What was the purpose of this attack if one took place?

Question

Background

• Windows 7 Home Edition HP desktop (no av/no firewall/ remote assistance enabled)

• two external drives attached/no documents on internal drive connected to fios wifi (wep protection/standard logon un:Admin pw:Serial Number)

• Visited a maximum of 5 webpages then downloaded recuva from cnet download

• left recuva running and computer idle/unattended connected to wifi for ~40 day (due to travel/forgetting to turn it off)

• when I woke the computer and the screen came on, the only not password secured user profile was on the screen

• Note: My typical way of waking the monitor is by button mashing, but in 8 years I never accidentally logged in as anyone else doing so, but it is possible, I replicated it, but I was trying

• new Vz In Home Agent shortcut was on the desktop and installed 20 days into the idle period

• Windows Defender logged activity every day except the day of the VZ install (the event #'s don't skip, but there was no activity logged, if that means anything)

• I'm not a value added target

• Windows Event Viewer shows my user name (first name as the user name, 9 character lowercase password) logged in several times [Terminal Services: Remote Desktop session started/Explicit Credentials Used/Types 2/3/7] note: many of these "remote" logons were logged before I ever connected to the internet

• Using Windows Event Viewer I found that the no-password user profile (not guest, it was my fathers profile) logged in for the first time since internet connection 10 days after VZ was installed, I checked this date in my basic system log on my router GUI and found no foreign IP's except this 10 minutes before login(logged several times per day/then a new ip took its place/I'm assuming this is verizon): DHCP WAN connection IP:xxxxxxxx,DNS:68.237.161.12 71.243.0.12 ,GTW:xxxxxxx,Subnet:255.255.255.0 (WAN MoCA)

• Since then I've changed everything possible, upgraded to wpa2, disabled remote assistance, unplug after use.

• I'm the only person with physical access

• I don't have any "nudes" (and I'm a male) but I'm sure I have something that someone would deem embarrassing i.e. drunk mumble video or something stupid like that (as do most people)

• The computer's connection to the internet is through the Fios wifi (actiontec MI424WR/default settings) [I see no failed logon attempts besides what are confirmed mine.]

Questions:

1. Based on the above circumstances, what level of expertise in attacking would be required to access the documents stored on the external drives by anyone other than me, without being physically present?

a. Based on the most common up-to-date stats on computer attacks by this level of attacker, assuming the most statistically probable scenario, would the documents in the external drives on the aforementioned network have been compromised?

2 Is it possible for the aforementioned events to occur as they did, without the machine/network* being attacked and/or compromised?

a. If yes: Would it be a rarity, common occurrence, or in-between?

3 Assuming the machine/network* was attacked, are the aforementioned symptoms statistically indicative of a certain type of attack(s)?

a. If yes: Based on the most statistically common rationales of said attack(s), what would the probability(High/Medium/Low) be of the documents in the aforementioned scenario having been compromised?

4 If the machine in the aforementioned scenario was compromised, in the most probable scenario would evidence of this have been on the router's system logging at some point?

a. If yes: How probable, based on the statistics of the most common scenarios combined with the above information, would it be that evidence still can be found?

i. If medium or high probability: Can you, based on general information security knowledge as well as an up to date understanding of computer attackers' common operation, tell me three tale tale signs that would commonly be present?

Thanks in advance.

*My understanding is that the network serves as a first defense to my machine, if there is a way for the machine in question to have been attacked by someone/thing not physically present and without going through my router, please add this as a comment so I can adjust my questions accordingly. I included both "network" and "machine" in my questions to include scenarios where the network may have been the direct target of the attack, and the machine suffered indirect damage/a subsequent attack due to the effects of the first network directed attack. Thank you. This is not remotely opinion based.

Answer 1

David, the problem is that unless you had logging implemented, and in a location an attacker could not find/alter, anything could have happened.

An attacker could have come in for a play around, explored, read everything on the machine, decided to maliciously alter key information, install timebombs, use your machine as part of a botnet, gather any passwords for sites you may have visited... anything, really, and you have no way of knowing, without logs.

In short, consider that machine compromised - forget about probable scenarios, and assume the worst. Wipe the machine, reinstall from known good media, change all passwords etc.