How to check if someone has logged to my computer

Discussion in 'Computer Security' started by jeff_zhang446@yahoo.com, May 16, 2005.

  1. Guest

    Hi,
    I found something strange this morning.

    I am using windows XP professional edition.

    I was away from my desk a while. The screen saver display on my PC was
    ON. Then when I tried to click on the "turn off the computer" on the
    bottom left of my screen, there is a warning prompting on the screen:

    "Other people has logged on to this computer. Shutting down the
    computer will cause them losing the data. Do you want to continue?".

    I do not have my pc connected to internet(disconnected from the modem)
    this morning.

    If I go to start->shut down->turn off, the pc just shut down
    automatically without any such warning.

    I wonder how can I check if someone really hacked my pc?

    Or is there anything to do with the wuauclt.exe (automatic update from
    windows??)

    I would appreciate if someone can give me some advice. Thanks.

    jeff
     
    , May 16, 2005
    #1
    1. Advertising

  2. andy smart Guest

    wrote:
    > Hi,
    > I found something strange this morning.
    >
    > I am using windows XP professional edition.
    >
    > I was away from my desk a while. The screen saver display on my PC was
    > ON. Then when I tried to click on the "turn off the computer" on the
    > bottom left of my screen, there is a warning prompting on the screen:
    >
    > "Other people has logged on to this computer. Shutting down the
    > computer will cause them losing the data. Do you want to continue?".
    >
    > I do not have my pc connected to internet(disconnected from the modem)
    > this morning.
    >
    > If I go to start->shut down->turn off, the pc just shut down
    > automatically without any such warning.
    >
    > I wonder how can I check if someone really hacked my pc?
    >
    > Or is there anything to do with the wuauclt.exe (automatic update from
    > windows??)
    >
    > I would appreciate if someone can give me some advice. Thanks.
    >
    > jeff
    >

    Does your screen saver lock with a password?
    Do you have any other user accounts on your computer that somebody could
    use legitimately?
     
    andy smart, May 16, 2005
    #2
    1. Advertising

  3. Guest

    dear sir,

    Thanks for your reply.

    Yes,my screen saver do lock with password.

    I have disable the guest account. The other account is aspnet which is
    used only in visual studio .net.

    thank you.

    jeff
    andy smart wrote:
    > wrote:
    > > Hi,
    > > I found something strange this morning.
    > >
    > > I am using windows XP professional edition.
    > >
    > > I was away from my desk a while. The screen saver display on my PC

    was
    > > ON. Then when I tried to click on the "turn off the computer" on

    the
    > > bottom left of my screen, there is a warning prompting on the

    screen:
    > >
    > > "Other people has logged on to this computer. Shutting down the
    > > computer will cause them losing the data. Do you want to

    continue?".
    > >
    > > I do not have my pc connected to internet(disconnected from the

    modem)
    > > this morning.
    > >
    > > If I go to start->shut down->turn off, the pc just shut down
    > > automatically without any such warning.
    > >
    > > I wonder how can I check if someone really hacked my pc?
    > >
    > > Or is there anything to do with the wuauclt.exe (automatic update

    from
    > > windows??)
    > >
    > > I would appreciate if someone can give me some advice. Thanks.
    > >
    > > jeff
    > >

    > Does your screen saver lock with a password?
    > Do you have any other user accounts on your computer that somebody

    could
    > use legitimately?
     
    , May 16, 2005
    #3
  4. andy smart Guest

    wrote:
    > dear sir,
    >
    > Thanks for your reply.
    >
    > Yes,my screen saver do lock with password.
    >
    > I have disable the guest account. The other account is aspnet which is
    > used only in visual studio .net.
    >
    > thank you.
    >
    > jeff
    > andy smart wrote:
    >
    >> wrote:
    >>
    >>>Hi,
    >>>I found something strange this morning.
    >>>
    >>>I am using windows XP professional edition.
    >>>
    >>>I was away from my desk a while. The screen saver display on my PC

    >
    > was
    >
    >>>ON. Then when I tried to click on the "turn off the computer" on

    >
    > the
    >
    >>>bottom left of my screen, there is a warning prompting on the

    >
    > screen:
    >
    >>>"Other people has logged on to this computer. Shutting down the
    >>>computer will cause them losing the data. Do you want to

    >
    > continue?".
    >
    >>>I do not have my pc connected to internet(disconnected from the

    >
    > modem)
    >
    >>>this morning.
    >>>
    >>>If I go to start->shut down->turn off, the pc just shut down
    >>>automatically without any such warning.
    >>>
    >>>I wonder how can I check if someone really hacked my pc?
    >>>
    >>>Or is there anything to do with the wuauclt.exe (automatic update

    >
    > from
    >
    >>>windows??)
    >>>
    >>>I would appreciate if someone can give me some advice. Thanks.
    >>>
    >>>jeff
    >>>

    >>
    >>Does your screen saver lock with a password?
    >>Do you have any other user accounts on your computer that somebody

    >
    > could
    >
    >>use legitimately?

