Solved How to know what my friend did by my pc

[baxxter]

Some One used my PC behinde me ,I want to know what does he did with the PC
IS there something like the registry write every act ?

 

[Britton30]

Nothing like that exists but you can find out where they were on the web by searching temp or tmp files. At least you can see what sites were visited. You can also have a look at Control Panel\All Control Panel Items\Programs and Features to see if any new programs were installed and checking you browser for new toolbars.
May be a good time to change or add a password to the computer.
Is there an issue you need help with?

 

[baxxter]

I want to know wich sites he were ,and wich software he installed !
In Control Panel I cant find what softwares he installed if he unistalled it

 

[boohbah]

if you go to control panel / programs and features then set the view to details.



then click at the top where it says "installed on"



then it will give you a window with a calendar



and you can select the day you think anything was installed also you can check the boxes for changes over the week, month etc.
also check the browser history they may have deleted their browsing activity but maybe not,

 

[baxxter]

Thanks for the reply,But i know this way,I meant I want to see wich software he did install them and then unistall them before I back
The jump list doesnt work now ,I think he used Ccleaner

 

[richnrockville]

Thanks for the reply,But i know this way,I meant I want to see wich software he did install them and then unistall them before I back
The jump list doesnt work now ,I think he used Ccleaner

Baxxter, I think your out of luck figuring out what was installed and then uninstalled and ran ccleaner.

One thing is that you can look at the programs directories and maybe the uninstall did not remove the directory that was created when he installed some software.
Just a chance..

As was said earlier, I recommend a password change immediatly.

rich

 

[iRHardcore]

Have you checked your Internet history? That's probably the easiest way to find out what websites he went on, unless he cleared the history.
If he did, just check your 'temp files' like everyone else has suggested.

 

[baxxter]

where do i find this 'temp files'

 

[Tews]

Your best bet IMO would be to do a System Restore to a point before your "friend" started to play with your computer, and change your logon password ... then have a long talk with him about using your computer ....

This will show you how to do a System Restore to restore your Windows 7 system files to an earlier point in time. It's a way to undo system changes to your computer without affecting your personal user files, such as e‑mail, documents, or photos.

System Restore

 

[patio]

I love spies....

 

[Britton30]

where do i find this 'temp files'

Here is the path to some:
C:\Windows\Temp

To check your program directories which may be left over go to:
C:\Program Files (x86)
and
C:\Program Files
Look for files with software names you aren't familiar with or did not install.

In the end there is no way to discover how a PC was used, sites visited, or programs installed/uninstalled after CCleaner is run without a forensic exam of the hard drive. That can cost upwards of $5000 USD.

 

[baxxter]

I know how to use System restore,I only want to know what he did do with my pc

 

[Britton30]

Ask him.

 

[bobkn]

Ask him.

Waterboard him.

 

[legacy7955]

Just some extra advice ....if you are in an environment with other people around your PC or laptop, you need to make sure you keep the settings on a very short timer for the display to turn off, maybe even set it for a minute after the computer is left idle, and have it set for prompt for password upon the display returning to active status.

 

[karlsnooks]

baxxter,

You will never know what he did without spending big, big dollars.

You have received excellent advice to help you spot a few changes here or there and also how to recover back to an earlier time.

The suggestion of asking him would be a manly action for you to take.

For the future,
1. Make sure your log on requires a password,
2. Make sure he didn't create any additional accounts,
3. If you already had a password for your account, then change the password now.
4. In the future, any time you step away from your computer, then use the WIN + L key combo to lock your keyboard.

WIN is the key with the wavy Microsoft flag on top.

For point 2:
Control Panel | User Accounts | click on Manage another account | click on the account you want to change. I strongly recommend that you Disable the Guest account.

 

[mach04]

or you can press the Windows button on the keyboard + L to lock the screen.

 

[jimbo45]

Hi there
simpler solution

1) Back the whole computer up to an external USB disk using a STAND ALONE backup / restore program.
2) Store the disk AWAY from the computer.
3) Let person do whatever he / she / it wants with the PC.
4) Fetch external Disk again
5) Restore computer -- now it will be in an IDENTICAL state to what it was before User touched the machine.

Note STEP 5) must be done with the stand alone backup / restore program.

The number of times I've seen posts on the security section advising people to restore an infected computer using the Windows program itself is amazing --If a computer is infected or if you even THINK it might be how can you trust ANY software running on that machine !!!!!


If the user was using your machine WITHOUT your permission then you either need to secure your machine in a non acessible area or certainly ensure you have an adequate password that's not likely to be easily compromised.

Most sites I have ever worked at require users to LOCK their PC's when away from their desks -- even when going outside the building for a short "Cigarette" break - a diminishing number of countries still allow these !!!!.

If you don't take adequate precautions then it's YOUR funeral.


Cheers
jimbo