Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Comodo Firewall Help


  • Please log in to reply
11 replies to this topic

#1 nihil66861986

nihil66861986

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:52 PM

Posted 16 October 2018 - 10:47 AM

I am currently behind Comodo Firewall and I'm looking at the logs and I noticed that there was a blocked connection between Windows Operating System and this IP Address: 181.191.236.113 Is someone trying to hack me? The destination was the foreign address and the request was sent from my PC. Is there anyone here that's proficient when it comes to Comodo Firewall? Note: Comodo Firewall has been blocking Windows Operating System since I installed it.



BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,414 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:05:52 AM

Posted 16 October 2018 - 12:56 PM

Possibly a cookie or some adware attempting to call home.

 

The IP address belongs to NewerTech

QUOTE:NewerTech is the forefront of serving the Apple community with accessories, upgrades, and enhancements for Macs, iPods, iPhones, and iPads.

 

If you haven't run one or both of the programs below recently I suugest you do that and allow them to Quarantine/ Remove what they find.

Download and install the free version of Malwarebytes
Note: If you have Malwarebytes already installed, you don't need to install it again.

 

Download AdwCleaner by Xplode onto your desktop. (compatible with Windows 7, 8 and 10)

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.

Another program you can use to clean up the temp files and cookies is CCleaner.

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of Google Chrome and Avast.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 nihil66861986

nihil66861986
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:52 PM

Posted 16 October 2018 - 03:25 PM

Thank you for your response. The Adware cleaner showed two entries, which were Chrome search providers: Ask and AOL. I removed them and restarted my computer. Malwarebytes detected 3 entries:  steam_api.dll which I'm fairly certain are false positives. 



#4 buddy215

buddy215

  • Moderator
  • 13,414 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:05:52 AM

Posted 16 October 2018 - 03:33 PM

Do you own any Apple products that you might of linked to your computer? If so, that could be a source.

 

You can ask about those 3 items in the Malwarebytes forum before deleting them.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#5 nihil66861986

nihil66861986
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:52 PM

Posted 16 October 2018 - 03:48 PM

I own no Apple products whatsoever. This is a new laptop. It's an MSI GT75VR 7RE TITAN and my phone is a Samsung Galaxy S7 Edge. I'll check out the Malwarebytes Forum. Thank you. I'll let you know what they say. 



#6 buddy215

buddy215

  • Moderator
  • 13,414 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:05:52 AM

Posted 16 October 2018 - 04:22 PM

After checking with Malwarebytes...and confirming one way or the other as to whether those false positives or not

and the firewall is still blocking that IP do this:

 

Post the three lists mentioned below using CCleaner.

Open CCleaner and click on Tools. Choose Startups. On that page you will see a list of Windows Startups and at the top tabs for each browser and Scheduled Tasks.

At the bottom right of that page you will see a button when clicked will allow you to Copy and Paste the list of Windows Startups and Scheduled Tasks into your next

post. Please do that.

 

Open CCleaner and click on Tools. Choose Uninstall. On that page you will see a list of programs installed on your computer and at the bottom right of that page you

will see a button when clicked will allow you to Copy and Paste that list in your next post. Please do that.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#7 nihil66861986

nihil66861986
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:52 PM

Posted 16 October 2018 - 08:37 PM

Here's what you asked for. However, I had trouble in the MBAM forum because my post kept being flagged as spam for some reason.
 
Yes HKCU:Run CCleaner Smart Cleaning Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
No HKCU:Run OneDriveSetup Microsoft Corporation C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup
No HKCU:Run Steam Valve Corporation "D:\Program Files (x86)\Steam\steam.exe" -silent
No HKCU:Run utweb "C:\Users\Michael King\AppData\Roaming\uTorrent Web\utweb.exe" /MINIMIZED
Yes HKLM:Run AvastUI.exe AVAST Software "C:\Program Files\AVAST Software\Avast\AvLaunch.exe" /gui
Yes HKLM:Run COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} COMODO C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
Yes HKLM:Run IAStorIcon Intel Corporation "C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" 60
Yes HKLM:Run MsiTrueColor Portrait Displays, Inc. "C:\Program Files\Portrait Displays\MSI True Color\MsiTrueColor.exe" startup_folder
Yes HKLM:Run Nahimic2UILauncher Nahimic C:\Program Files\Nahimic\Nahimic2\UserInterface\Nahimic2UILauncher.exe /noUI
Yes HKLM:Run RTHDVCPL Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
Yes HKLM:Run SCM Micro-Star International CO., LTD. C:\Program Files (x86)\SCM\SCM.exe
Yes HKLM:Run SecurityHealth Microsoft Corporation %ProgramFiles%\Windows Defender\MSASCuiL.exe
No HKLM:Run SunJavaUpdateSched Oracle Corporation "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
Yes HKLM:Run WinZip FAH WinZip Computing, S.L. C:\Program Files\WinZip\FAHConsole.exe
Yes HKLM:Run WinZip PreLoader WinZip Computing C:\Program Files\WinZip\WzPreloader.exe
Yes HKLM:Run WinZip UN Corel Corporation C:\Program Files\WinZip\WZUpdateNotifier.exe -show
Yes Startup Common SteelSeries Engine 3.lnk SteelSeries ApS C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
 
