New User Accounts/Usernames Appeared unexpectedly - Are These Windows, or Malware??

[WA3HPa600n]

My Windows 8 (x64) now includes some unexpected names  - -  in the C:\Users folder!  The next level under the Users folder in its subfolder tree (in the explorer.exe window)  when this HP Pavilion g7 was new, basically showed me my three (3) known Usernames that I had set up in Control Panel and the Public folder.  Those were,  my password-protected admin account name and two (2) password-protected usernames, call them Std.1 and Std.2 plus the built-in Administrator and the built-in Default subfolder. Guest account also shows on login screen when authorized in CP.

Now, over recent 2 or 3 months, something has set several additional subfolders into the Users folder  - -  names including:
.NET v4.5
.NET v4.5 Classic
DefaultAppPool
DefautAppPool.IIS APPPOOL

Also, a very strange User in Properties Security tab was, and I quote,

Account Unknown(S-1-15-2-2551677095-2355568638-4209445997-2436930744-3692183382- 387691378-1866284433)  

On certain folders/files, some of these accounts' names also show up in the Security tab of the Proprties sheet, conferring Privileges on the questionable account.. 

Such names were not assigned manually, and these folders must have been created by the software. Are these known to have been created by Windows? If not, are they likely to be from Malware?

Surely, some Microsoft expert can say authoritatively that the 4 names above are properly generated by a Windows Expert or other Microsoft authoritative sourcs. Is this a sign of Malware?

[Mrstenter]

Hi @WA3HPa600n ,

Thank you for visiting the HP Support Forums and Welcome. It is a great site for information and questions. I have looked into your issue about your HP Pavilion g7 Notebook and concerns of the folders on your system. These are Windows files the .net 4.5 is the Microsoft .Net framework. You need this on your notebook. The Apps folder is for the Apps you use with Windows 8.  These are all normal folders and are not a virus.

Here is a definition of the Framework on your Notebook.

Hope this helps.

Thanks.

[WA3HPa600n]

.Thank you, Mrstenter, for the courtesy of replying to my inquiry.

OK, I understand .NET 4.5 does come from Microsoft®, but I do wonder that this add-on should require a folder tree in C:\Users.  Why and how should .NET Framework 4.5 be treated as a User? Is it not a set of executables and libraries?

I do not understand, and  please explain,  why did ".NET 4.5 Classic" appear, in addition to .NET 4.5?  What IS this "Classic" and how doe it differ from the .NET?

As for the 'Apps' folder, why should Apps be a User?  Are Apps not programs? What are Apps other than Programs? Some would say that Apps are simply programs for Apple OS X boxes, or are for Android or iOS.  How do Apps relate to the Windows® operating system? Why not put Apps in the Programs folder or in the Programs (x86) folder? 

Ok, OK, I know that these are questions best addrssed to M$, however HP made this an OEM Windows OS with special HP  'stuff.'  so HP has a measure of responsibility for (at least) some of the items in this OS, and I cannot tell from the outside, where it would be, that HP leaves off and Microsoft picks up, unless I can ask you.

Now, what can you tell me about "DefautAppPool.IIS APPPOOL"??  I have been trying to deactivate and avoid any IIS stuff on my Pavilion g7; no server, here. 

And the last one, the monster beginning, "AccountUnknown(..."   If you don't have a complete understanding of these things, I canunderstand that, so, please ask around.  I suspect that was an artifact of some malware. 

You gave me some hope, at least. Please give me the serious answers.

[tryone]

is there a particular software installation, system service or setting that prompted the creation of these NEW USER PROFILES/FOLDERS???

i have the same issue and these folders first occured a few years after initial purchase.

.net has been on my computer a long time and APP POOL apparently has something to do with IIS???

[tryone]

hey man i think i found the culprit..  i believe microsoft's INTERNET INFORMATION SERVICES (IIS) installed these users to facilitate running a server on your computer.

you can turn off the service and disable it and maybe find a way to uninstall IIS altogether.  in any case i think its safe to delete all these users that were probably created on the same date.

to turn off the service i use ctrl-alt-del to get to my TASK MANAGER then i go to the services tab then i click below where it says OPEN SERVICES then i find IIS and i double click it and select the drop down menu to DISABLE it.

i also stop the service.. i'm researching now how to delete this feature all-together.

here's the reference i used to come to this conclusion. https://answers.microsoft.com/en-us/windows/forum/windows_8-files/can-you-delete-defaultapppool/b73d...

and yes that HP lady is right .NET is fundamental software but these random user profiles are not necessary unless you're doing some hedy stuff! and you'd know.

cheers brotherman!

[kvanzuijlen]

Hello,

You can disable IIS alltogether by reversing the second post on the following forum:

https://stackoverflow.com/questions/30901434/iis-manager-in-windows-10

Greetings,

kvanzuijlen