, and then it was an app called Staffpad from the MS App Store. is there a way to find out if any other apps have been installed recently?
Expert:  Richard replied 1 year ago.
yes, press the windows key + X and click on control panel
Then uninstall a program
then click on date installed and it will then show you there.
Customer: replied 1 year ago.
Last three programs installed were:
1) Microsoft Office 365 en-us on 25/11/15 - I had been testing software for an American customer and used Office before I set the localisation settings back to UK,
2) GotoMeeting on 22/11/15 presumably an update
3) Displaylink Core Software on 8/11 again presumably an updateI suppose the mystery accounts might have been there longer, as I normally just log in without thinking into my everyday (not admin) account. But I can't see any sinister programs there.tbh I have been having a problem with screen settings recently (one screen keeps reverting to portrait mode) but that is presumably to do with the Displaylink update.
Expert:  Richard replied 1 year ago.
ok, press CTRL + ALT + Delete and click on Task Manager
Click on the Startup Tab, and disable all items.
Then remove the accounts.
Restart the computer and tell me if they come back please
Customer: replied 1 year ago.
OK disabled all startups except the following which wouldn't let me:
mcci+McciTrayApp(3) (Alcatel-Lucent)
ituneshelper (Apple Inc)
Eset main GUI (Eset)
hpwuSchd Apliccation (Hewlet Packard)
Then restarted as Admin and deleted the accounts.
Then restarted. No mystery accounts. Logged in as everyday account. and immediately a new account was there.
Expert:  Richard replied 1 year ago.
whats the name of the new account?
and where exactly do you see it?
Customer: replied 1 year ago.
utfvvcpkfyed - interesting - its the same as last time!
If I press the windows key and then click on my login name I can see it. fyi I can see my login name, admin, the fictitious name I chose for Eset anti-theft, and the new name.
Expert:  Richard replied 1 year ago.
Its being done by a program installed.
Try disabling all services as well and then remove it and see if it reappears.
To do that, press the windows key + R and type in
and press enter.
Click on the Services Tab and click "Hide All Microsoft Services"
Then click Disable All
Click ok, restart and let me know if it appears again
Customer: replied 1 year ago.
Nope They are still disabled (except for Eset) , but the account has come back. I'll just delete it again to make sure I didn't screw up.
Expert:  Richard replied 1 year ago.
not start, this is now services, this is different to what I asked you before to do.
Customer: replied 1 year ago.
No - I did disable all non-microsoft services. The only service that re-instated itself was Eset Service. I have checked and repeated the sequence. Account disappears, is not there when logging on after restart, then instantly reappears.
Expert:  Richard replied 1 year ago.
ah ok, was just confirming
there is a program thats doing this. I could see nothing against this type of account name, but your going to have to start uninstalling programs around the time this problem started to see which is doing it.
Office you can leave as this will not be the one.
Customer: replied 1 year ago.
real question is - if this is just set up as a local account, can it cause harm - i.e. spy on passwords etc?
Expert:  Richard replied 1 year ago.
If you had not run Malwarebytes, then potentially, but you ran a full scan so no, your safe from this, its a program using the account for a service.
Customer: replied 1 year ago.
OK thanks
Expert:  Richard replied 1 year ago.
your welcome
If you would like any additional information or assistance or see any issues arise from it (ie: more accounts being made), please do not hesitate to let me know.
And if you can take a second to rate my service by clicking one of the stars at the top of the screen then submit, that would be greatly appreciated.
Thank you
Richard and other Software Specialists are ready to help you