2

For weeks now there's been someone on the company network that thinks it's funny to shut down my computer remotely. All I can say is thank GOD for file recovery otherwise I'd have lost 3 projects worth of code by now.

At this point, I'd like to be able to trace the shutdown request back to it's source, terminate the shutdown request after it's been executed, or completely block all incoming requests on my firewall (except from applications like Outlook, and web browsers), while allowing outgoing requests to pass through at the same time.

At one stage 3 weeks ago, I'd been convinced it was a virus or something and couldn't find any infections, so I re-installed my computer completely... The guy who'd been hassling me then owned up, and, to my knowledge, hasn't done it again (he's still my prime suspect though, but I can't prove anything).

Any suggestions will be greatly appreciated.

2
  • 2
    This isn't a technical problem. It's a mangement / "people" problem. Jul 19, 2010 at 14:41
  • +1 Evan. Though proving which person is the problem may involve some technical evidence gathering. Jul 19, 2010 at 20:58

4 Answers 4

1

This Microsoft article may help you track the shutdown event:

2
  • Thanks :) I've also enabled this one... Definitely gonna throw my net as wide as possible to catch the issue here... I suppose revenge hacking the culprit would be a questionable thing to do considering the nature of this thread... Jul 19, 2010 at 13:50
  • The information in this article has allowed me to directly control whether or not my pc shuts down. It doesn't solve the problem of tracking who ordered the shut down, but it does let me stop it. Jul 26, 2010 at 8:38
8

Suggestions:

  1. Contact your IT department.
    If you don't have one, contact the consultant firm you use to configure your computers.
    If you don't have one, find a good one.

  2. Implement some sort of security. This guy obviously has admin access to your machine. I suspect that either you have no security at all, or everyone is a local admin of your computer. These are both really bad security practices, and depending on what data you have on your computer might be criminally negligent.

    Start by taking everyone out of your Local Admin group. Then he wont be able to shutdown the machine even if he can send the request. If you need whoever is at the computer to be an admin (usually because of some god-forsaken legacy application), add the "Interactive User" to the local admin group; it still blocks him, and allows the local person admin access.

  3. Turn the Windows Firewall on, it's in the Control Panel. Under the exceptions tab make sure file and print sharing isn't turned on. If you have a IT person talk to them about what settings are necessary. File and Print sharing is not typically necessary. If they don't really know what they're doing you might want to just turn if off anyway, and if they notice it's turned off, you can switch it back on; but it's really common for impromptu admins to have systems irresponsibly wide open for absolutely no reason.

  4. It may well be a virus, your co-worker could be harassing you and just taking the credit. If you don't have a good MS updating and virus control system in place it's likely. Make sure you are completely up to date with Microsoft Update (unless the updates break some legacy application). Also be sure you're running a good anti-virus. The free ones on the net, are good enough to make sure you're aware of any problems (though I wouldn't trust them to completely prevent problems in the first place). The good commercial AV packages are probably less expensive compared to the downtime you've already experienced (if this is a virus).

4
  • plus one...way better than my answer. I did not consider the possibility of malware.
    – cop1152
    Jul 19, 2010 at 12:50
  • I'm a member of the IT Department. As such I have admin rights (granted by the domain controller) to all computers in the company. The only other people I know of that also have admin rights are the other guys in the IT dept (one of them is the guy who was hassling me last time). Windows Firewall is on. I've actually just set it to not allow exceptions. I've also disabled remote admin on my computer with netsh firewall set service RemoteAdmin Disable, but my pc can still be shut down remotely. Jul 19, 2010 at 13:32
  • Just a side note... We don't get enough work to keep us all busy in IT anymore, so we do play jokes like this on occasion... just today I turned off a mate's Themes service for a laugh... He still thinks there's a problem on his box, but this shut down gag has been going on for at least a month now... Jul 19, 2010 at 13:42
  • I agreee with Evan Anderson: this is now a Personnel problem. Your IT department needs to have a few guidelines as to what is "funny" and what is "hostile." Changing the Internet Explorer link on the desktop to play an amusing .wav file really loud instead of opening IE is funny. Causing someone to lose work is not.
    – Jesse
    Jul 19, 2010 at 15:12
2

I think there are many solutions to this problem. Instead of blocking all incoming connections, which will probably hinder your work, try to see what port he is connecting on.

YOu can easily configure Windows Firewall to create a logfile to help with this.

Open your Local Area Connection properties, click the advanced tab, then click settings. CLick the advance tab there, then under Security Logging, click settings.

I log both dropped packets and successful connections and save the file to my desktop. It will update constantly. Once your machine is tampered with again, you should have some information in that log file that will help you.

Once the issue is resolved, change all of your passwords and tighten down your antivirus. Most AV software offers the ability to set custom rules for firewall traffic.

2
  • I like this suggestion. I've done it and hopefully next time it happens, I'll be able to see who did it. It's a start at least :) thanks Jul 19, 2010 at 13:38
  • What version of Windows are these instructions for? On 7, 8, 10, this is configured from the Windows Firewall with advanced security MMC snap-in, not the network connection properties. Sep 9, 2015 at 9:22
2

Assuming your company is big enough to have one, this needs to be reported to your IT department immediately. If someone on your network is doing that then they need to be stopped and possibly warned/sacked for abusing their admin privilege or hacking to get admin privilege they should not have. Also it may be that your machine has picked up some malicious code that is doing it rather than another local human in which case that needs fixing ASAP.

1
  • Antivirus reports clean... online scans with Panda, MS Malicious Software Removal Tool, Windows Defender, Kaspersky, Norton, AVG and Avast... all using the latest definitions. I ran all these before re-installing Windows about a week ago. I haven't received any "odd" emails and I've only been to websites I know and trust so I'm 99% sure it's someone on the network... Jul 19, 2010 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .