Suspicious hidden user accounts

[ammonv]

Hi there,

I accidentally stumbled across some hidden user accounts on my account by enabling hidden files. They are extremely strange, and from what I can tell have no place being there. Here is a picture with all the folders shown:


I tried opening one of the files inside the hidden user accounts and nothing happens. Just says they are corrupted or cannot be opened, etc.

I looked up some other posts and saw something about using a cmd command and I tried it but the computer said the user accounts didn't exist? The command was

net user "username" /active:no

I think that was it.

Anyways, I've done virus scans and nothing is popping up. Any help would be appreciated.

Here's a picture to the files: https/imgur.com/bcEpft6

 

[Peter Martin]

Too small to read for me

 

[dalaran]

It's weird, two possibilities in my mind
#1 you've got a virus
#2 some kind of honeypot for ransomware detection, do you have a program called Cybereason RansomFree if so it's most likely related
See: https/security.stackexchange.com/questions/148511/can-you-recognize-this-virus
The way these seem to work is they create some random files which look like user file and keep watch on them, if they get modified they can detect it and try to stop the misbehaving process, since they are the first and last folder they're most likely to be targeted by ransomware first...

Otherwise did you install any programs on 9/26/2018 if so it's likely related, all files have the same timestamp

 

[ammonv]

I just downloaded Cybereason. I guess I had no idea how it worked but that makes sense! Thanks for calming me down.