You could check installed apps or programs to see if any remote access software has been installed.
If you open the run command and enter netplwiz [press return] does it show any users other than yourself.
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I've experienced today a control takeover on my pc as i was doing my business, the hacker started typing chinese, opened a lot of windows, used the mouse. I've shut down the pc immediately and deactivated the WIFI. I've ran anti-malware scans but nothing to report here. I've digged into the event observer and with some internet articles, managed to find myself in the TerminalService - LocalSessionManager and discovered that a "defaultuser100000", a few minutes before the attack, launched the distant desktop service as i've undertood what i've read. See more here :
</Event>
As it's not my username and my actual username appears clearly on other logs, i'm genuinely asking myself if i've spotted the guy. But something weird aswell is that it seems like at the PC start, a distant desktop session is opening ( i traduce from french but i read "Remote Desktop Services: successful login :" and "Remote Desktop Services: kernel startup notification received :" from my own username.
To sum up, i'm not suspecting a malware, it's there for sure but i would urgently need to know how to block any future remote access from the hacker. Thanks a lot!
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
You could check installed apps or programs to see if any remote access software has been installed.
If you open the run command and enter netplwiz [press return] does it show any users other than yourself.
When you carried out a antimalware scan did you use Cyber Security Software and Anti-Malware | Malwarebytes if not download and carry out a scan.
Open Settings > System and select Advanced system settings (right hand pane under Related settings) Select the Advanced tab then User profiles and see what is listed. The first two are normal.
Also select the Remote tab and uncheck Allow remote Assistance connection.
To be honest the only way to be absolutely sure will be to clean install windows deleting all data on the internal drive.
Thanks for your response. I just see myself conneted right now. But how to tell if this or that software isn't mimicking an official one ? And how to tell if x program has remote access permissions ? I have to say it's kinda scary to know that someone could get back to my session at anytime... :/
Unless you have installed remote access software yourself there shouldn't be any installed.
Go to Apps and Features (right click start and it's at the top) then change the order to Date installed. Do you see anything unusual. If you wish you can take a screenshot and post it in your reply so it can be checked.
Or list what you see.
hi
sorry for my intervention as i dont have experience in these things and i hope that your problem is solved by now!
your problem and this page popped-up on google while i was searching for protection over remotely access..
my question is , if i will need remotely assistants from someone over internet (OBD2 coding intervention that requires over internet remote access cession using windows10....
how can i protect my personale files from being accessed or hacked , etc?
is there is a way?
sorry again for the irrelative subject.
cheers
Ramban