Eek! Identity Crisis!

[Griffin NoName]

Got a message a while ago:

Other people are logged on to this computer. Shutting down Windows might cause them to lose data.

I remember thinking I'd check it out - in case I'd developed multiple personality disorder. Then I must have forgotten all about it.

Just been fishing around in Event Log. The entire Security Event Log is empty. And security event logging must have been switched off as it certainly isn't logging anything as usual.

How do I find out who I am ?

[Sibling Zono (anon1mat0)]

Do you have a home network? That message is usually due to one of these:
- You have more than one profile and someone logged in (ie, in our house we have 3 profiles in each computer, one for me one for my wife and one for my son, sometimes my son logs in and doesn't logout from his profile and I get the message while shutting down).
- You have a shared folder in your computer and other computer on your network is accessing files from that folder. A typical case is having movies, songs or pictures in a shared folder to access them remotely (within your network) to watch/listen them.

If that's not the case, more questions come to mind.
- Do you have a wireless router? Is it secured? If someone connects to your wifi (s)he can potentially read any shared folder in your network.
- Have you installed a program recently? Some programs may run under a different user than the one logged in and keep certain files open. A way to tell is opening the task manager (right click on the task bar and select task manager), select the processes tab and mark the Show processes from all users checkbox (for more about locked files look my post on the Arghh cannot delete file thread).

[Griffin NoName]

Thanks Zono, but no, none of those.

The only possible access is Me (and I do have several profiles but they are all secure and I never normally use them, they are decoys LOL!), a hacker, or a trojan. I have ruled out a Trojan unless they withdrew the horse after the event. Also, if there were a program installer running under a different "user" I'd know about it because it would have had to ask me.

I've done a bit more rummaging and I think the empty securty event log is a red herring. Looks like auditing never got swicthed back on after I had a new disc and migrated from W2K to XP.

My best guess is I fell foul of one of my own decoys !