Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I came to my computer today and have not been here since monday afternoon. I am using windows 7. There were some error messages showing even on the log in screen about memory violations done by spotify and one more (I can't remember), and I just clicked them away, even though it is not normal on my PC. Sometimes it freezes on the login screen and I have to reboot, but this was different. But I did not take a note of the messages as I just didn't care.

After logging in, I noticed that my Teamviewer client was running (the GUI was showing). I thought this was odd, since I haven't been using it lately. I was a bit curious, so I checked the log. I will not include it here, as I don't know how to read it and I do not know what could identify me. It seems that it was an update leading to this, but I am not sure. Probably, but I don't like the fact that the GUI was showing with my ID and password showing. They could have silently updated it or have given me a message...

So, this leads me to the question: How to figure out if someone has been using TeamViewer 8 to access my computer when I was not here? What to look for in logs and perhaps the Windows 7 event logs? And a bonus Q: Is it safe to have TeamViewer 8 running in the background at all?

share|improve this question
If you can pull it off one of the best security things you can do with TeamViewer is under the Advanced options change the "connections to this computer" setting from full access to "confirm all". This will require that someone is sitting at the computer in order for TeamViewer to allow any inbound access. Failing that if you only connect to your computer from one or two remote systems there is a blacklist / whitelist option which you can use to restrict only certain TeamViewer IDs to. – Tim Brigham May 2 '13 at 13:25
up vote 24 down vote accepted

Running Teamviewer isn't very secure: read here

To determine who was logged in - look here:

  • C:\Program Files\TeamViewer\VersionX\Connections_incoming.txt
  • C:\Users\XXX\AppData\Roaming\TeamViewer\Connections.txt
share|improve this answer
hmm. The first file Connections_incoming.txt is not present at all. Not even when searching for it. The second is there but shows nothing suspicous. Could it be that the file is simply not created, because I have never had an incoming connection (as far as I know)? – Piddien May 2 '13 at 12:53
Did you ever had an incoming connection? Afaik the file will be created with the first connect. But remember: the file simply can be deleted from "evil" guys... – Dr.Ü May 2 '13 at 13:00
yeah that was also my though. But I think it unlikely in this case. Thank you for the help :) – Piddien May 2 '13 at 13:06
@Per-ØivinAndersen You tried looking on Program Files(x86) instead of Program Files? – JMK May 3 '13 at 11:38
yes I have. It is not there but I think it is because I have never had an incoming conn. – Piddien May 3 '13 at 13:07

In teamviewer 10 you can check the following files:

C:\Program Files\TeamViewer\Connections_incoming.txt

C:\Program Files\TeamViewer\TeamViewer10_Logfile.log

First one provides details about the incoming connections. Second one provides details of the actions performed

share|improve this answer

protected by Community Nov 22 '15 at 21:25

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.