    >
    >


    OK, so if there are no other user accounts it's hard to see how anybody
    else could have been logged in locally; I know you said it wasn't
    connected to a modem, do you have a network connection (either cabled or
    wireless) which could have been used to access it remotely?
     
    andy smart, May 16, 2005
    #4
  5. From: <>

    | Hi,
    | I found something strange this morning.
    |
    | I am using windows XP professional edition.
    |
    | I was away from my desk a while. The screen saver display on my PC was
    | ON. Then when I tried to click on the "turn off the computer" on the
    | bottom left of my screen, there is a warning prompting on the screen:
    |
    | "Other people has logged on to this computer. Shutting down the
    | computer will cause them losing the data. Do you want to continue?".
    |
    | I do not have my pc connected to internet(disconnected from the modem)
    | this morning.
    |
    | If I go to start->shut down->turn off, the pc just shut down
    | automatically without any such warning.
    |
    | I wonder how can I check if someone really hacked my pc?
    |
    | Or is there anything to do with the wuauclt.exe (automatic update from
    | windows??)
    |
    | I would appreciate if someone can give me some advice. Thanks.
    |
    | jeff

    1. Disable File and Print shares

    2. Get a Cable/DSL Router such as the Linksys BEFSR41 and specifically block both TCP and
    UDP ports 135 ~ 139 and 445 if you need File and Print Shares on your home computer.

    3. Tighten your security such as
    a. 10 digit alphanumeric passwords using the following...
    2 Uppercase
    2 Lowecase
    2 number
    2 special chars.
    b Rename the administrator account from 'administrator' to something other like
    'localadmin'

    4. Please perform the following....

    ump the contents of the IE Temporary Internet Folder cache (TIF)
    Start --> Settings --> Control Panel --> Internet Options --> Delete Files

    Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
    Tools --> Options --> Privacy --> Cache --> Clear


    Download CLEAN.EXE from the URL --
    http://www.ik-cs.com/programs/virtools/clean.exe

    It is a self-extracting ZIP file that contains the Kixtart Script Interpreter
    { http://kixtart.org Kixtart is CareWare } three batch files, two Kixtart scripts, two Link

    (.lnk) files and a PDF instruction file.

    GETFILES.BAT -- For downloading (FTP) the files needed to run the McAfee Command Line
    Scanner. If you are using Windows XP, you may have to disable the Windows XP FireWall to
    allow the FTP utility to download the needed files

    CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. If you choose
    to scan again at a future date, run this batch file. It will automatically check the date
    of the McAfee DAT files and if it is a couple of days old, it will download (FTP) the latest
    signature files and install them before performing the scan.

    DOSCLEAN.BAT -- For use on a Win9x/ME PC or on a Win2K/WinXP PC that is using FAT32 after
    you have booted from an Emergency Boot Disk or DOS disk and have already executed;
    c:\mcafee\GetFiles.BAT from within Windows. DOS disk boot images can be obtained from;
    http://www.bootdisk.com/bootdisk.htm

    I need you to perform the following...

    Execute; CLEAN.EXE
    Choose; Unzip
    Choose; Close

    Execute; c:\mcafee\GetFiles.BAT
    { or Double-click on 'GetFiles Link' in c:\mcafee }

    Reboot the PC into Safe Mode [F8 key during boot]

    Shutdown as many applications as possible !
    It would also help for you to read - "How to perform a clean boot in Windows XP"
    http://support.microsoft.com/kb/310353

    Execute; c:\mcafee\CLEAN.BAT
    { or Double-click on 'Clean Link' in c:\mcafee }

    A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
    end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
    It is suggested that you move the report out of c:\mcafee before performing another scan.
    It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
    report for each session.


    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html
    http://www.ik-cs.com/got-a-virus.htm
     
    David H. Lipman, May 16, 2005
    #5
  6. Guest

    Dear Sir,
    The pc setting do allow remote access since I need to use messanger
    occasionally.

