1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Username log in with $ signs

Discussion in 'Windows 10' started by Kferguson319, Jul 11, 2019.

Thread Status:
Not open for further replies.
Advertisement
  1. Kferguson319

    Kferguson319 It's My Birthday! Thread Starter

    Joined:
    Jul 11, 2019
    Messages:
    16
    What does it mean when your seeing a user named after your own computer followed by a dollar sign? My computer is called MYSURFACEPRO_6 But I'm seeing computer log on and privilege changes made by username MYSURFACEPRO_6$ and always seeing notifications about unauthorized changes being blocked from changes being made to "mscorsvw.exe" I've been told dollar signs are not a good sign. Is this true?
     

    Attached Files:

  2. Kferguson319

    Kferguson319 It's My Birthday! Thread Starter

    Joined:
    Jul 11, 2019
    Messages:
    16
  3. lunarlander

    lunarlander

    Joined:
    Sep 21, 2007
    Messages:
    11,575
    In general, accounts with a $ at the end are not displayed normally.

    MSCORSVW is a dot NET compiler.

    You have Controlled Folder Access turned on. And it prohibits applications from modifying your data in the documents folder etc. You must have placed an app somewhere in your data folders and you need to go to Ransomware Protection > Controlled Folder Access > Allow an App ... to allow that application to make changes to your data folders.

    The $ is unusual. But I would not worry about it unless you have signs of being hacked. Then, it might be a hacker setting up a hidden account on your PC.

    If you did not place a program into your data folders then don't blindly allow modifications to them by using the Allow an App ... function above. And you might want to treat this suspicious incident as a potential hacking attack. When viewed in light of also having an $ account. Ask further questions as the case may require.
     
  4. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    113,941
    These are security auditing logon events in the Event Viewer and it's normal for the account to have a $ appended to it.

    I don't know the significance of these particular events but will try to do more digging if I have the time.
     
  5. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    113,941
    What makes you think those events are linked to the alert? That's a Windows Defender alert, right?

    Is this computer a business one with multiple users?
     
  6. Kferguson319

    Kferguson319 It's My Birthday! Thread Starter

    Joined:
    Jul 11, 2019
    Messages:
    16
    Personal computer and I run ecommerce and affiliate marketing websites I'm the only person that uses my surfacepro and as I was taking these pictures the notifications kept popping up in the corner but it wasn't me making those changes the pop up whenever they feel like it and in not even using my computer.
     
  7. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    113,941
    OK so these are two separate issues.

    The logons with the account having a $ appended is not an issue. This is normal.

    The alert from Windows Defender is also normal but this is a Microsoft file that needs to be granted access as Lunarlander mentioned.

    You can verify it's the real Microsoft file by navigating to this location:

    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

    Right-click the mscorsvw.exe file and select Properties and check that it's signed by Microsoft.
     
    Kferguson319 likes this.
  8. lunarlander

    lunarlander

    Joined:
    Sep 21, 2007
    Messages:
    11,575
    Hi Cookiegal,
    Windows Defender Controlled Folder Access (ransomware protection) stops modifications only to data folders like documents, pictures etc. You need to verify that the OP has indeed placed a program into those folders, or else nothing should be modifying those folders, signed executable or not. Do you know what it is compiling in those folders?
     
    Last edited: Jul 14, 2019
  9. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    113,941
    Sorry, I misread your post. I thought it had already been established that it needed access.
     
  10. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    113,941
    According to Microsoft:

    "Controlled folder access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop".

    But most of the known items are already in the default list and shouldn't have to be added. You would think .Net Framework would be one of those IF it were necessary.
     
  11. lunarlander

    lunarlander

    Joined:
    Sep 21, 2007
    Messages:
    11,575
    something fishy is going on, eh ?
     
    Kferguson319 likes this.
  12. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    113,941
    Possibly but unfortunately, I don't know enough about this feature of Windows Defender and Windows 10 in general to know for sure. I'm just going by research into the matter.
     
  13. Kferguson319

    Kferguson319 It's My Birthday! Thread Starter

    Joined:
    Jul 11, 2019
    Messages:
    16
    No how would i look at that? and i do feel like something is going on. when i look into permissions cause half the time it says i dont have permission when im a dang adminsitator. but when i go into lookup users to add my account as the owner or allow myself to see it...it shows me usernames i dont even know & i dont ever see them when i sign in though. I also see the name AERIN sometimes in the logs but thats my sons name and he doesnt play on my computer or use it at all. he just plays xbox one

    Annotation 2019-07-31 151805.png
     

    Attached Files:

  14. lunarlander

    lunarlander

    Joined:
    Sep 21, 2007
    Messages:
    11,575
    "when i look into permission" How were you trying to do that?

    "but when i go into lookup users to add my account as the owner or allow myself to see it...it shows me usernames i dont even know"

    Are you right clicking on an file, then Properties > Security tab? What are the account names listed please? Some are built in system accounts.
     
  15. Kferguson319

    Kferguson319 It's My Birthday! Thread Starter

    Joined:
    Jul 11, 2019
    Messages:
    16
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1229859

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice