Hi,
This is probably not dangerous, but I’ll ask anyway. Sometimes when I shut the PC a message appears saying (the message is in Finnish so I cannot write it quite as it should be in English, sorry) : Someone else is using this computer. If you shut it, something will be lost (or something like that). Do you want to shut Windows anyway?
This is scary and embarrassing. Why do I get such a message? We have only one PC in the house.

If you receive the message that ‘other people are logged on to this computer‘ and you are the only one, it doesn
Hello Jim,
My son also uses the pc (I’m his mother, not father by the way), but he has no user profile or account. That’s because I used to need his help with this machine. So we both have administrative rights. We have of course our own passwords for the sites we visit, which are very different. He also has his e-mail account somewhere else, not in my Outlook Express. I don’t really understand this logging-in: we just open Windows and its ready to use, after some waiting.
I checked the Computer Management thing – there is nothing there: shared folders, sessions, shared files are empty, except that all three gave the message "error 2114: server service is not started."
I’m sorry for this long and boring explanation, but its necessary if I’m going get some help.
What does setup mean, sorry? I have Windows XP SP2, IE7, Win and Norman firewalls, Norman virus control, Win Defender.
Regards
Asteri
Sorry for the gender mix up Asteri.
When you start windows, do you have to enter a password and username?
Do you receive the ‘other people are logged on to this computer‘ message every time you shutdown the computer?
If you let the computer sit for awhile, does a screen saver start and then require you to enter a username and password to get back in?
If you look at Start, Settings, Control Panel and double click on Windows Firewall, what do you see?
Regards,
Jim.
The answers are in the same order as your questions.
No.
No, I have received it four or five times in the last couple of months.
No.
(After Start there’s no Settings) I but see the green "badge" is marked, "no exceptions" is marked, the red "badge" is not marked.
I check this every now and then and now I suddenly remembered after your question that actually once to my horror the red "badge" was marked. This was two or three months ago. I cannot understand why, we had no reason to change it.
Regards, Asteri
Hi Asteri,
Try this:
Start, Settings, Network Connections – double click Lan (unless your are using wireless, then you would choose Wireless Network Connection).
click on properties of the Lan Status box and in the ‘connection uses the following items’, scroll down to TCP/IP and select the properties of the TCP/IP.
Click Advanced and then select the ‘WINS’ tab and make sure that the NetBIOS setting is set to Disable NetBIOS over TCP/IP.
It looks like your firewall is active and does not allow any exceptions, so this is good.
Let’s take a look at your port setting for remote desktop and make sure it has not been changed.
Start Registry Editor from Start, Run and then type in REGEDIT. [careful here, we don't want to change anything yet]
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINESystemCurrentControlSetContro lTerminalServerWinStationsRDP-TcpPortNumber
It should show 0x00000d3d (3389) – is this correct?
Let me know your findings.
Regards,
Jim.
Hello Jim,
The netBios setting is set to Disable… was I supposed to find still something else? This all is Hebrew to me, as you probably understand.
The port number is correct, too.
Regards
Asteri
It appears that your system is locked down – I was thinking that perhaps someone could have set the remote desktop port to 80 or something that might be allowed by the firewall, but it’s all standard and your settings are good.
Right now I am at a loss as to what could be causing this, but I think you are safe and that some process or something that I am missing is generating this message.
It will eventually come to me and I’ll post back then – I hate to leave something open, but if I were you, I would not worry, you appear to be secure.
If anyone else can think of something, please post!
Regards,
Jim.
Thank you, Jim
I am relieved. You certainly earn a couple of cups of Chai.
Just two thoughts:
My son had earlier a user profile until I asked him to "delete" it. Could there still be remains of this, somewhere deep inside the system? But then of course the message would appear every time Window is closed.
Or maybe there has been a browser hijacking, and the culprit has done what he’s done but, realizing that actions have been taken, has left and hidden his tracks.
Best regards
Asteri
Thank you for the gift!!
That profile should not kick in by itself – try this if you get time. Search this forum for wireshark – wireshark is a free packet sniffing program and it will watch (and record) everything that comes and goes from your computer to the internet.
It only records the packets of data that are sent and received. What you could do after the program is installed, is to fire it up, start the recording process and then leave the computer. When you come back, there will be data that has been captured. Note: make sure you or someone else is not surfing the net or the packet log will be massive and lead us down the wrong path.
We can look at this data and see what transpired. Most likely, we will only see windows updates, anti-virus updates, etc. However, if someone is logging into your system, we will find it with this.
It’s up to you how far you would like to take it, but should you consider sniffing packets, send me the data and I’ll review (the captured packets (packet log)).
Best regards,
Jim.
Jim,
I’ll do as you advise as soon as I can. I’m quite busy right now.
Regards
Asteri
No pressure Asteri
Hello Jim,
My pleasure.
My answer seems to be gone in the wind, I just wanted to say that I will follow your advice as soon as I can. Right now I am tired and busy.
Regards
Asteri