Security

[vernod]

I have a Toshiba laptop with Windows XP Professional. One night, I left my laptop on so I could download a few things (I just close my lid and the broadband connection remains on – when the lid is opened, there is no requirement to enter a password to log on or anything like that).

I was out of the office for a few days. But during that time, someone tried to access my laptop to print a document by inserting a pen drive into the USB port. He later claimed to a colleague that he could not access the laptop because it prompted him for a password, which is not possible normally since I did not password protect the computer when opening the lid. However, I went through the Event Viewer and noticed that Windows had downloaded and installed a security update the same night I left it on. Apparently, this required a system restart.

I thought I was lucky, because normally if the system is restarted, it will ask for a password to log on. However, when I looked at the Event Viewer in closer detail, I noticed that Windows Defender still conducted the daily scans even after the restart and when I looked at my AVG Antivirus log, it showed that the daily scheduled scans occurred even after the apparent system restart.

My questions are as follows:

1. When Windows initiates a restart, would it go to the screen where it asks me for my password or for a restart due to installation of a security update, does it take you directly to the desktop without asking for a log in password?

2. If it does ask for the password before logging in, then how can Windows Defender and AVG still run if not logged in? When I got back, I tried restarting my laptop moments before the scheduled daily AVG scan and just left the screen at the place where it prompts for the log in password (I did not enter it though). Then, after 20 minutes, I entered my password to log in to see if AVG had initiated and it turns out that it had not. Which leads me to believe that after the system was restarted due to the Windows security update, it automatically logged my back in without a password, and that is the only way AVG and Windows Defender could have run after that. If that is the case, I am worried about someone accessing my files and/or placing malicious software. I had run AVG antispyware and Panda Activescan after the incident, but it did not find anything. However, a few days later, I downloaded Spyware Doctor and it found Trojan-PWS.OnlineGames.KW which made me even more nervous.

Do I have anything to worry about?

[-pops-]

Anyone accessing any of my machines without my explicit permission has a very short life expectancy. Remember also that pen drives can easily wreck USB ports (and/or themselves) if not used correctly. This alone would make me think twice about permitting this.

Laptop machines are designed to be portable. I don't have one myself but, if I did, I would never leave it so that someone else has access to it - apart from the danger of theft.

As a general point, arrange that Windows updates are NOT automatically downloaded, just let it notify you of them. That way it is you who decides when (or if) you need the update (some you may not require or choose not to have). Doing this will prevent Microsoft surreptitiously altering what may be important settings you have on the machine.

[vernod]

Yes, I agree. It was a stupid mistake. But unfortunately, it happened. Would appreciate any advice regarding the 2 questions I had.......

Thanks!

Vern

[ɹəuəllıʍ ʇɐb]

It depends how you have set it up - you specify if you need to type the password at login, or if the password is automatically supplied, or if you have no password at all.

If you have set it up that the password is required to be entered manually, then Windows startup will wait at the password prompt until the correct password is entered.