Proceso extraño en Windows 10.

%3CLINGO-SUB%20id%3D%22lingo-sub-2922715%22%20slang%3D%22es-ES%22%3EStrange%20process%20in%20Windows%2010.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2922715%22%20slang%3D%22es-ES%22%3E%3CP%3ESorry%20for%20the%20bad%20English.%20It's%20from%20Google%20Traslate.%3C%2FP%3E%3CP%3EStrange%20process%20in%20Windows%2010.%20%3CBR%20%2F%3E%20Hello%2C%20thank%20you%20very%20much%20to%20those%20who%20take%20the%20time%20to%20reply%20to%20me%20in%20advance.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWell%2C%20it%20turns%20out%20that%20a%20little%20while%20ago%20my%20gmail%20email%20was%20hacked%2C%20followed%20by%20my%20Steam%20account.%20Before%2C%20I%20had%20already%20locked%20almost%20all%20the%20files%20on%20my%20PC%20with%20the%20.maql%20extension%20to%20ask%20me%20for%20a%20ransom%20of%20%24%20950%20that%20of%20course%20I%20did%20not%20pay.%20More%20than%20600GB%20of%20files%20I%20had%20to%20restore%20by%20downloading%20everything%20again%2C%20and%20the%20account%20was%20recovered%20in%202%20hours%20to%20the%20Google%20media%20to%20recover%20your%20Google%20account%20when%20it%20was%20stolen.%20The%20fact%20is%20that%20since%20then%2C%20as%20you%20can%20imagine%2C%20I%20have%20not%20stopped%20checking%20my%20computer%20and%20suddenly%20today%20I%20saw%20a%20process%20that%20I%20had%20never%20seen%20in%2012%20years%20using%20Windows%2C%20at%20least%20not%20with%20the%20extension%20at%20the%20end.%20The%20process%20is%3A%20WpnUserService_3b44c.%20If%20I%20have%20seen%20the%20UserService%20very%20often%20but%20this%20one%20in%20particular%20never.%20I%20have%20been%20surprised%20especially%20because%20when%20I%20look%20for%20it%20in%20services%20and%20see%20its%20properties%2C%20it%20appears%20that%20in%20the%20%22start%20session%22%20section%20it%20says%20This%20account%20and%20it%20has%20a%20password!%20%F0%9F%A4%A6%20%3A%20male_sign%3A.%20I%20do%20not%20understand%20why%20a%20Windows%20process%20must%20also%20run%20under%20my%20personal%20account%20with%20password.%20It%20seems%20very%20suspicious%20to%20me.%20And%20in%20Google%20that%20process%20does%20not%20appear%20anywhere%20with%20that%20_3b44c%20at%20the%20end.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPlease%2C%20if%20anyone%20knows%20if%20it%20is%20a%20normal%20process%2C%20please%20tell%20me%20that%20since%20my%20account%20was%20hacked%2C%20I%20see%20that%20my%20monitor%20sometimes%20gets%20darker%20than%20normal.%20As%20if%20something%20was%20superimposing%20my%20desk%2C%20as%20if%20they%20were%20recording%20it%2C%20let's%20go.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHelp%20please%2C%20I%20do%20not%20personally%20know%20technicians%20who%20can%20help%20me%20find%20out%20if%20I%20have%20a%20Ukrainian%20spy%20on%20my%20PC%20now%2C%20but%20I%20did%20see%20that%20the%20one%20who%20hacked%20my%20accounts%20was%20from%20there.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20email%20is%3A%20lucianooriel25%40gmail.com%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20Spanish...%3C%2FP%3E%3CP%3EHello%2C%20thank%20you%20very%20much%20to%20those%20who%20take%20the%20trouble%20to%20answer%20me%20in%20advance.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWell%2C%20it%20turns%20out%20that%20a%20week%20and%20a%20little%20ago%20my%20gmail%20email%20was%20hacked%2C%20followed%20by%20my%20Steam%20account.%20Before%20I%20had%20already%20blocked%20almost%20all%20the%20files%20on%20my%20PC%20with%20the%20extension%20.maql%20to%20ask%20me%20for%20a%20ransom%20of%20%24%20950%20that%20of%20course%20I%20did%20not%20pay.%20More%20than%20600GB%20of%20files%20I%20had%20to%20restore%20by%20downloading%20everything%20again%2C%20and%20the%20account%20was%20recovered%20in%202%20hours%20thanks%20to%20Google%20means%20to%20recover%20your%20Google%20account%20when%20it%20is%20stolen.%20The%20fact%20is%20that%20from%20entonses%20as%20you%20can%20imagine%20I%20do%20not%20stop%20checking%20my%20computer%20and%20suddenly%20today%20I%20saw%20myself%20with%20a%20process%20that%20I%20had%20never%20seen%20in%2012%20years%20using%20Windows%2C%20at%20least%20not%20with%20the%20extension%20of%20the%20end.%20The%20process%20is%3A%20WpnUserService_3b44c.%20If%20I%20have%20seen%20very%20often%20the%20UserService%20but%20this%20one%20in%20particular%20never.%20I%20have%20been%20surprised%20especially%20because%20when%20looking%20for%20it%20in%20services%20and%20seeing%20its%20properties%2C%20it%20appears%20that%20in%20the%20%22log%20in%22%20section%20it%20says%20This%20account%20and%20has%20a%20password!%F0%9F%A4%A6%3Asigno_masculino%3A%20%20.%20I%20don't%20understand%20why%20a%20Windows%20process%20should%20run%20on%20my%20personal%20account%20with%20password%20as%20well.%20I%20find%20it%20very%20suspicious.%20And%20in%20Google%20that%20process%20does%20not%20appear%20anywhere%20with%20that%20_3b44c%20at%20the%20end.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPlease%20if%20anyone%20knows%20if%20it%20is%20a%20normal%20process%20please%20tell%20me%20that%20since%20the%20hacking%20of%20my%20account%20I%20see%20that%20my%20monitor%20sometimes%20gets%20darker%20than%20normal.%20As%20if%20something%20is%20overping%20my%20desk%2C%20as%20if%20they%20are%20recording%20it%20come%20on.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPlease%20help%2C%20I%20don't%20personally%20know%20technicians%20who%20can%20help%20me%20find%20out%20if%20I%20have%20a%20Ukrainian%20spy%20on%20my%20PC%20now%2C%20but%20I%20did%20see%20that%20the%20one%20who%20hacked%20my%20accounts%20was%20from%20there.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20email%20is%3A%20lucianooriel25%40gmail.com%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2922916%22%20slang%3D%22en-US%22%3ERe%3A%20Proceso%20extra%C3%B1o%20en%20Windows%2010.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2922916%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1205831%22%20target%3D%22_blank%22%3E%40Luciano1655%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHello%26nbsp%3B%3C%2FP%3E%3CP%3Escreenshots%20show%20normal%20-%20correct%20process.%3C%2FP%3E%3CP%3EIf%20you%20want%20to%20scan%20your%20computer%20-%20the%20official%20scanner%20that%20will%20check%20the%20security%20of%20Windows%2C%20below%20will%20be%20a%20link%20to%20download.%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fintelligence%2Fsafety-scanner-download%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EMicrosoft%20Safety%20Scanner%20Download%20-%20Windows%20security%20%7C%20Microsoft%20Docs%3C%2FA%3E%3C%2FP%3E%3CP%3EOf%20course%2C%20immediately%20delete%20your%20e-mail%20address%20-%20for%20your%20own%20safety.%3C%2FP%3E%3CP%3Eand%20if%20anyone%20wants%20to%20help%20you%20via%20email%20-%20ignore%20it!%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Sorry for the bad English. It's from Google Traslate.

