Possible Unknown intruder..

[msnews.microsoft.com]

Hi,
My machine have XP pro SP3 and also have NOD32 antivirus Business Edition
install both uptodate. I have firewall on. I don't have any network sharing
folder open or any other program open, but when I reboot my pc, a notice
dialog pops
up saying something like this "another user is still connected to your
computer. are you sure you want to turn off your computer?".

My question, is there a way to tell whos connected?

Thanks in advance!

Mingo

 

[Big_Al]

Hi,
My machine have XP pro SP3 and also have NOD32 antivirus Business Edition
install both uptodate. I have firewall on. I don't have any network sharing
folder open or any other program open, but when I reboot my pc, a notice
dialog pops
up saying something like this "another user is still connected to your
computer. are you sure you want to turn off your computer?".

My question, is there a way to tell whos connected?

Thanks in advance!

Mingo

Open computer management. See Shared Folders. You have shares,
sessions and open files.
If there is anyone in your system it would normally show up there.

 

[Mike Hall - MVP]

Hi,
My machine have XP pro SP3 and also have NOD32 antivirus Business Edition
install both uptodate. I have firewall on. I don't have any network
sharing
folder open or any other program open, but when I reboot my pc, a notice
dialog pops
up saying something like this "another user is still connected to your
computer. are you sure you want to turn off your computer?".

My question, is there a way to tell whos connected?

Thanks in advance!

Mingo

Is there more than one account? Is somebody logging into the other account?


--
Mike Hall - MVP
How to construct a good post..
http://dts-l.com/goodpost.htm
How to use the Microsoft Product Support Newsgroups..
http://support.microsoft.com/default.aspx?pr=newswhelp&style=toc
Mike's Window - My Blog..
http://msmvps.com/blogs/mikehall/default.aspx

 

[Mingo]

I only have one account created, beside the admin account which i never use
it.

 

[Mingo]

Thanks..
I opened compmanagement and no one show up is in my system.
It's not everytime i get this dialog box..

 

[Shenan Stanley]

My machine have XP pro SP3 and also have NOD32 antivirus Business
Edition install both uptodate. I have firewall on. I don't have
any network sharing folder open or any other program open, but when
I reboot my pc, a notice dialog pops
up saying something like this "another user is still connected to
your computer. are you sure you want to turn off your computer?".

My question, is there a way to tell whos connected?

First off - I suggest changing both your password and the built-in
administrators passwords immediately - just as a precaution. Why take the
chance and you will be able to see ALL accounts while doing this. ;-)

Secondly - and this is truly a shot in the dark - I would suggest
installing:

http://www.microsoft.com/downloads/...hVQmszOMq6HriyUTLewWaQIM2W8TsZfA7xxN7jRhKYg==

UPHClean...

Reboot a few times.

As a more drastic measure after that...

Cleanup using "Disk Cleanup" followed by a CHKDSK (reboot will likely be
necessary) and then a DEFRAGMENTATION. After those three things - run
SuperAntiSpyware and MalwareBytes (free versions with updated definitions)
and do full scans with each of them. Clean up anything they find. You can
uninstall them afterwards. See if any of that helps.

 

[HeyBub]

Hi,
My machine have XP pro SP3 and also have NOD32 antivirus Business
Edition install both uptodate. I have firewall on. I don't have any
network sharing folder open or any other program open, but when I
reboot my pc, a notice dialog pops
up saying something like this "another user is still connected to your
computer. are you sure you want to turn off your computer?".

My question, is there a way to tell whos connected?

Thanks in advance!

You got wireless networking? You got neighbors?

 

[Dan]

I agree with Shenan Stanley and may I add please be sure the passwords meet
with the minimum requirements of the Microsoft Password Checker. In
addition, you really should use the admin. account sometimes and you can use
it when you are not connected to the 'Net just to make sure everything is
okay with your accounts.

http://www.microsoft.com/protect/yourself/password/checker.mspx

Finally, please consider following Chris Quirke's standards of safety while
being on the Internet.

 

[Twayne]

Hi,

My machine have XP pro SP3 and also have NOD32 antivirus Business
Edition install both uptodate. I have firewall on. I don't have any
network sharing folder open or any other program open, but when I
reboot my pc, a notice dialog pops
up saying something like this "another user is still connected to your
computer. are you sure you want to turn off your computer?".

My question, is there a way to tell whos connected?

Thanks in advance!

Mingo

It's most likely one of the "system accounts" that haven't finished
their work or are hung up. Often microsoft's UPHclean will take care of
that. I don't have a URL for it, but search at MS or use Google and
look for a hit from Microsoft. Download it and run it. Seems like it
was a .msi: Meaning, you right-click and choose "Install" to run it.

