Mysterious user account

Hi,

I was updating a Windows XP SP3 box and happened to notice that I had a new user account in documents and settings, called "UpdatusUser".

It had shortcuts to Windows remote assistance and LG updater. The LG item is the DVD drive in this box.

I looked at user accounts in control panel and the account wasn't displayed there.

A bit of investigation revealed that it must have happened when I updated the nVidia management software and drivers for the GeForce 8400GS video card. I allowed the updater utility to be installed, as there was no warning that it would create a system account.

Apparently it will do the same thing in Vista and Windows 7.

I am no expert at malware authorship but it did occur to me that this could be a potential exploit vector?

I uninstalled the nVidia updater utility and noticed that this does not get rid of the phantom account.

I am still trying to figure out the LG DVD drive bit though, as I can't quite see the connection? :confused:

The driver was 270.61

See this link, at the bottom of the page:

http://www-307.ibm.com/pc/support/si...IGR-76476.html

Here is the relevant content:

After the correctly installed Nvidia Optimus video driver, there will be a new account added to the system. The account is a System Service account that is used by the Nvidia Daemon update service to update the optimus profiles. The account will allow for the automatic download and installation of application profiles that the Optimus technology will use.

The account can be removed by changing it to use Local System, Set to Manual and then delete the UpdatusUser user account and folder.

It's a part of the Optimus video technology from NVidia....the article happens to be a reference from a Lenovo Page but the information applies to all installs of the Optimus Package.

Thanks Wazz!, that's a great find, and all is becoming clear to me now (doh!) :)

My wife bought the machine from her workplace. It has an Intel motherboard with integrated graphics. I added a 512MB nVidia GeForce 8400GS discrete card.

It would seem that the nVidia upgrade spotted the integrated chipset and applied this new application, so that the system can now use both the integrated and the discrete graphics. I think that this is similar to the Ati "Hybrid Crossfire" system?

It also appears that this nVidia application was developed with gaming and entertainment in mind. That would explain the apparently strange inclusion of the LG DVD drive update, as it also checks that the hardware drivers are up to date?

As I suspected, it should be run as Local System rather than World + dog :D

Thanks again, I believe that the mystery is now solved. :)

Excellent!!! Glad I could help you out nihil! Nice of them to let us know they're creating accounts for us eh? Perhaps an Installwatch or Windows System State Analyzer is called for here to see what else is going on....Hmmmm. Cheers...

This is interesting...developers are now forced to open new accounts on a machine to make their product run?

Laziness, or not wanting the user to have to clicky click the buttons?

@ bludgeon,

Indeed! that's what made me suspicious at first. Now, thanks to Wazz and a bit of investigation I find that it doesn't even work on the machine in question.

It seems to have seen the nVidia card and the onboard Intel video chipset and assumed that it was a laptop? as this is an old machine (mid-2006) I have to turn off the onboard video to run the discrete card.

From what I can see this is aimed at laptops or portable desktops and will act as a power (battery) saving mechanism, reverting to the onboard chipset for low intensity graphics requirements. At the same time it seems to be aimed at gamers; as these "profiles" look like tweaks for specific games.

I would have thought it should be something deliberately initiated by the user, rather than globally applied?

:)

Low level hardware control, more interesting...don't tell the Belgians.

Can't find much on your topic that's useful, this tho...

http://forums.nvidia.com/index.php?showtopic=178965

This is interesting...developers are now forced to open new accounts on a machine to make their product run?
What'd u mean? PR?

These accounts are created when your normal user profile is damaged. Windows creates a new user profile for you then. Although I would not re-profile referenced in the article linked below (it is for Windows 2000 and not XP), MVP Ramesh has a good explanation of the situation and how to find what you are really profile with here:

Copy the profile folders under "Documents and Settings"

^^ Seems our pet is starting to loose it's touch. ;)

forgot to inlude the url to the referenced article.

Props to Donald on this one, I was not aware that Windows did such a thing?

Unfortunately he has left out the link to the MVP's article :(

@ joem11

This looks like nVidia making things convenient for themselves, but potentially compromising your security in the process.........please see the interesting link posted by bludgeon.

I am about to build a machine with onboard and independent nVidia graphics so I will be able to see if this account and SLI work together, or if it is just a gaming and/or laptop utility.

The reason I posted in the first place was that it created a potential security hazard on a machine where it had no functionality whatsoever. It should at least have been local rather than global?


//off topic:

I think that I am beginning to see how Donald works..........at first I thought his stuff was way off target, but now that just seems to be my narrow minded approach at the time.

He appears to provide additional information, not specific to the post in question...........a bit like the "obiter dicta" of high (supreme) court judges? //

:D

EDIT:

@ HYBR|D

You beat me to it! .........breakfast interrupted my post :drink:. I have edited Donald's contribution slightly to make more sense, and put it in context.

Quote:

---

Originally Posted by nihil

This looks like nVidia making things convenient for themselves, but potentially compromising your security in the process.........please see the interesting link posted by bludgeon.

---

This may be a blessing in disguise for security. If you were to have (on a business/pro Windows) multiple "admin" level accounts for specific applications such as GFI LANGuard, application updaters, etc... you can add them all into specific security groups to facilitate locking down the machine.

This will allow you to grant them the needed admin rights, while subjecting them to GPO and file/registry permissions that you would not be able to reasonably apply to Local System, Local Service, or Network Service. If one of them is compromised for any reason, they would not have that critical access that the compromise would need to take over the system. It will never be perfect, but it will allow that extra mitigation capability.

The way I see it, limiting possible compromise scope is just as important as limiting attack surface and direct compromise. Proper file permissions on temporary folders is the best defense against browser 0days, and the same can be said for any high risk application.