Has my computer been hacked by the creepy local repair guy?

Question

A couple of months ago, my hard-drive decided to die. I went to this guy in town that everyone suggested for cutting deals and taking all kinds of work. He installed a new hard drive, but was completely a creep (asking for all sorts of "favors" for software, which of course I declined.) He continued to ask as he perused my personal things in front of me, commenting all the way.
Just today, I noticed in "My Network Places" that there are all sorts of things I didn't put in there that have his name on them. They have names like "Drivers on Paul-1288", "clone cd images on Paul-1288", "Shared Docs on Paul-1288", "Shared Docs on JEREMIAH'S ROOM", "pete on Paul-1288." Paul is the name of creepy computer repair man, and I certainly have never heard of any of those other names.
Can I delete these files and keep my computer running? Does this mean he have access to my stuff?
Please give me a legit answer, it's really freaking me out. Thank you VERY MUCH.

EDIT: Why did I go to "creepy guy" in the first place? I'm new in town and everyone suggested him.
I am resolved to not go to the police, as I really doubt they will deal with this (they are very against harassment claims here.) I'm certainly not the only one in town he's done this to - imagine the blackmail he might have on the officials in town!
I am, however, reporting him to the Better Business Bureau.

Thanks to the suggestions, I checked to see if there was a keylogger on my computer. There was. Thanks a lot. In the haze of everything, I didn't even think about all the *other* ways my personal data might be taken. I spoke with a friend who works in programming, who gave me lots of valuable information about all of this. And a free new hard drive to boot! (pardon the pun) Thanks again for answering, everybody!

Answer 1

Answering your question comes in two parts.

First, there is nothing particularly troubling about the items you described. If he was working on your computer and had it linked to his network (which is often done, we do it every day), the folders he accessed would be included in your network places automatically. The names would be logical locations for drivers, support files, etc. that he would have on his network and could use to diagnose and/or repair your system. Click on any of those items. You should get a "not found" or similar error. This means those network places are no longer accessible since your system is no longer on his network. You can safely delete them, and you should.

Second, the fact that these items are innocuous doesn't mean he hasn't hacked your system some other way. Antivirus and antispyware sweeps would be a good idea, but if he put a keylogger program on your computer, these sweeps probably will not find it. (A keylogger would be your worst nightmare in terms of lost privacy). Do a google search for keylogging programs and download a kelogging finder (pctools and many others are free). Sweep your computer with these (I'd use two or three). You might consider sweeping with "hijackthis", though it's not a very user-friendly tool. I'd also check for obvious backdoors (the guy doesn't sound very bright) such as pcanywhere, gotomypc, etc. Go to add/remove programs and look for anything suspicious.
Go to start/run "msconfig". Check your startup items and non-microsoft services for anything suspicious.
Finally, forget about the police. Crime or not, the truth is they're just not going to bother.

Answer 2

Hello,

Personally I would straight out ask "Creepy Guy" what those files/folders are and what they have been placed there for. Also, sometimes techs will back certain files up in folders easy to access. However, that said, as a tech he should have explained to you up front about those files/folders because if they are in fact there for a legit reason you will likely want to know about them.

I would strongly suggest that since you obviously do not completely trust this person that you find yourself some tools ie( a good virus scanner, spyware software, and spy tracker software and finally a good firewall).

The virus scanner should pick up at least the most obvious trojans/viruses (AVG Free Edition works quite well for me) and as far
as spyware software (Adaware, Spybot Search and Destroy and HiJack This) are a great combination of tools. "Spy tracker" software is different in that it specifically searches for known surveillance and key stroke logging software which is different than spyware and much more dangerous for you to not know about. A firewall may help in protecting your computer from unwanted access from the outside or at very least inform you of the attempts.

First lesson to take from this is to make sure to only allow trusted and qualified persons to repair your PC and even this isn't fool proof. Computers contain a wealth of personal information and even when you delete something and you THINK it is gone, it ISN'T! It COULD be recovered unless you take action to permanently remove it. Windows Washer is a cheap tool for cleaning up temp files and what not AND has a tool to ensure files and secret information is permanently wiped out!

From the looks of the folder names it appears there is nothing strange going on but folder names mean nothing at all. It sounds like the "Creepy Guy" is less than ethical from your recount of him so I would definetely follow up on your concerns.

My background so you know is as a programmer and network admin. Message me back here if you would like or I can give you my personal email address and I can see what I can do to help you out.

Good Luck

PS. In response to the many useful answers to your question I've JUST noticed. PLEASE DO NOT just go and delete files without knowing what you are deleting. Also, DO NOT go reporting him to the police just yet until you have proof he has done something illegal!!!!!! Being unethical isn't a crime and at this point there is no confirmation of illegal activity. Don't cause trouble for someone unless they deserve it of course.

Answer 3

Don't panic!

Do not delete those files.
Those are shared folders, the creepy guy might share your personal folder so he can access it via internet, wireless lan. Those folder contains your personal stuffs, so if you delete it, you deleted your own stuffs. The right thing to do is un-share it.

You have to search for where the folder is, use window explorer, and right click on that folder, choose sharing, and disable it.


those Paul-1288 is the computer name. The guy who installed windows for you used his name as computer name. There is nothing being hacked or spy on your computer. You might want to change the computer name:

1. Right click on My Computer, choose properties.
2. Click the Computer name tab, click 'Change' button below the 'network id' button.
3. Deleted the Paul-1288 and enter your new computer name.
4. Click ok to close, and restart your computer.

That's it, you won't see paul-1288 anymore.

Answer 4

Yes delete all those things you mentioned in Network Places. They are previous network connections - he may have used them in restoring your data.

Q #1) why would you let a 'creepy guy' have access to all your info?
Q #2) Getting any weird phone calls lately??

Find someone you trust to work on your computers in the future, also have them check out your computer for user account and shares that may be used as a 'back-door' into your computer if you are seriously worried about this guy.

Answer 5

nah, it sounds alot more like he just reinstalled windows then made a network connection to another machine from your pc - on that network connected machine he had placed all the various drivers, programs and such for your machine - he could then copy them across to your machine and install them.

if he wanted to spy on you, you wouldn't see such obvious signs.

it's common sense to be running a reliable antivirus program to pick up any trojans or malware on your system so if you don't already have something like that installed, go get some.

Answer 6

Girl , I STRONGLY RECCOMEND you show this to the POLICE IMMEDEITLY and then see what they can do, and go to a local computer store and a tech expert to see whats wrong so they can get it fixed, or jus report to the police and delete the files.

Answer 7

He used your computer to browse to other places on his network. Possibly to test it; possibly to grab some drivers; possibly for some other reason.

The computer automatically added the places that he browsed to. Those places aren't on your network. You can delete them safely.

Answer 8

yes delete those files but only after you show them to the police!!!!!!!
if hes a preditor, he needs a vacation in the crossbar hotel for about 30 years.
promise me you will call the police!!!!!!

Answer 9

you need to report him right away... i also noticed that you have your e-mail address posted.................now anyone can send you a virus.