Strange process in Windows 10.
Hello, thank you very much to those who take the time to reply to me in advance.

 

Well, it turns out that a little while ago my gmail email was hacked, followed by my Steam account. Before, I had already locked almost all the files on my PC with the .maql extension to ask me for a ransom of $ 950 that of course I did not pay. More than 600GB of files I had to restore by downloading everything again, and the account was recovered in 2 hours to the Google media to recover your Google account when it was stolen. The fact is that since then, as you can imagine, I have not stopped checking my computer and suddenly today I saw a process that I had never seen in 12 years using Windows, at least not with the extension at the end. The process is: WpnUserService_3b44c. If I have seen the UserService very often but this one in particular never. I have been surprised especially because when I look for it in services and see its properties, it appears that in the "start session" section it says This account and it has a password! 🤦‍: male_sign:. I do not understand why a Windows process must also run under my personal account with password. It seems very suspicious to me. And in Google that process does not appear anywhere with that _3b44c at the end.

 

Please, if anyone knows if it is a normal process, please tell me that since my account was hacked, I see that my monitor sometimes gets darker than normal. As if something was superimposing my desk, as if they were recording it, let's go.

 

Help please, I do not personally know technicians who can help me find out if I have a Ukrainian spy on my PC now, but I did see that the one who hacked my accounts was from there.

 

  En español...

Hola, muchas gracias a los que se tomen la molestia de responderme de antemano. 

 

  Bien, resulta que hace una semana y poco me hackearon mi correo de gmail, seguido de mi cuenta de Steam. Antes ya me habían bloqueado casi todos los archivos de mi PC con la extensión .maql para pedirme un rescate de 950$ que por supuesto no pagué. Más de 600GB de archivos tuve que restaurar descargándo todo de nuevo, y la cuenta la recuperé en 2 horas gracias a los medios de Google para recuperar tu cuenta de Google cuando te la roban. El caso es que desde entonses como podrán imaginar no paro de revisar mi ordenador y de repente hoy me vi con un proceso que jamás en 12 años usando Windows había visto, al menos no con la extención del final. El proceso es: WpnUserService_3b44c. Si he visto muy seguido el de UserService pero este en particular nunca. Me a extrañado sobre todo porque al buscarlo en servicios y ver sus propiedades, me aparece que en el apartado "iniciar sesión" dice Esta cuenta y tiene contraseña!🤦‍:male_sign:. No entiendo porqué un proceso de Windows se deba ejecutar en mi cuenta personal con contraseña además. Me parece muy sospechoso. Y en Google no aparece en ningún lado ese proceso con ese _3b44c al final. 

 

  Por favor si alguien sabe si es un proceso normal que me lo diga por favor que desde el hackeo de mi cuenta veo que mi monitor en ocasiones se pone más oscuro de lo normal. Como si algo estuviera sobreponiéndose a mi escritorio, como si lo estuvieran grabando vamos. 

 

  Ayuda por favor, no conozco personalmente a técnicos que me puedan ayudar a averiguar si es que tengo un espía Ukraniano en mi PC ahora, pero si vi que el que me hackeo las cuentas era de allá.

3 Replies

@Luciano1655 

Hello 

screenshots show normal - correct process.

If you want to scan your computer - the official scanner that will check the security of Windows, below will be a link to download. 

Microsoft Safety Scanner Download - Windows security | Microsoft Docs

Of course, immediately delete your e-mail address - for your own safety.

and if anyone wants to help you via email - ignore it!

Thank you so much. I already scan the system with this tool to see what results it gives me.

@Luciano1655 

But why didn't you delete your email address?

This is a public forum and not everyone should know your address!