Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My laptop has windows 7 installed.

One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on the laptop started blinking. The lid was closed, and I didn't want to open it because I had a headache.

The fan was on and lights blinking for good half an hour, and then the laptop went back to sleep. In the morning I checked the laptop to see if any files were missing, or if anything was done. But I didn't find any problems.

This got me thinking.

How would you detect if someone has remote access program installed on your computer?

If you have some remote access program, can you wake up the laptop from sleep(which I think is possible since I have seen some programs like logmein.com and such)? And if so would the user be able to tell if the computer is being accessed remotely?

If your computer is being remotely accessed should you nuke it from orbit or can you somehow just remove whatever is allowing your computer to be accessed.

Thanks to anyone for their help and explanation :) I could only find solutions for linux and none for windows.

share|improve this question
5  
Microsoft has a 2AM routine for updating your system. You should be able to disable the autoupdate... –  zedman9991 Jan 6 at 15:38
1  
You could disable autoupdate, but you probably shouldn't. Most of the patches it makes are for security reasons. Instead, check your System and Application event logs. They should tell you why it woke up and what it did when it ran. –  John Deters Jan 6 at 17:38

3 Answers 3

up vote 1 down vote accepted

You can check open port lists to see if anything unusual going on. If something looks weird, you can listen "bad port"

Moreover, using some tool like processHacker, you can see what are each and every process is doing.

Coming back to your question, booting up a pc remotly, or awaking it from sleep, is not impossible probably, BUT I would say it is pretty hard. Especially booting it up. Even when sleeping, pc should be listening on some port so that remote attacker could send packets to wake it up. Since it is listening for an input from keyboard, it is probably doable, but pretty hard I -only- assume.

And booting it up is even harder since it wont be listening on anything at that time. But there might be a device pluged in to the USB or whatsoever.

Either way, listening on ports and watching process would help you to catch any malware/virus. Do not forget that, your pc might also have became a zombie which sends packets outside (zombie virus could wake the PC up also), so listen both incoming and outgoing packets.

TLDR; Everything is possible.

share|improve this answer
    
Unless it is set to wake up to receive commands from a controller ... –  schroeder Jan 6 at 15:53
    
which would be some sort of zombie virus as I have mentioned in final paragraph.. –  cengizUzun Jan 6 at 15:54
5  
    
schroeder's right, wake on lan is easy - it's on by default on a lot of motherboards, and lots of routers have built in wake-on-lan features allowing someone to send the magic packet if they log on to your router. Bios alarms would also allow you to wake it up if they had a way to set it. –  pacifist Jan 6 at 23:57
    
@schroeder is quite right. And again the magic packet could be catched by listening the traffic at the ports. –  cengizUzun Jan 7 at 13:06

If your computer is being remotely accessed, you have no idea how deep the infection goes. Nuke from orbit is the only way to go.

As for detecting remote access programs, there are offline scanners you can run from many vendors that look for known remote access malware. But, of course, that only covers known malware.

You can listen on ports and list processes, but malware can also be time-based and only run at certain times or when certain event occur. Malware can also attach to existing legitimate processes, so that they look completely normal.

share|improve this answer

It's most likely this was just automatic updates I think...

That said, it would be possible that someone woke your computer (with wake on lan) provided they had control of your router or another computer on your lan (wake on lan works at the MAC frame level, i.e. level 2, so it won't work over the internet).

That being the case, most things are fallible. Run a virus-scan. Run another one in a week to mop up (by which time the vendors should be up-to date on the wider spread viruses we had this week if they couldn't already see 'em).

If you still think you're owned, you'll need to reformat.

If you still think you're owned after that, they're either getting at your from a vulnerability left open... or you'll need a new computer because they've affected firmware (think graphics card or bios); at the moment the firmware angle is still only proven possible so far, but not really seen in the wild.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.