"People are logged in ... " Who?

[Lars]

Hi group,

A friend of mine gets these odd messages as he is about
to shut down his computer. "Other people are logged in ....
blabla will be lost if you shut down now.."

Actually he has Windows XP, but I could not find any serious
looking group for XP networking. He also has profiles on his
computer for girlfriend and daughter but they rarely use the
machine and anyhow these messages appear also when
they have not been logged in at all.

He has only one computer, and a broadband connection.
No firewall yet.
He is a very nice person but not particularly computer
savvy. He has lived elsewhere for several years and just
moved back to this city. I have not seen that computer
yet and do not know much of what is installed on it, but
have promised to come over soon.

Certainly I want to set up a firewall for him. That is not
my question here. But what about these "people logged in",
are they bad guys or is it just a silly message?


Lars
Stockholm

 

[Bob I]

Get a firewall on that unit quick!

 

[Steven L Umbach]

The " net sessions " command would list who is connected to the computer. If
he has a broadband connection without using a firewall he more then likely
has a compromised and or infected computer. Tell him to enable the built in
firewall in XP and to disable file and print sharing. Of course the computer
should be scanned for malware ASAP. --- Steve

http://www.microsoft.com/athome/security/protect/default.aspx -- Microsoft
tips on PC security.

 

[Lars]

If he has a broadband connection without using a firewall he
more then likely has a compromised and or infected computer.

I am sure I will find some spyware etc once I get to that
computer. But would such malware etc really appear as
a "user logged on to your system"?


Lars
Stockholm

 

[Eugene Taylor]

No but most likely they have installed a trojan. If you right click on my
computer you can go to manage and from there click on the plus by share
folders. From there you can get a list of what is shared, what sessions are
active, and what files are actually open.

 

[Steven L Umbach]

Not usually. Worms attack vulnerabilities of the operating system or a weak
passwords. Malware will usually show itself as unknown startup programs or
processes. Free tools from SysInternals such as TCPView, Process Explorer,
and Autoruns can help in detecting such. Your best bet however would be to
run a full virus scan with the latest virus definitions installed from the
vendor's website. --- Steve

 

[Shalom B.]

It could be that he has some program, service logging on using another
users credentials via the secondary logon service.

 

[Lars]

It could be that he has some program, service logging on using another
users credentials via the secondary logon service.

Thank you all for your suggestions.

I was over to his place a couple of days ago and helped him
out on several things.

Cleaned out about one gig of temporary files from Windows
and IE cache.

Reinstalled Norton Antivirus, that had somehow stopped
working and not been updated in a long time. Scanned
and found several viruses, including trojans.

Installed Spybot scanning for spyware. It found 58
mal entries on first scan. Immunized.

Installed Startup.cpl and disabled more than a dozen
useless, or even hazardous, things from starting with
Windows. Also did some research on funny messages
he had experienced lately, and found that they were
quite innocent since they are related to his HP printer.

Set up a hardware firewall / router.

Installed ZoneAlarm software firewall.

That is about all we had time for and I think he is far
better protected than before.

Again thank you all.


Lars
Stockholm