    However I have unplugged the network connection to the cable modem
    before I start the machine.

    Thank you.

    jeff

    > OK, so if there are no other user accounts it's hard to see how

    anybody
    > else could have been logged in locally; I know you said it wasn't
    > connected to a modem, do you have a network connection (either cabled

    or
    > wireless) which could have been used to access it remotely?
     
    , May 16, 2005
    #6
  7. wrote:
    > Hi,
    > I found something strange this morning.
    >
    > I am using windows XP professional edition.
    >
    > I was away from my desk a while. The screen saver display on my PC was
    > ON. Then when I tried to click on the "turn off the computer" on the
    > bottom left of my screen, there is a warning prompting on the screen:
    >
    > "Other people has logged on to this computer. Shutting down the
    > computer will cause them losing the data. Do you want to continue?".
    >
    > I do not have my pc connected to internet(disconnected from the modem)
    > this morning.
    >
    > If I go to start->shut down->turn off, the pc just shut down
    > automatically without any such warning.
    >
    > I wonder how can I check if someone really hacked my pc?
    >
    > Or is there anything to do with the wuauclt.exe (automatic update from
    > windows??)
    >
    > I would appreciate if someone can give me some advice. Thanks.
    >
    > jeff


    That user was you!

    When it is set to use password upon return from screen saver XP goes to the
    log in screen as if you had hit Log Off> Switch User. All you programs are
    left running. So when you tried to turn off the PC from the log-on screen
    Windows tried to warn you that "someone" (you) stall have an active session
    logged on and possibly have programs running.
     
    Slightly Graying Wolf, May 16, 2005
    #7
  8. Guest

    thanks for all the help and advice.

    jeff
     
    , May 16, 2005
    #8
  9. Solbu Guest

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    tried to express an opinion:

    > The pc setting do allow remote access since I need to use messanger
    > occasionally.


    What does "remote access" have to do with using the messenger?
    And what kind of remote access did you mean?


    You _DO NOT_ need to enable remote access to your computer
    in order to use any service on the internett!
    Who ever told you that is lying!

    People DO NOT need to connect remotely to YOU
    in order for you to use Messenger.
    I presume you mean MSN messenger, yes?

    - --
    Solbu - http://www.solbu.net
    Remove 'ugyldig' for email
    PGP key ID: 0xFA687324
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQFCiUvnT1rWTfpocyQRAlrhAJ90LYDALqHs+o7Oc+SSDyn/sNwxUQCeLbzy
    fNxZP6dQYfl9YsG2wesZ1FE=
    =50iu
    -----END PGP SIGNATURE-----
     
    Solbu, May 17, 2005
    #9
  10. Nog Guest

    <> wrote in message
    news:...
    > Hi,
    > I found something strange this morning.
    >
    > I am using windows XP professional edition.
    >
    > I was away from my desk a while. The screen saver display on my PC was
    > ON. Then when I tried to click on the "turn off the computer" on the
    > bottom left of my screen, there is a warning prompting on the screen:
    >
    > "Other people has logged on to this computer. Shutting down the
    > computer will cause them losing the data. Do you want to continue?".
    >
    > I do not have my pc connected to internet(disconnected from the modem)
    > this morning.
    >
    > If I go to start->shut down->turn off, the pc just shut down
    > automatically without any such warning.
    >
    > I wonder how can I check if someone really hacked my pc?
    >
    > Or is there anything to do with the wuauclt.exe (automatic update from
    > windows??)
    >
    > I would appreciate if someone can give me some advice. Thanks.
    >
    > jeff



    That usually just means that another computer on your network is connected.
    You have a home network?
     
    Nog, May 17, 2005
    #10
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Peter H

    Someone logged onto friends comp !!

    Peter H, Aug 6, 2003, in forum: Computer Support
    Replies:
    4
    Views:
    486
    Paul McCredie
    Aug 6, 2003
  2. A. J. Moss
    Replies:
    3
    Views:
    2,280
    Another Airnet User
    Sep 19, 2003
  3. Chuck S
    Replies:
    2
    Views:
    1,822
    Christopher M. Hobbs
    Aug 27, 2003
  4. Replies:
    7
    Views:
    10,839
  5. Ameya
    Replies:
    2
    Views:
    328
    Ameya
    Jan 5, 2008
Loading...

Share This Page