-3

I recently received my laptop from repair and I just had a hunch that something fishy might have happened so I checked the log files on Windows Event Viewer and it turns out that my laptop has been successfully logged on into while it was sent for repair.

It was sent for repair as it could not be charged. The logs show that the laptop was turned on for a few seconds, twice on the same day it was handed over. I assume this is just the repair person doing some preliminary tests.

3 days later it was used again for 5 mins and then nothing until I received it. During this time the security logs that really worry me are two consecutive events with Event ID: 4624, An account was successfully logged on. The Logon Type is 2, which means a user logged on. The account name is my name.

The same event is logged when I manually logon to my laptop. Does this mean that my laptop's password has been hacked? Is there any other explanation for these logs?

I have a local account on windows 10 with a fairly strong password. I know that my laptop can be hacked. Is there a way to tell that it was hacked for certain? I have used antivirus software but it detects nothing.

Giacomo1968
  • 58,727
Freddit
  • 1

2 Answers2

2

Windows has a facility to log a user in before they enter passwords and effectively when you log in you are simply "unlocking" your account. This is done to ensure that updates are performed upon boot and keeps your system up to date.

It could be this that you are seeing and the shop simply powered it on to test that whatever they did to repair it worked. They could have then tried it again a few days later to see that it had not lost a significant amount of charge or was still able to charge.

Unless you can see signs that all your data has been accessed or other programs installed it does not necessarily mean that they were doing anything unexpected or nefarious.

You can find out more about that setting and how to disable it at Windows 10 - Users already logged in at boot

Mokubai
  • 95,412
-2

It would need to be a very good hacker if he managed to install undetectable malware in only 5 minutes. But the danger from a workshop employee isn't the only one, given that your computer was turned-on and even (perhaps) logged-into in an environment that you don't control.

I would suggest to run a few antivirus full scans on your computer, using several well-known such products, in addition to Windows Defender. Some of them can run the scan from the browser.

You may find a list of such products in the article Best Free Antivirus Software.

harrymc
  • 498,455