Computing.Net > Forums > Windows XP > Remote desktop used for evil...=(

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Remote desktop used for evil...=(

Reply to Message Icon

Name: DonLduk
Date: May 7, 2006 at 20:39:10 Pacific
OS: XPSP2
CPU/Ram: Dell
Product: Dell
Comment:

Hi. I have a friend, whose roomate (as she told me) is being stalked by her boyfriend, because apparently, he can see whatever she and my friend do on their PC. Proof of it was that one day they were looking at party pictures and the guy inmediatly called and asked what the heck was she doing out in the night partying. Now they had a problem because both their emails we hacked and changed passwords and stuff. Me having notion of PCs, I was asked to help them, but I dont have that much notion about remote desktop (which I suppose the guy is doing). The 1st thing I thought of was to disable the service, and the check boxes on the system windows.

Im not sure if that is going to be enough, or, can anyone guide a bit better?

I read some information that may be useful in this page

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/adminra.mspx

Will that be enough?

thanks for the replys in advance.



Sponsored Link
Ads by Google

Response Number 1
Name: jefro
Date: May 7, 2006 at 20:48:38 Pacific
Reply:

#1. If your friend is being stalked then have her or you contact the police. Contact your local women's shelter for their help too.

Security on computers is not built in oddly enough. There are many things that one must do to help. The only true security is not connecting to the internet.

Consider too that your friend may also have some sort of snooping device. I'd contact a security company and see how much for a sweep.


Anyway, you should disable the box's about remote assistance and also remote desktop. There are also other programs that can transfer the screen images to other computers. Things like pcanywhere, vnc and maybe even online type of setups might have been placed. If your friend is in danger then you need to get a local computer company that is trusted to check that computer.

The other solution in the mean time might be to use a type of live cd such as Knoppix or DSL. They boot from a cd and are pretty secure. They offer a type of browser that works with most sites.


0

Response Number 2
Name: Michael J (by mjdamato)
Date: May 7, 2006 at 20:53:11 Pacific
Reply:

He is not using remote desktop. If he was, when he logs it it would automatically log out anyone who was using the computer. I have never used Remove Assistance (which allows the local and remote user to view the desktop simultaneously) but my understanding is that it requires the local user to accept the connection.

There are other "remote desktop" applications though which may or may not require the local user's acceptance. In any case, these programs would most likely require the computer to be listening in on a port. If they are behind a router, check the router settings to be sure no ports are being redirected. If not behind a router, check the firewall settings to make sure no unneccessary ports are open. Or, install a different firewall.

And, you shoud download the latest updates for virus and spyware scanners and run full system scans. Changing passwords may not be sufficient if he installed a keylogger.

Lastly, do a CTRL-Shift-ESC to bring up the task manager. On the processes tab ensure the "Show processes from all users" is checked. Then one by one, enter the name of each "Image Name" in the list into Google to see what the process is.

Michael J


0

Response Number 3
Name: chancer
Date: May 8, 2006 at 03:48:54 Pacific
Reply:

The others are right, there are plenty of programmes available that will take screenshots of a desktop at predefined intervals and email them out. It is then just a question of opening the email and seeing what activity has been taking place on the affected PC. Many of them are marketed at employers and parents concerned at what their workers or kids might be viewing. For example:

http://www.filesland.com/companies/Jay-Cheah/Win-Spy-Software.html

She probably has one of these installed on the PC, and the boyfriend is having the screenshots sent to him. However, as Michael J says, if he also has a key logger installed he could be getting passwords AND financial information. If this is the case it may even be illegal, but I don’t know what your laws are like.

Locate and uninstall the spyware, and get a new boyfriend would be my advice!


0

Response Number 4
Name: dj3642
Date: May 8, 2006 at 05:37:33 Pacific
Reply:

well sicne what is on her PC may be some sort of tracker. i would suggest that she back up all her stuff and do a clean format and get rid of it. i mean you can spend lots of time trying to weed out the culprit.. but she can wipe out and reformat and then be VERY careful about opening up email attachments as that is how many SPY trackers are installed.. i mean a format is usually a last resort. but seeing that this is a "stalking" issue.. maybe this extreme needs to be looked at to get stopped NOW.. just a suggestion..


0

Response Number 5
Name: Woof
Date: May 8, 2006 at 06:30:06 Pacific
Reply:

Contact the Police and nail this creep.

Get him sent away for a very very long time in a cell with a big guy who needs his own bitch!!!!

He`d then think twice about doing it again.

FWIW

Woof

Always proof-read carefully to see if you any words out.


0

Related Posts

See More



Response Number 6
Name: CyberSlug
Date: May 8, 2006 at 09:27:05 Pacific
Reply:

Yes, you should contact the police. There's no telling what spy software and/or hardware (bugs, cameras, etc). could be around.

I don't know if police would need/want any forensic computer evidence, so you should probably contact them before making changes to the computer.


0

Response Number 7
Name: tonysathre
Date: May 8, 2006 at 10:54:27 Pacific
Reply:

It's most likely VNC. VNC allows someone to remotely monitor a PC without the user needing to accept a connection.

To see if your PC has a listening VNC server run this command and look for port 5900:

netstat -an

You may also want to see if any other high port numbers are listening (port 1024 or higher) and then Google those to see what services run on those ports.

You can also check your services by going to Start | Run | type services.msc and hit enter. Look for VNC Server. If its there, disable it and set it's startup type to disabled.

Fed up with Windows? Try Ubuntu Linux


0

Response Number 8
Name: DonLduk
Date: May 9, 2006 at 21:47:46 Pacific
Reply:

Hi. thanks for the replys, they really guided me.

The guy was so stupid that he left all the installers in the root C: folder, so I found these programs:

Family_keylogger
Family_keylogger V2 or whatever
and
Remote Administrator v2.2

and of course, I did a little research and found the files created by keylogger, and jezz hes been spying for 3 months or so, holy! hehe. I uninstalled all 2 softwares, then ran ad aware SE, then disabled remote desktop service and reactivated the firewall and firewall alarms, which I found disabled.

That will do it for now because I heard the guy left for a long trip to USA or something. But, is there a way to prevent the firewall from being deactivated? Internally?

thanks for the replys again.


0

Response Number 9
Name: captainkremmen
Date: May 10, 2006 at 18:52:33 Pacific
Reply:

Don't rely on just the built in windows XP firewall. It blocks incoming connections but not outbound connections. Download one of the decent freeware firewalls such as Zonealarm. That way if any other nasties get onto the PC Zonealarm (ow any of the other decent firewalls) will pop up a box informing you the program has asked for an internet connection. If it is not a program you recognise you can deny access until you investigate further.



0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows XP Forum Home


Sponsored links

Ads by Google


Results for: Remote desktop used for evil...=(

Using Remote Desktop w/Firewall www.computing.net/answers/windows-xp/using-remote-desktop-wfirewall/83508.html

Remote Desktop Disconnected www.computing.net/answers/windows-xp/remote-desktop-disconnected/112494.html

Remote Desktop-using local printer www.computing.net/answers/windows-xp/remote-desktopusing-local-printer/143656.html