Can I find out when my laptop was used?

gonzo127

aliasojo wrote: »

There's no way would my eldest have been able to start the laptop at almost exactly the same time.

why not all he would have to do is set an alarm clock to wake him up when he wants to use it

david39

If the laptop is properly closed down then there is no way that I can think of that can allow it to wake itself up and start running again.

This suggests either someone else is using it without your knowledge or you are not properly closing it down.

If someone else is using it, then it seems very strange that they started the computer up on successive nights at almost precisely the same moment.

The most likely explanation is that the laptop is being left in a sleeping state and is set to run a program each night at midnight - possibly a virus scanner. Can you check your virus scanner to see if it is set to run a scan each night at midnight?

aliasojo

gonzo127 wrote: »

why not all he would have to do is set an alarm clock to wake him up when he wants to use it

His disabilities would preclude this.

david39 wrote: »

The most likely explanation is that the laptop is being left in a sleeping state and is set to run a program each night at midnight - possibly a virus scanner. Can you check your virus scanner to see if it is set to run a scan each night at midnight?

Checked avast, nothing is scheduled at all.

The_Grandmaster wrote: »

If you are worried about infection causing the computer to start, run malwarebytes:
Download and install. Click UPDATE, CHECK FOR UPDATES, and then run a QUICK SCAN. Remove anything it finds and post log here.
Download Malwarebytes Anti-Malware 1.50 - FileHippo.com

Would any of these be the culprit? There's 13 of them. Thought avast would have stopped this.


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6341
Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514
12/04/2011 11:38:21
mbam-log-2011-04-12 (11-38-21).txt
Scan type: Full scan (C:\|D:\|)
Objects scanned: 250135
Time elapsed: 33 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 13
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)

debitcardmayhem

Check in control panel > administrative tools > task manager

aliasojo

debitcardmayhem wrote: »

Check in control panel > administrative tools > task manager

Millions of things in the task scheduler! Well 37 at least, plus 3 Google updater things.

Can't copy and paste, will have to post screenshot, give me a mo'.

aliasojo

Anyone got a magnifying glass? Cant see the words clearly but if I increase the size in paint or photobucket, they just go blurry. Will try to get clearer pics soon. System Restore next run time is set for 13/04/11 at 00.00.00. Wonder if that is what the problem is?

debitcardmayhem

If you see one or more that ran at 00:00:34 then highlight it and then export it (it savesa as xml which you can open with notepad and post it here) HTH

aliasojo

I've clicked on every one, none have a last run time as 12/04/11 @ 00.00.34.

There are maybe 4 or 5 that have a last run time of 12/04/11 @ 00.00.42.

debitcardmayhem

aliasojo wrote: »

I've clicked on every one, none have a last run time as 12/04/11 @ 00.00.34.

There are maybe 4 or 5 that have a last run time of 12/04/11 @ 00.00.42.

Are any of them set to wakeup the computer to run the task on conditions tab? That should only happen if the PC is in sleep mode

aliasojo

Checked every entry. None of them have this option selected.