Windows Event Viewer Question

[NewSilkTurtle]

Earlier today I went out for a while and left my computer on. While I was gone, my neighbor came over and briefly used my internet connection.

The computer was turned off when I got home, and my neighbor swears that she did not turn off the computer, and I have a UPS so unless the power was off for more than five minutes the computer would have stayed on.

The System Log shows two 6006 "clean shutdown" events and one 6009 reboot during the specific time that my neighbor was using the machine, but it can't be started without a password, and I have one that nobody else has or could ever guess.

So what happened?

 

[tfinch2]

I rebooted it via Trojan Horse.

I am watching you now, close that pr0n!

 

[NewSilkTurtle]

Prove it. Reboot it again right now. I'm waiting!

 

[tfinch2]

Your sarcasm meter is broken. Check the Hot Deals thread to see if any specials are going on.

 

[NewSilkTurtle]

Why don't you just send me one via Trojan Horse?

 

[gsaldivar]

Teh FBI owns joo.

 

[stratman]

Originally posted by: NewSilkTurtle
Why don't you just send me one via Trojan Horse?

lol, turtle.

 

[NewSilkTurtle]

I think I know what happened.

My neighbor is both a liar and very absent-minded. The Event Viewer shows her Remote Access (via dialup) was started at 10:32 and terminated at 10:36, which agrees with the record of the ISP. She then proceeded to shut down the computer at 10:36, forgetting that she is not the one who started it in the first place. Or else she wanted to try to cover her tracks. She's not very computer literate, has only had a PC since last summer and doesn't even know that IE keeps a history.

Aside from the computer being shut down the IE history is what clued me in that she had been here, as she visited a website that I would never visit but which is of particular interest to her. And when I questioned her if she had shut down my computer she at first denied having looked at the website I mentioned from IE history. She was probably thinking "How the heck does she know what website I looked at?" but what she said was that one of my cats probably did it. Yeah, right - the cat managed to open IE, type a URL, and connect to the internet - ROFLMAO!!!

When she was finished, since she doesn't know how to disconnect from the internet, and didn't know what time I would be back, she shut the computer down, then realized "This machine was on when I got here, I better turn it back on." Except you can't start my PC without a password, and she didn't know that, so when she saw it ask for a password, she decided that rather than leave the password window open and clue me in that way, she would shut it down again and hope I would forget I had left it on.

Most of this is supposition.... I finally got her to admit to shutting it down once "by accident" but she says she "doesn't remember" shutting it down a second time.