I’m posting this message because I think that someone may have broken into my apartment today and hacked into my computer. My main evidence: entries in the Win XP Pro Event Viewer –> System log file that occurred when I wasn’t here.
I’d like users who know more than I do about Event Viewer to tell me if:
a) I have good reason for being very suspicious of System log file entries that occurred when no one should have been here.
or
b) I’m getting upset about nothing, and there’s another reasonable explanation for the log file entries.
The essential facts:
I do my computing in a home office environment. No one else uses this computer except me.
I was out of the home office today, and many people knew that I would be out.
Because of a video card problem I’ve had for the past month, I log out of the computer, rather than shut it down, when it’s not in use. That’s what I did when I left this morning.
Also, when I left this morning, as I often do, I left a small radio on, for security reasons.
Fast forward to this afternoon. I return to the apartment, and surprise! The radio’s off.
“Gee, that’s funny,” I thought. “I could have just sworn I left it on. Huh! Maybe I didn’t after all.”
I went to the desk. The desk chair seemed to be in a different position than usual. That struck me as odd, too.
“Tim,” I figured, “you’re probably getting worried about absolutely nothing. But if it’s really bothering me, why not just go into Event Viewer and check the log files? That will reassure me that nothing is amiss.”
So, I loaded Administrative Tools, went to Event Viewer, and checked the System logs.
To make a long story short:
All entries in the System log for the past few weeks perfectly mirror my time at the computer. The only activity shown occurred when I was here.
But today — and only today, so far as I can tell — System log entries occurred when I WASN’T here.
All of the suspicious event log entries were for the Google Software Updater service. I don’t mind Google handling updates behind the scenes — but when I’m logged out, and the cable modem is off?! How, I wonder, could I see entries for:
‘The Google Software Updater service entered the running state.’
and
‘The Google Software Updater service entered the stopped state.’
… when the box is logged out, the modem is off, and no one is here?
I’ll emphasize: so far as I can tell, these are the only entries that have occurred in the log file when I wasn’t here doing things at the computer.
Folks, I’m hardly an expert on Windows XP, on Win XP security or on the Event Viewer. If there’s another reason that these log entries could have occurred when the computer was logged out and no one was here, please do tell me so. I’ll heave a deep sigh of relief and chalk the whole thing up to paranoia.
But if there’s no reasonable explanation for those log entries, well, I gotta know that too.
For those who check many message boards: I posted a similar message in Experts Exchange.
Thanks in advance.