Yes Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
Yes Task Dragon_Center_updater Micro-Star International CO., LTD. C:\ProgramData\MSI\Dragon Center\DragonCenter_Updater.exe DragonCenter
Yes Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
Yes Task MSI_Dragon Center Micro-Star International Co., Ltd. C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe
Yes Task MSI_Help_Desk_Agent Micro-Star International Co., Ltd. C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe
Yes Task MSISCMTsk Application C:\Program Files (x86)\MSI\MSI Remind Manager\MSISCMTsk.exe
Yes Task OneDrive Standalone Update Task v2 %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Yes Task WinZip Update Notifier 1 Corel Corporation "C:\Program Files\WinZip\WZUpdateNotifier.exe" -checkType="scheduled_9AM" -show
Yes Task WinZip Update Notifier 2 Corel Corporation "C:\Program Files\WinZip\WZUpdateNotifier.exe" -checkType="scheduled_12PM" -show
Yes Task WinZip Update Notifier 3 Corel Corporation "C:\Program Files\WinZip\WZUpdateNotifier.exe" -checkType="scheduled_3PM" -show
 
Yes Directory File ownership
Yes Directory Open PowerShell window here powershell.exe -noexit -command Set-Location -literalPath '%V'
Yes Directory WinZip WinZip Computing C:\Program Files\WinZip\wzshls64.dll
Yes Drive Comodo Antivirus COMODO C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll
Yes Drive Open PowerShell window here powershell.exe -noexit -command Set-Location -literalPath '%V'
Yes File 00asw AVAST Software C:\Program Files\AVAST Software\Avast\ashShA64.dll
Yes File avast AVAST Software C:\Program Files\AVAST Software\Avast\ashShA64.dll
Yes File Comodo Antivirus COMODO C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll
Yes File MBAMShlExt Malwarebytes C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
Yes File WinZip WinZip Computing C:\Program Files\WinZip\wzshls64.dll
Yes Folder avast AVAST Software C:\Program Files\AVAST Software\Avast\ashShA64.dll
Yes Folder Comodo Antivirus COMODO C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll
Yes Folder MBAMShlExt Malwarebytes C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
Yes Folder WinZip WinZip Computing C:\Program Files\WinZip\wzshls64.dll
 
