someone is taking control of a pc

[daz666]

Hi we have a windows 7 machine that someone keeps taking control of. do you know of any software out there they might be using (we cant find anything installed on the pc) its possibly going to be an app installed on something like an ipad iphone ect and most likley a free app. we dont think they are using remote desktop as the user at the time says they watch what the person is doing I.E opening the internet ,going to my computer . lastly do you know of any software to catch them at it. cheers daz666

[elsiegee40]

It's not being controlled by something like Impero is it?

 

Failing that, don't waste time with it. Reinstall windows/re-image.

[adhutton]

This kind of thing usually requires software to be installed on the PC which interacts with the remote PC doing the controlling.

 

Things such as Impero, GotMyPC, TeamViewer etc. are likely candidates.

 

Can you not just look at the running processes/programs on the PC and see which one is in use?

 

Andrew

[X-13]

the user at the time says they watch what the person is doing I.E opening the internet ,going to my computer

 

If they're not doing anything... How do they know they're there?

[Meldrew]

i'd be interested in doing netstat -a -b and see if any suspicious processes are listening for connections...

 

meldrew

[strawberry]

Look for any sort of vnc in program files or as a service. It's possible they are installing , connecting and uninstalling. Also worth checking the admin accounts on the pc.

[Theblacksheep]

adobe connect?

[Edu-IT]

i'd be interested in doing netstat -a -b and see if any suspicious processes are listening for connections...

 

meldrew

I'd start with this, yes. It's alright just wiping the machine clean but I'd be more interested to know how they've done what they're doing. Might be a hole that needs to be fixed.

[AJWhite1970]

How exactly are they taking control of the PC? Taking over the mouse and keyboard? Might want to check for a tiny USB dongle and a small remote keyboard/mouse combo? One of my students tried that, spooked the teacher but the room was put in lockdown and one of the other students grassed them up infront of me (and I got to keep the keyboard, sits on my media PC at home these days...)

 

EDIT: Just checked, it was a Rii Touch http://riiminikeyboards.com/

Edited January 16, 2013 by AJWhite1970

[caffrey]

remote assistance ?

[Gaz]

Not exactly the same, but still remote control of sorts. We had a user doing this and he was using a wireless mouse with a dongle plugged into the back so it wasn't apparent. The drivers must already be installed for the mouse with Windows so it just accepts it. He was doing it while the teacher was using the Promethean board.

[dhicks]

Hi we have a windows 7 machine that someone keeps taking control of.

 

I've seen a Windows XP machine full of random teacher-downloaded malware / toolbars that seemed to have someone remote controlling it. We didn't bother investigating too closly, we just reimaged the machine right away.

[philwaud]

Google chrome remote desktop?

[apeman]

Products | Atelier Web

 

Web remote commander doesn't need anything installed, all you need is admin rights over a machine so it can copy a .exe to the hard drive and run it. the .exe is also deleted when the remote viewer program is closed.

you can call the .exe anything you like e.g. svchost.exe so you wouldn't spot it in task manager.

[daz666]

Hi thanks for the replies we will be lookihg into the sugestions. daz666

[Willott]

you can call the .exe anything you like e.g. svchost.exe so you wouldn't spot it in task manager.

 

Unless you add the command line column to task manager and you can see the location it's running from (ie svchost.exe outside of windows\system32 would be a flag up)

[mikeyd101]

Possible attack from app such as sub 7?

[dwhyte85]

Do a netstat -b and see if you've any known ports that belong to RAT / remote control software.