Was my machine compromised?

[Ignacio Machin \( .NET/ C# MVP \)]

Hi,

Cross posted to microsoft.public.windowsxp.help_and_support,
microsoft.public.windowsxp.general

This morning I went to shutdown my computer and I got a popup saying
"There are other users logged on the computer ... " and that strike me as
something odd.

These are the facts that I found out:


I'm the only user of the computer, the other user defined as not login
permission. My user has no password and IIRC you cannot connect using TS
unless the user has a password, is this correct?

I'm behind a DSL modem that has NAT. also have updated versions of NAV and
MS antispyware.

The machine is updated with the lastest patchs from MS

The only change I did yesterday was installing Quake 4

Also in the log I saw an entry saying something like "An application or
service was using the log when the shutdown started so it could not finish
written it, the log will be .... This is probably cause a windows service
was running as the logged user" , I do not recall any service running under
my username.

Was my machine compromised in someway or I'm just being paranoic?


Thanks in advance,

 

[Gerry Cornell]

Next time it happens look in Task Manager -Ctrl+Alt+Del, User tab.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Ignacio Machin \( .NET/ C# MVP \)]

I did

But when I did so it was only me, now, IIRC when you are using terminal
service and from the console you try to turn off you get a message saying
so. So it's possible that if somebody was logged using TS , as soon as he
saw that message he logoff.

cheers,

 

[Gerry Cornell]

What anti-virus, firewall and anti-spyware programmes are you using?

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Ignacio Machin \( .NET/ C# MVP \)]

NAV, MS antispyware

I'm behind a NAT router and I do not have any firewall installed in the
local computer

 

[Fitz]

You need to have a firewall. Being behind a NAT router is good, but not
good enough. If you're using XP SP2, enable the firewall.

***

 

[V Green]

Response inline:

Hi,

Cross posted to microsoft.public.windowsxp.help_and_support,
microsoft.public.windowsxp.general

This morning I went to shutdown my computer and I got a popup saying
"There are other users logged on the computer ... " and that strike me as
something odd.

These are the facts that I found out:


I'm the only user of the computer, the other user defined as not login
permission. My user has no password and IIRC you cannot connect using TS
unless the user has a password, is this correct?

I'm behind a DSL modem that has NAT. also have updated versions of NAV and
MS antispyware.

The machine is updated with the lastest patchs from MS

The only change I did yesterday was installing Quake 4

Quake runs multiplayer over networks (at least the old
versions did - I haven't had time to play any games for
years now) and may load stuff to do this.

Make sure you don't have this capability enabled.

I would simply try uninstalling it to see if the
behavior goes away.

 

[Rick \Nutcase\ Rogers]

Hi,

That message will occur if any other user is connected to your machine. P2P
file sharing applications and games that use 'net connections can easily
cause this to occur.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org