Alarms & Clock Microsoft Corporation 10/12/2018 10.1808.2461.0
App Installer Microsoft Corporation 10/12/2018 1.0.20921.0
Atlantic driver (64 bit) Aquantia 7/22/2017 268 KB 1.40.042.0
Avast Free Antivirus AVAST Software 10/12/2018 18.7.2354
Battery Calibration Micro-Star International Co., Ltd. 7/22/2017 2.53 MB 1.0.1609.1901
Borderlands 10/15/2018 11.2 GB
Borderlands 2 10/15/2018 11.4 GB
Borderlands: The Pre-Sequel 10/15/2018 8.31 GB
BurnRecovery Application 7/22/2017 58.6 MB 5.0.1704.1801
Calculator Microsoft Corporation 10/12/2018 10.1808.2461.0
Call of Duty: Modern Warfare 2 10/14/2018 21.4 GB
Call of Duty: Modern Warfare 3 Infinity Ward 10/12/2018
Call of Duty: Modern Warfare 3 - Multiplayer Infinity Ward 10/12/2018
Camera Microsoft Corporation 10/12/2018 2018.426.90.1000
CCleaner Piriform 10/17/2018 5.47
COMODO Firewall COMODO Security Solutions Inc. 10/12/2018 11.0.0.6710
Dragon Center Micro-Star International Co., Ltd. 10/14/2018 52.9 MB 1.2.1804.1201
Fallout 4 Bethesda Game Studios 10/13/2018
Feedback Hub Microsoft Corporation 10/12/2018 1.1805.2331.0
Fraps 10/16/2018
Get Help Microsoft Corporation 10/12/2018 10.1706.12332.0
Google Chrome Google Inc. 10/12/2018 69.0.3497.100
Grand Theft Auto V 10/13/2018 68.9 GB
Groove Music Microsoft Corporation 10/12/2018 10.18091.10321.0
Help Desk Micro-Star International Co., Ltd. 10/14/2018 7.33 MB 1.0.1802.0501
HitmanPro 3.8 SurfRight B.V. 10/14/2018 3.8.0.295
Intel Extreme Tuning Utility Intel Corporation 10/12/2018 138 MB 6.2.0.14
Intel® Management Engine Components Intel Corporation 7/22/2017 11.7.0.1013
Intel® Rapid Storage Technology Intel Corporation 10/12/2018 15.5.0.1051
Java 8 Update 181 Oracle Corporation 10/12/2018 100 MB 8.0.1810.13
KB9X Radio Switch Driver ENE TECHNOLOGY INC. 10/12/2018 1.1.4.0
Mail and Calendar Microsoft Corporation 10/12/2018 16005.10827.20137.0
Malwarebytes version 3.6.1.2711 Malwarebytes 10/13/2018 193 MB 3.6.1.2711
Maps Microsoft Corporation 10/12/2018 5.1807.2291.0
Messaging Microsoft Corporation 10/12/2018 3.38.22001.0
Microsoft Pay Microsoft Corporation 10/12/2018 2.1.18009.0
Microsoft Solitaire Collection Microsoft Studios 10/12/2018 4.2.8172.0
Microsoft Sticky Notes Microsoft Corporation 10/12/2018 3.0.118.0
Microsoft Store Microsoft Corporation 10/12/2018 11809.1001.8.0
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 10/14/2018 3.38 MB 8.0.56336
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 10/15/2018 13.1 MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 10/12/2018 676 KB 9.0.30729
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 Microsoft Corporation 10/15/2018 13.8 MB 10.0.40219
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 Microsoft Corporation 10/15/2018 26.1 MB 10.0.40219
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 Microsoft Corporation 10/13/2018 20.5 MB 11.0.61030.0
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 Microsoft Corporation 10/13/2018 17.3 MB 11.0.61030.0
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 Microsoft Corporation 10/12/2018 20.5 MB 12.0.21005.1
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 Microsoft Corporation 10/12/2018 17.1 MB 12.0.21005.1
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24212 Microsoft Corporation 10/12/2018 23.5 MB 14.0.24212.0
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 Microsoft Corporation 10/12/2018 19.5 MB 14.0.24212.0
Mixed Reality Viewer Microsoft Corporation 10/12/2018 5.1807.6012.1000
Movies & TV Microsoft Corporation 10/12/2018 10.18082.10311.0
MSI Feature Navigator Micro-Star International Co., Ltd. 7/22/2017 314 MB 1.0.1703.1601
MSI Remind Manager Service Micro-Star International Co., Ltd. 7/22/2017 8.57 MB 1.0.1705.3101
MSI True Color Portrait Displays, Inc. 10/12/2018 2.0.0.034
Nahimic 2+ Audio Driver Nahimic 10/14/2018 106 MB 2.5.31
NVIDIA Graphics Driver 416.34 NVIDIA Corporation 10/12/2018 416.34
NVIDIA HD Audio Driver 1.3.37.5 NVIDIA Corporation 10/12/2018 1.3.37.5
NVIDIA PhysX System Software 9.18.0907 NVIDIA Corporation 10/12/2018 9.18.0907
Origin Electronic Arts, Inc. 10/12/2018 334 MB 10.5.28.13288
Paint 3D Microsoft Corporation 10/12/2018 5.1809.1017.0
People Microsoft Corporation 10/12/2018 10.1808.2473.0
PhotoDirector8 for MSI CyberLink 10/12/2018 8.0.4020.0
Photos Microsoft Corporation 10/12/2018 2018.18081.14710.0
PowerDirector14 for MSI CyberLink 10/12/2018 14.0.5226.0
Qualcomm Atheros Bluetooth Installer (64) Qualcomm Atheros 7/22/2017 40.3 MB 10.0.0.309
Realtek Card Reader Realtek Semiconductor Corp. 7/22/2017 14.6 MB 10.0.15063.21299
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 10/12/2018 6.0.1.8199
Remote Desktop Microsoft Corporation 10/12/2018 10.1.1060.0
resident evil 4 / biohazard 4 Capcom 10/13/2018
SCM Application 10/14/2018 6.17 MB 13.018.06221
Steam Valve Corporation 10/12/2018 2.10.91.91
SteelSeries Engine 3.12.13 SteelSeries ApS 10/12/2018 3.12.13
Store Experience Host Microsoft Corporation 10/12/2018 11809.1001.1.0
Synaptics Pointing Device Driver Synaptics Incorporated 10/12/2018 46.4 MB 19.3.4.184
Tales from the Borderlands 10/16/2018 8.57 GB
Thunderbolt™ Software Intel Corporation 7/22/2017 3.17 MB 16.3.61.275
Translator Microsoft Corporation 10/12/2018 5.2.4.0
TriDef VR Games (MSI) 1.3.4 Dynamic Digital Depth Australia Pty Ltd 10/12/2018 1.3.4
Update for Windows 10 for x64-based Systems (KB4023057) Microsoft Corporation 10/12/2018 874 KB 2.50.0.0
Voice Recorder Microsoft Corporation 10/12/2018 10.1808.2461.0
Web Media Extensions Microsoft Corporation 10/12/2018 1.0.12341.0
Windows Setup Remediations (x64) (KB4023057) 10/12/2018
WinZip 22.5 Corel Corporation 10/14/2018 227 MB 22.5.13114
Xbox Microsoft Corporation 10/12/2018 44.44.7002.0
Xbox Game bar Microsoft Corporation 10/12/2018 1.34.5003.0
Xbox Game Speech Window Microsoft Corporation 10/12/2018 1.21.13002.0
Xbox gaming overlay Microsoft Corporation 10/12/2018 1.16.1007.1000
Xbox Identity Provider Microsoft Corporation 10/12/2018 12.45.6001.0
XSplit Gamecaster SplitmediaLabs 7/22/2017 216 MB 3.0.1705.3130
µTorrent BitTorrent Inc. 10/13/2018 3.5.4.44632
 
