Icons appeared on workspace, possible security problem

[polgster]

Hi, we have a user that had a couple of local databases on her C drive that hadn't been used for a number of years and the icons for which have appeared on her workspace without her knowledge. One of which doesn't even sit in her data folder its in an other folder completely on her C drive.

I can't explain how this has happended and the user thinks it maybe someone accessing her PC.

Any help would be appreciated.

 

[pmonett]

If there is a doubt about the security of a user PC, the first thing to do is check for viruses and, more importantly, keyloggers.
Once it is ascertained that the PC is clean (ie any malware has been purged from the system), change the logon password of the OS.
Also, in the Services, it is a good idea to disable the Remote Helpdesk service - unless it is used in your company. Remote Registry is also to be banned, and if you can, disable also the Windows Messenger service.
Finally, have the user change Notes password and invalidate the previous one (use the Password Compromised option)- that way if there is a copy of the ID in the hands of the wrong person, it will become useless.

Pascal.


I've got nothing to hide, and I'd very much like to keep that away from prying eyes.

 

[polgster]

Hi, all of the above is OK and we checked the event viewer and the PC hasn't been touched since she last used it. One of the databases that was added was on her network drive which is only accessible via her active directory sign on (or an administrator) and so it's looking more and more like something unusual has happended as opposed to a security breach but I can't explain the additional icons.

Graham

 

[lhuegele]

Any time I access a database, local or otherwise, it shows up in my workspace. Is she running Notes 7?

Also, it's been my experience in IT that the user is usually unaware that they have done something. If you checked everything pmonett stated above and have confirmed that security hasn't been compromised on her system, then it's far more likely that they showed up because of something the user did, and not that something "unusual" has happend....unless she actually saw them appear in her workspace while she was staring at it, more likely than not that they've been there for some time and she just didn't notice.

Good luck.