BleepingComputer.com: Security Breach?

Hi,

I use a laptop with XP Professional.

I had sent my laptop in for repairs because it was sporadically powering on - i.e. sometimes it would and somtimes it wouldn't. The indicator lights showed the AC adapter was working and I could turn the power button on, on the lap top, but it would not power up. So, the repair guy said it was a hardware issue and replaced some part or the other. He asked for my login password as he said he had to test the laptop to make sure it was working properly. I was reluctant, but did so anyway.

However, when I got my laptop back, he said he had not logged on at all. However, the time/date was totally off and when going to start - all programs, it indicated I had new programs (i.e. a lot of the programs were highlighted, even though they were there before I sent the laptop in for repairs). He told me that he had to remove some internal battery while repairing, and hence the time/date issue - but no answer for the new programs issue...

My questions:

0. Hiow can I tell when the computer was turned on and logged into (like within the last week)?
1. How can I check if he accessed any files (copied, opened, etc.) or programs?
2. I had some files in the recycle bin (important ones) that I would not want him to have viewed - how can I tell if he did?
3. Can I tell if he installed some software (e.g. keylogger, etc.) that is harmful for me?
4. In future, if I have to send my laptop for repairs, how can I safeguard data and the laptop from being viewed by the repairer?
5. I suppose even if I did not give the login password, he could have simply removed the hard driver and copied it to another computer if he really wanted to see my data.

Thanks,

Vern

I know a lady in Maine, USA who runs a computer repair shop. The first thing she does for fun is scan the hard disk for pictures. She once told me, that she found some funny (nude) pictures of a couple on their hard disk

To know if someone accessed files on your computer, you can scan files for access date (using Windows Search tool) that you did not touch earlier.

You can also goto Control Panel >Admin Tools >Event Viewer to see if there are any events generated during the time, your laptop was with the repairman?

My suggestion is to create a new account for the repairman that has very few privileges and to password protecting your folders (using something like truecrypt) before giving the computer for repair.

This post has been edited by Romeo29: 17 April 2009 - 09:04 PM

Hi,

Thanks for the info.

Checked the Event Viewer and the last entry was generated before I gave the laptop for repairs (the next entries were for yesterday when I got it back and was checking it out). Is it possible to delete entries in the event viewer? The last message before sending for repairs was:

Details
Product: Windows Operating System
ID: 6006
Source: EventLog
Version: 5.2
Symbolic Name: EVENT_EventlogStopped
Message: The Event log service was stopped.

But the date/time was messed up when i got it back so could that affect the date/time for events on the event log and give me an inaccurate info? Same thing with the search tool - could the wrong date/time affect the info? For example. in control panel - add/remove, it shows last modified date and its all messed up (i.e. something i accessed in the last month is showing that I last accessed it 3 years ago) so maybe the time/date on the computer has messed this up and wont provide accurate info?