TeamViewer Forum

General Category => Teamviewer for Windows => Topic started by: asfsas on April 08, 2013, 04:49:48 AM

Title: Help i think i got hacked ?
Post by: asfsas on April 08, 2013, 04:49:48 AM

Hi guys

Please can someone check this log i think i might have been hacked.

I had some messages popping up saying reading drive c and drive and so on then i turned off my pc straight away from the guy who was connected to me

Bits that stand out to me are

Code: [Select]

[code]2013/04/08 12:26:15.906  2828  4140 S0   CToken::GetSystemToken() set session 1
2013/04/08 12:26:15.913  2828  4140 S0   InterProcessNetwork: Loader process started, pid = 4276
2013/04/08 12:26:15.913  6528  4280 L32  Loader started with: "C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe" --action hooks  --log C:\Program Files (x86)\TeamViewer\Version8\TeamViewer8_Logfile.log  
2013/04/08 12:26:15.918  4276  6632 L64  Loader started with: "C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe" --action hooks  --log C:\Program Files (x86)\TeamViewer\Version8\TeamViewer8_Logfile.log  
2013/04/08 12:26:15.929  2828  6500 S0   CT2 CT.Receive.CMD_PINGOK From=0 To=679257192 L=4
2013/04/08 12:26:15.933  6528  4280 L32  Starting Loader
2013/04/08 12:26:15.888  6876  6896 H32  Loader: SharedMem Connected (seg = 0x3860000, refcnt = 1)
2013/04/08 12:26:15.888  6876  6896 H32  teamviewer.exe: SharedMem Connected (seg = 0x3860000, refcnt = 2)
2013/04/08 12:26:15.937  4276  6632 L64  Starting Loader
2013/04/08 12:26:15.956  2828  6500 S0   NetWatchdog: Ping successful!
2013/04/08 12:26:15.957  2828  6500 S0   Non-Commercial use
2013/04/08 12:26:15.957  2828  6500 S0   Resource-Language:en
2013/04/08 12:26:15.991  6876  6896 G1   Tray created! [/code]

Any advice would be appreciated so i may report him to the police if this is the case ?

Many thanks.

Title: Re: Help i think i got hacked ?
Post by: matt on April 08, 2013, 06:55:50 AM

Was the person connected to your computer, originally connected with your permission?

Why do you think that that portion of logs looks suspicious?

Title: Re: Help i think i got hacked ?
Post by: asfsas on April 08, 2013, 08:57:46 AM

Yes he was connected with my permission

The logs show a "hook" hence why im suspicious

Also when he was connected i had a box pop up like a log box saying that he was viewing my different partitions of my hard drive yet i could not see the mouse moving as it was saying this. He was doing a file transfer at the time of this happening that was meant to be a small text document but seemed to go on for what seemed about 1 min so when the log box popped up and i could see it saying "viewing D drive" "Viewing Program files" etc i just hit reset on my pc.

Does this sound like or look like iv been hacked by logs ?

Thanks.

Title: Re: Help i think i got hacked ?
Post by: David_Feynman on April 08, 2013, 09:24:20 AM

My guess is that I very much doubt you've been hacked or that "hooked" is anything to worry about.  I don't know what you were being assisted with but it's pretty common for someone doing support to look at the file system.  Have you run a virus scanner and found anything?  Unless a scanner found something I would not worry further.

Title: Re: Help i think i got hacked ?
Post by: asfsas on April 08, 2013, 09:32:59 AM

Hi David

I have indeed and nothing popped up suspicious. Thank you very much for the reply.