Jump to content
Sign in to follow this  
Rokkaholik

Windows 7 - Checking Recent Activity

Recommended Posts

A good friend just called me and said that she has a small "issue" at her workplace... They wanted her to do some work from home and the only way to do that would be to install some sort of VPN (?) in her personal laptop.

 

Now... The techie dude that came to do it has been "eyeballing" her for quite some time and even propositioned her once. (why he's still there? I don't know). He wanted to take her laptop back to his office to do it, but she told him that he will do whatever he needs to do right there in her office. She had work to do, so she was doing that and tech boy was busy fiddling with her laptop with the screen facing HIM and she couldn't see it. Then she noticed he had his cell phone plugged into her USB port. She immediately addressed this and he quickly unplugged it and said he was just charging his phone... :glare:

 

 

Not that she has anything "naughty" on her laptop, she does have personal stuff as well as tax documents, and other financial stuff. She hasn't accessed ANYTHING since he was on it (I told her not to). Is there a way to look at recently copied/looked at/transferred type files? I know about the Event Viewer, but no clue where to look once it's opened in Windows 7 Home Premium.

 

She doesn't have the Recently Opened Files or Recently Installed Programs thing turned on in the taskbar...

Share this post


Link to post
Share on other sites

Check the control panel to see if he installed anything recently (if you go to uninstall a program you should be able to sort by date).

 

The even log should have the information in there as well...but to be honest I usually give up looking for specific events because it's so cumbersome. :lol:

 

You could take a look at the running processes/services to find out if anything odd is running as well.

Share this post


Link to post
Share on other sites

Windows Backup will also show any recent program changes. Just check for restore points, and see if there's one akin to "installed yaddayadda.exe" on the day he used her laptop. Sometimes they uninstall it to cover their tracks (like when she questioned him), so it doesn't show in the programs list. But it'd still show here as most people don't think to clear the restore points list.

 

As for recent documents he might've viewed or copied.. I'd have to think a while, nothing comes to mind on that one.

Edited by dragonsdontfly

Share this post


Link to post
Share on other sites

http://www.youtube.com/watch?v=JejZjSg8HxY

 

A personal thing I do if I'm using my laptop or desktop near people I don't trust... I open FRAPS and set it to record a screenshot every 30 seconds. Those screenshots are saved to my dropbox folder. So even if I'm away.. Every 30 seconds the computer is awake, I get a screenshot on my phone of what is being done on it. I've included the FRAPS subfolder of my dropbox directory in my disk cleanup's routine, so anytime I run it it clears out the old pictures automatically. Helps me recover all the disk space I occasionally lose when I set it to go off.

 

If you do this I'd recommend hiding the on-screen FPS counter and disabling the key to toggle it's position. I even re-enabled the notification area's hiding feature where it minimizes everything to the taskbar button so FRAPS is only visible if they look for it. That way MOST people aren't aware of it even recording them.

 

Some are still smart enough to shut it off. But in that case you just confront them about why they disabled it.

Edited by dragonsdontfly

Share this post


Link to post
Share on other sites

She confronted the guy again later that day and he offered his phone to her to look through... Even though that still doesn't cover the time in between where he could have easily sent it somewhere else. She said that any of the other techs she would have just taken their word for it, but this one has been creeping on her. Damn creepy IT guys... :rolleyes:

 

 

Going to install Malwarebytes and Spybot for her just in case and that should make her feel better...

Edited by Rokkaholik

Share this post


Link to post
Share on other sites

Has she filed complaints or anything about him? If not she should. It would start a paper trail to where if he doesn't cut the . out he should get trash canned with plenty of documentation. Or maybe he just needs some parking lot counseling ;)

Share this post


Link to post
Share on other sites

It snot a crime to ask someone you work with out on a date. Unless of course he flat out asked to get in her pants. Just check and see if anything was installed. I use a VPN to get into my work systems from home or on the road. If she needs to access company files from home then it is a reasonable request. Most companies have an IT request that needs to be filled out by a supervisor before it goes forward just for security concerns.

A geek whos phone battery died is a plausible reason for hooking up to a computer and the fact that he offered it up for review I don't think there is anything there.

Share this post


Link to post
Share on other sites

If she is really worried that he installed anything she could just go into system restore and go back to the day before he worked on the pc, then ask another tech that she trusts to reinstall the programs she needs to work from home, but I doubt he would risk his job by installing any malicious programs.<IMG class=bbc_emoticon alt=:rolleyes: src="http://forums.overclockersclub.com/public/style_emoticons/default/rolleyes.gif">

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...