[gaftop1]

this is a friends d6000 hp laptop that is new with vista and a wireless lynksys modem with roadrunner.
she emailed me complaining about crashes and said she watched a bunch of files leave via bluetooth and she didn't understand it. she thought somebody was remotely accessing her computer. she took it to somebody that investigates his work computers or something.
this is the email she sent me.
i went into user accounts all that was there were her as admin and disabled guest. don't know if her modem is locked or not.
what do you think? any suggestions?

> my computer had been sharing files with an unknown
> user account. I did see where somehow a remote
> user/device was accessing me and in turn they were
> uploading my personal info and the security settings
> had been changed. I was unable to change the settings
> myself. Here are some of the users I found who had
> gained access (REMOTE, PRINTER, user, users,
> administrators, Cynthia/administrator, DIAL UP, POWER
> USER, GUESTS, OWNER, OWnER/POWER USER,) to name some.
> The POWER USER AND OWNER had full control of
> everything. A Bluetooth device was also located which
> had file sharing and CPU to CPU sharing properties, I
> didn't find this info myself my friend did.

[lunarlander]

Can she clarify how she saw that people were uploading personal info? That is, what command did she use to find that out?

[gaftop1]

she told me that a blue tooth icon or program or something identifying blue tooth came on and she watched files leave like when downloading, the folders moving across. what did the hotshot computer wiz see to tell her about power users and the like. what's a power user? wouldn't it be listed in the user accounts. where did they find a record of access of the power user.
i can't call her and she lives a couple of hundred miles away., only contact is by email.
did they find something that said the computer was capable of doing the power user stuff. but wasn't actually doing anything. if somebody was actually doing something wouldn't they cover their tracks?
i'm pretty much lost and can't understand why anybody would actually go after any information she might have.

[lunarlander]

Bluetooth effective range is about 32 feet, so whoever is doing it is within sight.

Power User is a built in user group that by default has no members. Go to Administrative Tools / Computer Management. Then Local Users and Groups/ Groups and double click on the Power Users Group to see its member user accounts. If there are indeed members of that group then she's in trouble.