"Other users logged in"??!!? Who are these users??

E

Ed from AZ

My daughter fired up her laptop the other night just to show us a
picture she'd saved to her desktop. It's a Dell Latitude 600 running
Win XP pro. SHe has WiFi and Bluetooth capabilities.

Didn't launch any programs or connect to WiFi - though I guess it's
possible the computer detected a network in the neighborhood and
connected to it. When we went to shut down, we got a message saying
"Other users are logged in. Shutting down will disconnect them."

We've never seen this before. I did have a scare on my laptop with
the Confiker worm, but everything says I'm clean, the thumb drive we
shared is clean, and her machine is clean.

How do we see who is "logged in"? Could this be something bad? Or
just a Windows thing that doesn't mean much?

Ed
 
E

Ed from AZ

Was WiFi & Bluetooth disabled at the time?

No, they weren't. She's got the free AVG, but I know the Windows
firewall is off. I run ZoneAlarm, PC Tools AV, and Spyware Terminator
(all frees) with Win FW off, and I still got the worm!

Is there a control panel or such that will tell us who's logged in if
we get this message again?

Ed
 
P

PA Bear [MS MVP]

Ed said:
No, they weren't. She's got the free AVG, but I know the Windows
firewall is off. I run ZoneAlarm, PC Tools AV, and Spyware Terminator
(all frees) with Win FW off, and I still got the worm!
<snip>

The plot thickens...

Why in the world is the Windows Firewall on her computer turned off?!?!?

If both computers are on a local area network and data on each computer is
available to the other(s), you're in one fine mess. Neither computer should
be connected to the network or the internet until such time as you've gotten
both computers 100% clean *and* have either Reset or Reinstalled the router.

NB: Do NOT waste your time with any of the below IN RE your daughter's
machine: Format & reinstall Windows. A Repair Install will NOT help!

On all other machines:

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You will need to download the
MSRT (and any other tools) on a non-infected machine, then transfer MRT.EXE
to the infected machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://www.dslreports.com/forum/cleanup, http://aumha.net/viewforum.php?f=30
or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
 
J

Jim

My daughter fired up her laptop the other night just to show us a
picture she'd saved to her desktop. It's a Dell Latitude 600 running
Win XP pro. SHe has WiFi and Bluetooth capabilities.

Didn't launch any programs or connect to WiFi - though I guess it's
possible the computer detected a network in the neighborhood and
connected to it. When we went to shut down, we got a message saying
"Other users are logged in. Shutting down will disconnect them."

We've never seen this before. I did have a scare on my laptop with
the Confiker worm, but everything says I'm clean, the thumb drive we
shared is clean, and her machine is clean.

How do we see who is "logged in"? Could this be something bad? Or
just a Windows thing that doesn't mean much?

Ed

If she doesn`t use a password on at least her WiFi , anybody can use
the connection . ( My WiFi has 400 feet operating range , but it`s
password protected ) .
 
B

BillW50

In
Ed from AZ typed on Sat, 16 May 2009 12:22:42 -0700 (PDT):
My daughter fired up her laptop the other night just to show us a
picture she'd saved to her desktop. It's a Dell Latitude 600 running
Win XP pro. SHe has WiFi and Bluetooth capabilities.

Didn't launch any programs or connect to WiFi - though I guess it's
possible the computer detected a network in the neighborhood and
connected to it. When we went to shut down, we got a message saying
"Other users are logged in. Shutting down will disconnect them."

We've never seen this before. I did have a scare on my laptop with
the Confiker worm, but everything says I'm clean, the thumb drive we
shared is clean, and her machine is clean.

How do we see who is "logged in"? Could this be something bad? Or
just a Windows thing that doesn't mean much?

Hi Ed! I read all of the posts so far and I disagree. Here is what I
believe happened. Your daughter's computer logged on automatically to a
neighbor's WiFi network. And this neighbor was being nosey and peeking
on your daughter's computer.

You can block them by changing the administrator's password and disable
guest logons. Administrator's account is blank by default. Also
disabling sharing will keep others off too (change the administrator's
account still). So that is best if others don't access her computer
anyway.

You should setup WiFi to not just willy-nilly logon to any network too.
 
P

PA Bear [MS MVP]

Read his post again: He's running ZA on *his* computer & he's also seeing
the same behavior.
 
E

Ed from AZ

Many thanks to all who chimed in.

Yes, she needs a firewall. Not sure if she found conflicts between
her AVG and Windows Firewall and so turned it off. But she's a Big
Girl, and that's her computer. I do like the looks of Comodo, and for
only $39 it seems pretty comprehensive. We don't have a home network
- just our two laptops that we take to WiFi hotspots.

I did download the Windows MRT, burned it to a CD, and she ran it -
nothing found.

I do think her WiFi is set to automatically log in to certain hot
spots (mine is too). The problem is that many people don't bother to
rename their connections, so if she auto-connects to "linksys" at the
local coffee shop, she'll also connect to the neighbor's linksys!
That does sound like the most plausible explanation.

Kelly: The Ask Leo link was most helpful, especially his link to
Process Explorer. I'm into knowing what's going on, so I'll probably
download and install that.

PA Bear: We haven't had a chance to work through all the info you
linked to. If we run into a problem, we'll definitely shout for help.

Again, thanks for all the info.
Ed
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top