[bogha]

hi,

i have a strange problem

in our company we have a domain, for our bad luck the CEO computer has been hacked, or the CEO said this.

i checked his computer , the remote access was disabled so no body can access it, but he said that he left his computer opened and nobody access it then when he came back he found alot of files and folders opened which as he said he didn't.

are there any way to access the computer remotly even if it's disabled in the attacked computer.
how to track which user access a certain pc becouse i couldn't determined it from the event log.

[zabusant]

Hi!

You would probably get more advice if you posted this in the "general security" section of the forum. (if you want to move it, you can use the "report" link on the bottom of a post and ask for it to be moved).

As for your problem, it's really difficult to say since you haven't really given much information (and since I'm not an expert on the matter ) - details about your network setup, how many people share the network, firewall software being used, antimalware software being used, what kind of files were open, has he recently been using the files, has this happened before/again,...

But generally, I would say it's a lot more likely that your boss either misclicked something (like opening multiple files by mistake by holding ctrl, which could have happened with a delay - depending on the computer specs) or someone had physical access to the PC. I mean, even if you were to access files remotely from another PC, why would they be open on your bosses PC?

[cybertech]

The CEO should have his computer looked at by his company IT department.

[lunarlander]

It may not be remote access, because you say the CEO found multiple files and folder opened. Remote command prompt access would not have left visible opened folders on a desktop. The attacker with a remote command prompt access would have simply copied away all the files and left little trace.

My guess is that someone has physical access to that PC. Physical security is important and part of IT security. Lock the office door when you're gone. And install security pass card readers for important sections of the office. etc. That way, those who have permission to physically access somewhere would leave a trace in some security log.