 


#8 buddy215

buddy215

  • Moderator
  • 13,414 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:05:52 AM

Posted 17 October 2018 - 04:35 AM

Suggest you uninstall uTorrent. Using it to download free stuff is very risky.

 

Look in your Chrome browser for Avast extensions. If there, disable or delete.

I suggest you consider uninstalling Avast and use Windows Defender which has much improved and is competitive with 3rd party anti-virus programs.

See why Avast is no longer recommended at #2

If you decide to uninstall Avast use their uninstaller per instructions below.

  1. Download avastclear.exe on your desktop
  2. Start Windows in Safe Mode
  3. Open (execute) the uninstall utility
  4. If you installed Avast in a different folder than the default, browse for it. (Note: Be careful! The content of any folder you choose will be deleted!)
  5. Click REMOVE
  6. Restart your computer

 

If you are not a frequent user of WinZip I suggest you disable it in Startups and Tasks.

Click on each WinZip item and then choose Disable on the right.

 

Disable CCleaner in Startups and Tasks


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#9 nihil66861986

nihil66861986
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:52 PM

Posted 17 October 2018 - 01:04 PM

I have done everything that you've told me to do, but I still have questions about whether or not I'm being hacked. I've performed scans with multiple AV's, checked those steam files online through websites like virustotal and a few others and they really aren't coming back with anything significant, I've checked and there are no inbound connections to my PC and the only outgoing connections are Chrome, Svchost, MSI Steelseries, Origin, and Steam. However, there's one program that is listed as listening when I check TCP View and that is a file called \jhi_service.exe. Is there anything that I should be concerned about? I'm really contemplating on doing an MSI System Restore and starting over without downloading any free games to my PC and only sticking with the ones that I have on Steam. What do you think? Thanks for you help, I really do appreciate it. 



#10 buddy215

buddy215

  • Moderator
  • 13,414 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:05:52 AM

Posted 17 October 2018 - 02:31 PM

That appears to be a legit .exe. See info at jhi_service.exe - Should I Block It? (Intel Dynamic Application Loader Host Interface)

 

If you are not noticing any obvious malware actions on your comp such as excessive processor use, popup ads, search misdirects, etc.

then you most likely have no malware infection.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#11 nihil66861986

nihil66861986
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:52 PM

Posted 20 October 2018 - 01:08 PM

Not sure if it's okay to continue commenting on this, but I'm having another issue with my firewall. Today I came home and noticed this listed under network intrusions. Could you explain to me what this means? I have IPV6 disabled via my networking adapter and also I blocked iw4sp.exe from connecting to the internet via Comodo Firewall last week. Also, the Router/Modem we have has IPV6 disabled because my gf needs it disabled in order to work at home remotely from her office.

 

https://ibb.co/dJHt6L (Comodo Firewall Log Showing Network Intrusion)


Edited by nihil66861986, 20 October 2018 - 01:13 PM.


#12 buddy215

buddy215

  • Moderator
  • 13,414 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:05:52 AM

Posted 20 October 2018 - 03:18 PM

Someone else may help you interpret Comodo log info. Comodo has an active forum that would be much more

helpful than me. Comodo Discussion Board and Support Forums | Comodo Community


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users