Someone Getting Into My Computer?

[Guest]

I am running XP Pro on my workstation. My workstation event viewer has event
id's 538, 540 and 576 for a new employee in the company. This employee
should not have access to my computer. Everything I have found for these
events indicate the person logged on/off my workstation or remoted into it.
They are not listed as a user on my machine, nor have they ever been.

What's actually happening?

 

[David H. Lipman]

From: "Steve" <[email protected]>

| I am running XP Pro on my workstation. My workstation event viewer has event
| id's 538, 540 and 576 for a new employee in the company. This employee
| should not have access to my computer. Everything I have found for these
| events indicate the person logged on/off my workstation or remoted into it.
| They are not listed as a user on my machine, nor have they ever been.
|
| What's actually happening?
|

Probing maybe.

 

[Guest]

David:
The computer in question is mine, an admin. I can't see any way to nail
down this event that indicates another person is logging on/off or remoting
into my machine. I am at a dead end. The events do repeat daily.

Any suggestions?

 

[David H. Lipman]

From: "Steve" <[email protected]>

| David:
| The computer in question is mine, an admin. I can't see any way to nail
| down this event that indicates another person is logging on/off or remoting
| into my machine. I am at a dead end. The events do repeat daily.
|
| Any suggestions?

In a office Domain ?

On a home PC ?

You need to examine the activity surrounding the attempts.

 

[Guest]

My workstation runs XP Pro. The network runs 2003 Standard Servers.

The person listed in my event viewer is a new hire sales associate. It's
unlikely this person is a hacker. Never the less, I need to find out why
they are in my log and how to stop them.

 

[David H. Lipman]

From: "Steve" <[email protected]>

| My workstation runs XP Pro. The network runs 2003 Standard Servers.
|
| The person listed in my event viewer is a new hire sales associate. It's
| unlikely this person is a hacker. Never the less, I need to find out why
| they are in my log and how to stop them.

Do you have File and Print Shares loaded an he can browse your PC and thus "click" on the PC
?