up vote 1 down vote favorite
share [g+] share [fb]

I’m suspecting my computer is being used when I’m not at home. This is happening either physically or remotely. My wireless switch is off. Is there any way possible to detect and/or monitor activity without purchasing software? My settings are being changed as well as passwords (Bios PW was changed and I cannot access Bios settings). I connect via the network cable. Is it possible for someone (in range) to connect to my laptop even if the wireless switch is off? This is a Dell Inspiron 1720 with the WLAN 1395 card. Here’s the kicker. When I try to download freeware for monitoring activity, I am not allowed to do this! ????

link|improve this question
First, thanks to everyone for responding to my dilemma.I agree that the computer is being accessed either physically (ex has key) and/or remotely. Dell informed me to replace the MBoard. Ha! Correct on the battery removal. That doesn't work. The keylogger program was blocked from downloading. Go figure. This problem happened once before, with a small dialog box popping up at certain times with the words "I'm here" inside. Nice, huh? Had to reinstall Windows to fix that one. The wireless switch is on the left side of the laptop. My cure? The manual keylock that locks the puter physically. :-) – brydaverambo Dec 25 '09 at 9:06
next time don't date psycho's.. Lesson learned, a bricked computer is a hard way to learn that one.. oh well now you know right? ;) – Jakub May 3 '10 at 17:36
feedback

4 Answers

up vote 1 down vote

If your BIOS password has been changed, the system's being accessed physically, which significantly limits your options for securing the box. Even requiring a BIOS-level password on bootup won't help, as your uninvited user can just reset the password by calling Dell and giving them the service IDs printed on the bottom of the machine.

Being blocked from security-related downloads indicates your system is infected -- probably something picked up online by your uninvited user. That means you need to reinstall Vista (to eliminate the malware) after doing a complete wipe of the drive (to eliminate any questionable material that may have been downloaded -- god only knows what kind of sites they've been visiting).

If you want to prevent this from happening again:

  1. Look into setting up drive encryption as part of the reinstall.
  2. Secure the laptop physically when you're not home.
  3. Find a new roommate.
link|improve this answer
One can actually edit the Windows (or Linux, for that matter) password from a tool booted from a CD, so don't rely on that to foil your unauthorized user. Hard disk encryption would be a good option, though. That way they couldn't change anything or even use anything on the hard drive unless they knew your hard drive passkey. They could still boot from a LiveCD and use the computer, but at least your hard drive would be safe. As long as they didn't steal it, that is. Be careful. – Nathaniel Dec 15 '09 at 0:31
feedback
up vote 0 down vote

Do you leave it on when you aren't home? What wireless switch are you referring to? Do you leave the network cable in, or, more specifically, is it connected to the Internet when you aren't there? What's your physical security - who would have access? If we're going to try to check out a security issue, we need more information.

How's your anti-virus software? What I would suspect is that somebody took over your computer, and is using it remotely over the net.

link|improve this answer
Dell Inspiron has a physical switch on the computer itself that turns the wireless network card completely off. However, it doesn't turn off the ethernet port, and bluetooth might still be an option for wireless attacks. – eswald Dec 14 '09 at 20:13
In the BIOS you can set the switch to also turn of BT – prestomation Dec 14 '09 at 20:22
Thanks - I haven't found a switch on my Inspiron 1420. (Not that I've looked at carefully, or more than glanced at the information card.) – David Thornley Dec 14 '09 at 22:59
My Inspiron 1720 wireless switch is on the left side with 3 positions. Off/On for detecting and accessing any available networks in the proximity and a momentary position that sets the card to check for any available networks. This switch (if activated via the BIOS settings) will detect even if the computer is off. This is why I suspected remote access, because I had turned the option off in my setup, set the PW, then went to my cable instead. When I tried to reset later, is when I found the PW changed as well as my previous settings. I'm Sol w/o the Pw. – brydaverambo Dec 25 '09 at 9:13
feedback
up vote 0 down vote

Keylog yourself. Seriously.

There is free keylogging software available such as Actual Keylogger which you can install on your laptop. You can password protect it so nobody can access the software. When you return home, simply check the logs to see what has been typed. If you do not trust this award winning software, there are open source keyloggers available such as pykeylogger.

The only remote connection to your laptop I could imagine (with your wireless access point being turned off) is a wireless ad-hoc, but even then it requires intervention with your laptop to get it running.

link|improve this answer
Ok, here it is. I tried to load Actual Keylogger. It almost made it. Then up pops the dialog "An error occurred while trying to rename a file in the destination directory: MoveFile failed;code 2. The system cannot find the specified file. Retry,Ignore to skip(not recommended), or abort to cancel install. Norton 360 blocked something called infostealer. The file is aspmonitor\is-159h6.tmp? I went ahead,loaded it, and tried to read the txt file but was blocked by "unknown user"? I wish my puter savvy was more advanced. Yea, student is right! – brydaverambo Dec 25 '09 at 9:45
feedback
up vote 0 down vote

your most important job is to clear and change the CMOS password. protect the system, not only the setup and make it a strong password this time!

if you can still boot from USB (F12), you can try to clear the CMOS password with CmosPwd.

if this doesn't work, you may need professional assistance, although the battery is easily acessible (right next to the memory slot), disconnecting the battery does not clear the password, don't even try.

relying solemnly on the Windows password is not a good idea as it is easy to clear for anyone who can access the boot selection menu.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.