If you go to a Command Prompt and enter netstat -a it'll show you
all the open connections and who is connected, listening, connected,
etc.. Best place to start, IMO. If you see any connections that you
know you're not connected to, that's a problem. Normally you will not.

HTH

 

[Mingo]

A BIG thank you to everyone for helping... So far, i'm not getting any
notice.

Mingo

"Twayne" <[email protected]> ¼¶¼g©ó¶l¥ó·s»D:[email protected]...
|> Hi,
| > My machine have XP pro SP3 and also have NOD32 antivirus Business
| > Edition install both uptodate. I have firewall on. I don't have any
| > network sharing folder open or any other program open, but when I
| > reboot my pc, a notice dialog pops
| > up saying something like this "another user is still connected to your
| > computer. are you sure you want to turn off your computer?".
| >
| > My question, is there a way to tell whos connected?
| >
| > Thanks in advance!
| >
| > Mingo
|
| It's most likely one of the "system accounts" that haven't finished
| their work or are hung up. Often microsoft's UPHclean will take care of
| that. I don't have a URL for it, but search at MS or use Google and
| look for a hit from Microsoft. Download it and run it. Seems like it
| was a .msi: Meaning, you right-click and choose "Install" to run it.
|
| If you go to a Command Prompt and enter netstat -a it'll show you
| all the open connections and who is connected, listening, connected,
| etc.. Best place to start, IMO. If you see any connections that you
| know you're not connected to, that's a problem. Normally you will not.
|
| HTH
|
|
|
|

 

[kalyan]

hi

Download the sysinternals utility called logonsession & try to find out

http://live.sysinternals.com/logonsessions.exe

Warm Regards
Kalyan

 

[Dan]

Kaylan, please provide us with a true web-link and the system requirements
for use of the tool you provided. Thanks in advance, Dan W.

 

[David H. Lipman]

From: "Dan" <[email protected]>

| Kaylan, please provide us with a true web-link and the system requirements
| for use of the tool you provided. Thanks in advance, Dan W.

Win2k and above...

http://technet.microsoft.com/en-us/sysinternals/bb896769.aspx

 

[Dan]

Thanks David.

 

[kalyan]

Hi

May know are you able to download the file from the below mentioned
site????.

Because this live link send my microsoft download centre notification
letter........

Have you got it.......

http://live.sysinternals.com/logonsessions.exe


Warm regards
kalyan








----- Original Message -----
From: "David H. Lipman" <[email protected]>
Newsgroups:
microsoft.public.security,microsoft.public.security.virus,microsoft.public.windowsxp.general
Sent: Saturday, September 06, 2008 1:33 AM
Subject: Re: Possible Unknown intruder..

 

[Shenan Stanley]

<snipped>

Download the sysinternals utility called logonsession & try to find
out
http://live.sysinternals.com/logonsessions.exe

Win2k and above...

http://technet.microsoft.com/en-us/sysinternals/bb896769.aspx

May know are you able to download the file from the below mentioned
site????.

Because this live link send my microsoft download centre
notification letter........

Have you got it.......
http://live.sysinternals.com/logonsessions.exe

Not sure what you are asking, but when I go to the link provided (
http://technet.microsoft.com/en-us/sysinternals/bb896769.aspx ) and click on
the download link ( Download Logonsessions (62 KB) ), I get directed to:

http://download.sysinternals.com/Files/LogonSessions.zip

Which asks me what to do - so I save the file... If I open it - I get the
executable and the EULA.

However - you gave:
http://live.sysinternals.com/logonsessions.exe

Which is a direct link to the executable - that seems to be the exact same
as the one in the zip file - sans the EULA.

I would say the main difference is one was meant to be distributed ot the
general public - so they would know what they are getting/clicking on/etc -
while the other was probably not necessarily meant for general consumption.
One comes with the EULA - further explainning the rights/etc the user of
said application has (so more for general consumption) while the other is
just the executable.

Now - perhaps there is a web page that actually has the direct link to the
executable someplace that does all this explaining as you read the page and
find said link - I don't know.

 

[Dan]

I have a multi-boot system that includes 98 Second Edition and XP
Professional fully customized on different hard drives. 98 SE is in Fat32
file system while XP Pro. is in NTFS file system and that is why I wanted to
know the system requirements and the web page which David so graciously
provided and I do not like to skip over the web page and the EULA but that is
just the way I work. Thanks anyway for the effort kalyan. I do not know
when the original poster will write back or it the original poster will write
back again.