Can you explain this mystery?

[Marty McFly]

I was using the computer the other day, went in the other room for a few minutes, and when I came back, ALL my open windows had been shut down, so I was just looking at the Desktop. Folder windows had been shut down, a couple of media tracks had been shut down. I even had a text file I was in the middle of writing (Notepad2) - this had never been saved and normally if you shut down an unsaved text file it will ALWAYS ask you if you want to save it. But this had just completely vanished without trace.

In all my years using Win7, nothing like this has ever happened before. Can anyone explain it? I have wondered if my machine is compromised, could this be evidence of that?

 

[Alejandro85]

Without any further information is pretty much impossible to know what happened, but here are my best guesses:

• Windows Update: If you have automatic updates enabled (generally a bad idea) an update may have arrived and installed. Windows then may have decided (all without your knowledge or consent) that it must reboot the computer, so it did "whenever it's convenient for you". The result of it, if you have autologin enabled or no password on your account, is an empty desktop and all your environment lost. You can check this in the "installed updated" section of control panel.
• BSOD: It may happen that BSOD while you're away. Depending on your system settings it can reboot itself after a while and leave you on an empty desktop again (otherwise leaving you on the blue screen). If that's the case, you may find evidence of it by checking the BSOD logs with a proper program.
• Power fault: A small power interruption may cause a reboot if it's short enough. A longer one would cause an abrupt shutdown.
• Someone else rebooted or closed everything: The simplest explanation is that some other person just grabbed your keyboard and either rebooted or closed your windows, very possible if someone else has physical access to the computer. Just ask around

I have wondered if my machine is compromised, could this be evidence of that?

It's a possibility, but a really long shot. Viruses these days are more interested in stealing something from you or taking control of your computing resources, but almost always want to stay undetected. Since closing programs or rebooting is a very noticeable activity, I think it's unlikely for a malware to do that (and you already raised an alarm about it). But strictly speaking, it's not impossible for a bored hacker to do a virus for rebooting your PC.

 

[Marty McFly]

Thanks for the answer.

 

[flavallee]

My guess is the last of the 4 possibilities that was mentioned.
But the first is a possibility.

 

[lukewt1017]

Without any further information is pretty much impossible to know what happened, but here are my best guesses:

• Windows Update: If you have automatic updates enabled (generally a bad idea) an update may have arrived and installed. Windows then may have decided (all without your knowledge or consent) that it must reboot the computer, so it did "whenever it's convenient for you". The result of it, if you have autologin enabled or no password on your account, is an empty desktop and all your environment lost. You can check this in the "installed updated" section of control panel.

The only way this could've happened is if there was only 1 user account with no password on this computer.

- - - Updated - - -

So, do you only have 1 user account with no password enabled? If so, this could be the reason.

 

[Alejandro85]

[/LIST]
The only way this could've happened is if there was only 1 user account with no password on this computer.

Yes, I agree, otherwise the computer would have left in the login screen. Also applies to the BSOD and power fault options I mentioned too.
Unfortunately for home computers this is a pretty common setup to have no password and just the default user account, so I think it's still a likely possibility.

 

[lukewt1017]

Unfortunately for home computers this is a pretty common setup to have no password and just the default user account, so I think it's still a likely possibility.

Not if you live with kids and it's the parent's home computer! :roflmao: