Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Security Breach?


  • Please log in to reply
2 replies to this topic

#1 vernodia

vernodia

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:03 PM

Posted 17 April 2009 - 09:49 AM

Hi,

I use a laptop with XP Professional.

I had sent my laptop in for repairs because it was sporadically powering on - i.e. sometimes it would and somtimes it wouldn't. The indicator lights showed the AC adapter was working and I could turn the power button on, on the lap top, but it would not power up. So, the repair guy said it was a hardware issue and replaced some part or the other. He asked for my login password as he said he had to test the laptop to make sure it was working properly. I was reluctant, but did so anyway.

However, when I got my laptop back, he said he had not logged on at all. However, the time/date was totally off and when going to start - all programs, it indicated I had new programs (i.e. a lot of the programs were highlighted, even though they were there before I sent the laptop in for repairs). He told me that he had to remove some internal battery while repairing, and hence the time/date issue - but no answer for the new programs issue...

My questions:

0. Hiow can I tell when the computer was turned on and logged into (like within the last week)?
1. How can I check if he accessed any files (copied, opened, etc.) or programs?
2. I had some files in the recycle bin (important ones) that I would not want him to have viewed - how can I tell if he did?
3. Can I tell if he installed some software (e.g. keylogger, etc.) that is harmful for me?
4. In future, if I have to send my laptop for repairs, how can I safeguard data and the laptop from being viewed by the repairer?
5. I suppose even if I did not give the login password, he could have simply removed the hard driver and copied it to another computer if he really wanted to see my data.

Thanks,

Vern

BC AdBot (Login to Remove)

 


#2 Romeo29

Romeo29

    Learning To Bleep


  • Members
  • 3,194 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:12:33 PM

Posted 17 April 2009 - 09:04 PM

I know a lady in Maine, USA who runs a computer repair shop. The first thing she does for fun is scan the hard disk for pictures. She once told me, that she found some funny (nude) pictures of a couple on their hard disk :thumbsup:

To know if someone accessed files on your computer, you can scan files for access date (using Windows Search tool) that you did not touch earlier.

You can also goto Control Panel >Admin Tools >Event Viewer to see if there are any events generated during the time, your laptop was with the repairman?

My suggestion is to create a new account for the repairman that has very few privileges and to password protecting your folders (using something like truecrypt) before giving the computer for repair.

Edited by Romeo29, 17 April 2009 - 09:04 PM.


#3 vernodia

vernodia
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:03 PM

Posted 17 April 2009 - 10:03 PM

Hi,

Thanks for the info.

Checked the Event Viewer and the last entry was generated before I gave the laptop for repairs (the next entries were for yesterday when I got it back and was checking it out). Is it possible to delete entries in the event viewer? The last message before sending for repairs was:

Details
Product: Windows Operating System
ID: 6006
Source: EventLog
Version: 5.2
Symbolic Name: EVENT_EventlogStopped
Message: The Event log service was stopped.

But the date/time was messed up when i got it back so could that affect the date/time for events on the event log and give me an inaccurate info? Same thing with the search tool - could the wrong date/time affect the info? For example. in control panel - add/remove, it shows last modified date and its all messed up (i.e. something i accessed in the last month is showing that I last accessed it 3 years ago) so maybe the time/date on the computer has messed this up and wont provide accurate info?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users