Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I came to my computer today and have not been here since monday afternoon. I am using windows 7. There were some error messages showing even on the log in screen about memory violations done by spotify and one more (I can't remember), and I just clicked them away, even though it is not normal on my PC. Sometimes it freezes on the login screen and I have to reboot, but this was different. But I did not take a note of the messages as I just didn't care.

After logging in, I noticed that my Teamviewer client was running (the GUI was showing). I thought this was odd, since I haven't been using it lately. I was a bit curious, so I checked the log. I will not include it here, as I don't know how to read it and I do not know what could identify me. It seems that it was an update leading to this, but I am not sure. Probably, but I don't like the fact that the GUI was showing with my ID and password showing. They could have silently updated it or have given me a message...

So, this leads me to the question: How to figure out if someone has been using TeamViewer 8 to access my computer when I was not here? What to look for in logs and perhaps the Windows 7 event logs? And a bonus Q: Is it safe to have TeamViewer 8 running in the background at all?

share|improve this question
add comment

2 Answers

up vote 9 down vote accepted

Running Teamviewer isn't very secure: read here

To determine who was logged in - look here:

  • C:\Program Files\TeamViewer\VersionX\Connections_incoming.txt
  • C:\Users\XXX\AppData\Roaming\TeamViewer\Connections.txt
share|improve this answer
    
hmm. The first file Connections_incoming.txt is not present at all. Not even when searching for it. The second is there but shows nothing suspicous. Could it be that the file is simply not created, because I have never had an incoming connection (as far as I know)? –  Per-Øivin Andersen May 2 '13 at 12:53
2  
Did you ever had an incoming connection? Afaik the file will be created with the first connect. But remember: the file simply can be deleted from "evil" guys... –  Dr.Ü May 2 '13 at 13:00
    
yeah that was also my though. But I think it unlikely in this case. Thank you for the help :) –  Per-Øivin Andersen May 2 '13 at 13:06
    
@Per-ØivinAndersen You tried looking on Program Files(x86) instead of Program Files? –  JMK May 3 '13 at 11:38
    
yes I have. It is not there but I think it is because I have never had an incoming conn. –  Per-Øivin Andersen May 3 '13 at 13:07
add comment

If you can pull it off one of the best security things you can do with TeamViewer is under the Advanced options change the "connections to this computer" setting from full access to "confirm all". This will require that someone is sitting at the computer in order for TeamViewer to allow any inbound access.

Failing that if you only connect to your computer from one or two remote systems there is a blacklist / whitelist option which you can use to restrict only certain TeamViewer IDs to.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.