My laptop has windows 7 installed.

One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on the laptop started blinking. The lid was closed, and I didn't want to open it because I had a headache.

The fan was on and lights blinking for good half an hour, and then the laptop went back to sleep. In the morning I checked the laptop to see if any files were missing, or if anything was done. But I didn't find any problems.

This got me thinking.

How would you detect if someone has remote access program installed on your computer?

If you have some remote access program, can you wake up the laptop from sleep(which I think is possible since I have seen some programs like logmein.com and such)? And if so would the user be able to tell if the computer is being accessed remotely?

If your computer is being remotely accessed should you nuke it from orbit or can you somehow just remove whatever is allowing your computer to be accessed.

Thanks to anyone for their help and explanation :) I could only find solutions for linux and none for windows.

  • 10
    Microsoft has a 2AM routine for updating your system. You should be able to disable the autoupdate...
    – zedman9991
    Jan 6, 2014 at 15:38
  • 3
    You could disable autoupdate, but you probably shouldn't. Most of the patches it makes are for security reasons. Instead, check your System and Application event logs. They should tell you why it woke up and what it did when it ran. Jan 6, 2014 at 17:38

4 Answers 4


You can check open port lists to see if anything unusual going on. If something looks weird, you can listen "bad port"

Moreover, using some tool like processHacker, you can see what are each and every process is doing.

Coming back to your question, booting up a pc remotly, or awaking it from sleep, is not impossible probably, BUT I would say it is pretty hard. Especially booting it up. Even when sleeping, pc should be listening on some port so that remote attacker could send packets to wake it up. Since it is listening for an input from keyboard, it is probably doable, but pretty hard I -only- assume.

And booting it up is even harder since it wont be listening on anything at that time. But there might be a device pluged in to the USB or whatsoever.

Either way, listening on ports and watching process would help you to catch any malware/virus. Do not forget that, your pc might also have became a zombie which sends packets outside (zombie virus could wake the PC up also), so listen both incoming and outgoing packets.

Edit: Oh btw, a virus might also boot up your computer at a certain time. However this isn't done remotely. Just like Windows' update policy (which makes you pc boot up at 3 am, check for updates, if any, installs them and shuts down). A virus could also do the same thing and connect to the remote master server.

TLDR; Everything is possible.

  • 2
    Unless it is set to wake up to receive commands from a controller ...
    – schroeder
    Jan 6, 2014 at 15:53
  • which would be some sort of zombie virus as I have mentioned in final paragraph..
    – cengizUzun
    Jan 6, 2014 at 15:54
  • 7
    – schroeder
    Jan 6, 2014 at 15:59
  • 3
    schroeder's right, wake on lan is easy - it's on by default on a lot of motherboards, and lots of routers have built in wake-on-lan features allowing someone to send the magic packet if they log on to your router. Bios alarms would also allow you to wake it up if they had a way to set it.
    – pacifist
    Jan 6, 2014 at 23:57
  • 1
    @schroeder is quite right. And again the magic packet could be catched by listening the traffic at the ports.
    – cengizUzun
    Jan 7, 2014 at 13:06

If your computer is being remotely accessed, you have no idea how deep the infection goes. Nuke from orbit is the only way to go.

As for detecting remote access programs, there are offline scanners you can run from many vendors that look for known remote access malware. But, of course, that only covers known malware.

You can listen on ports and list processes, but malware can also be time-based and only run at certain times or when certain event occur. Malware can also attach to existing legitimate processes, so that they look completely normal.

  • Nuke from orbit, and flash your bios and HDD. ;) Oct 30, 2015 at 1:01

It's most likely this was just automatic updates I think...

That said, it would be possible that someone woke your computer (with wake on lan) provided they had control of your router or another computer on your lan (wake on lan works at the MAC frame level, i.e. level 2, so it won't work over the internet).

That being the case, most things are fallible. Run a virus-scan. Run another one in a week to mop up (by which time the vendors should be up-to date on the wider spread viruses we had this week if they couldn't already see 'em).

If you still think you're owned, you'll need to reformat.

If you still think you're owned after that, they're either getting at your from a vulnerability left open... or you'll need a new computer because they've affected firmware (think graphics card or bios); at the moment the firmware angle is still only proven possible so far, but not really seen in the wild.


This probably is not applicable to your specific situation, but is relevant for the more general question.

If you have a second computer, and are able to sniff the traffic coming off of the computer you have doubts about, then you might be able to determine if the system is compromised by watching that traffic. Going into analyzing that traffic is far beyond the scope of an answer here (but there are open source tools such as SNORT (www.snort.org) which can help identify traffic produced by compromised systems). A simple (but my no means conclusive) test is to see if there is any traffic that you sniff, but no accompanying process that is visible via netstat. That is a common indicator of a system being taken over.

Scanning with an installed anti-malware solution on a compromised machine is unreliable as the compromise can hide from the scanning engine with hooks into the OS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .