Account Unknown listed in Registry Editor's Permissions.

[Thelps]

I've found a listing under the Right-Click > Permissions list of Security Accounts in the Registry editor.

It says 'Account Unknown' and lists an SID I don't recognise. It has 'Read'

This computer has been behaving very strangely lately and my gut instinct is it's hacked. The mouse cursor skips occasionally as if due to restricted-bandwidth ('lag').

Can anyone assist with resolving this issue and securing this computer?

Constructive answers only please.

Appreciated.

 

[Trouble]

Not sure this qualifies as "Constructive", but.....
I have just checked three physical machines
One running Windows 10 Pro, the current latest fully updated version 1809 and it has

Account Unknown(S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681)

Another running Windows 10 Pro, the latest Insider Build of 19H1 18282.1000. IT also has the identical string in the Registry
The third running Windows 10 Home, again latest Version and Build. Same identical string. All three with "Read" permissions to most if not all root keys, so...

I don't know if this gives you any peace of mind or not but I'm reasonably certain that none of the above machines are hacked or compromised in any way and unless we've all got the same attacker, who is not clever enough to even alter the SID, I'm gonna go out on a limb and suggest that it might be a product of some mysterious Temp account that Microsoft uses to support some aspects of the installation, upgrade or update process.

Personally, I have no immediate concern or worry, but....
I may at some time in the future, see if it might be worth the time and effort to delete it.

 

[Bastet]

I see the same, I usually remove them but on occasion this has caused problems with Windows so now I leave them.

 

[bernhard]

maybe this answers the question: capabilities SIDs were introduced with Windows Server 2012 and Windows 8