Here is the path to some:
C:\Windows\Temp
To check your program directories which may be left over go to:
C:\Program Files (x86)
and
C:\Program Files
Look for files with software names you aren't familiar with or did not install.
In the end there is no way to discover how a PC was used, sites visited, or programs installed/uninstalled after CCleaner is run without a forensic exam of the hard drive. That can cost upwards of $5000 USD.
I know how to use System restore,I only want to know what he did do with my pc
Just some extra advice ....if you are in an environment with other people around your PC or laptop, you need to make sure you keep the settings on a very short timer for the display to turn off, maybe even set it for a minute after the computer is left idle, and have it set for prompt for password upon the display returning to active status.
baxxter,
You will never know what he did without spending big, big dollars.
You have received excellent advice to help you spot a few changes here or there and also how to recover back to an earlier time.
The suggestion of asking him would be a manly action for you to take.
For the future,
1. Make sure your log on requires a password,
2. Make sure he didn't create any additional accounts,
3. If you already had a password for your account, then change the password now.
4. In the future, any time you step away from your computer, then use the WIN + L key combo to lock your keyboard.
WIN is the key with the wavy Microsoft flag on top.
For point 2:
Control Panel | User Accounts | click on Manage another account | click on the account you want to change. I strongly recommend that you Disable the Guest account.
or you can press the Windows button on the keyboard + L to lock the screen.
Hi there
simpler solution
1) Back the whole computer up to an external USB disk using a STAND ALONE backup / restore program.
2) Store the disk AWAY from the computer.
3) Let person do whatever he / she / it wants with the PC.
4) Fetch external Disk again
5) Restore computer -- now it will be in an IDENTICAL state to what it was before User touched the machine.
Note STEP 5) must be done with the stand alone backup / restore program.
The number of times I've seen posts on the security section advising people to restore an infected computer using the Windows program itself is amazing --If a computer is infected or if you even THINK it might be how can you trust ANY software running on that machine !!!!!
If the user was using your machine WITHOUT your permission then you either need to secure your machine in a non acessible area or certainly ensure you have an adequate password that's not likely to be easily compromised.
Most sites I have ever worked at require users to LOCK their PC's when away from their desks -- even when going outside the building for a short "Cigarette" break - a diminishing number of countries still allow these !!!!.
If you don't take adequate precautions then it's YOUR funeral.
Cheers
jimbo
Quote