0

I have following users in my registry.

s-1-5-18
s-1-5-19
s-1-5-20
S-1-5-21-3580036505-2828148361-1391708163-1001
S-1-5-21-3580036505-2828148361-1391708163-1001_Classes

Is it a virus or system users?

There is also a folder which contains folders of the above names and there are data files.

This folder can be deleted by shift + delete (Not only delete). Created again when something is copied / moved or deleted.

Improve this question

1 Answer 1

Reset to default
2

Microsoft KB: https://support.microsoft.com/en-gb/kb/243330

SID: S-1-5-18
Name: Local System Description: A service account that
is used by the operating system.

SID: S-1-5-19
Name: NT Authority
Description: Local Service

SID: S-1-5-20
Name: NT Authority
Description: Network Service

http://www.pcreview.co.uk/threads/what-relative-identifier-ends-with-1003-1003_classes.3084445/

SID: S-1-5-21-3580036505-2828148361-1391708163-1001
* A subkey named for the Security Identifier (SID) of the current local user. This subkey contains the current user's profile. The data in HKEY_USERS\SID also appears in HKEY_CURRENT_USER.

SID: S-1-5-21-3580036505-2828148361-1391708163-1001_Classes
* A subkey named for the Security Identifier (SID) of the current local user with the _Classes suffix. This subkey contains the current user's Classes. The data in HKEY_USERS\SID_Classes is also contained in HKEY_CLASSES_ROOT.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .