Question about application history on Win7

[KCB]

Does Windows 7 (or any version of Windows) save a history list of programs
run on the machine? I'm looking for a way to find out which programs ran on
my machine this past Saturday, and what time they were executed.

 

[Gene E. Bloch]

Does Windows 7 (or any version of Windows) save a history list of programs
run on the machine? I'm looking for a way to find out which programs ran on
my machine this past Saturday, and what time they were executed.

All I know is that you can buy software to accomplish this and related
tasks, but obviously that won't help you with prior events.

 

[John Williamson]

Does Windows 7 (or any version of Windows) save a history list of
programs run on the machine? I'm looking for a way to find out which
programs ran on my machine this past Saturday, and what time they were
executed.

In 7 and Vista, some recently used programs are listed in the start
menu, and there's a list of the most recently used programs and
documents in the registry, but the list is fairly short, with no times
attached. Some firewalls keep logs of which programs access the network
and when.

For documents that might have been modified, you can check the
properties to find out when the files were last marked as modified by
checking the properties in Explorer.

Other than that, no, unless you install logging software, which can't
log stuff that happened before it was installed.

 

[J. P. Gilliver (John)]

Does Windows 7 (or any version of Windows) save a history list of
programs run on the machine? I'm looking for a way to find out which
programs ran on my machine this past Saturday, and what time they were
executed.

[]
For documents that might have been modified, you can check the
properties to find out when the files were last marked as modified by
checking the properties in Explorer.

[]
.... which might thus indicate what was used to modify them - if a .doc
or .docx file, for example, it was probably Word.

I presume you're trying to find what caused something on your machine on
Saturday - perhaps tell us more and we might be able to help more?
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G.5AL-IS-P--Ch++(p)Ar@T0H+Sh0!:`)DNAf

Rather, she's like many educated people of her generation: modern enough to be
seduced by the sheer human interest of celebrity and popular culture, yet
traditional enough to feel bad about the seduction. - Robert Crampton on
Vanessa Feltz, Radio Times 15-21 January 2011

 

[Jeff Layman]

Does Windows 7 (or any version of Windows) save a history list of programs
run on the machine? I'm looking for a way to find out which programs ran on
my machine this past Saturday, and what time they were executed.

Anything useful in Event Viewer?

 

[VanguardLH]

Does Windows 7 (or any version of Windows) save a history list of programs
run on the machine? I'm looking for a way to find out which programs ran on
my machine this past Saturday, and what time they were executed.

Well, did you beforehand enable audit policies for process tracking?

gpedit.msc
node: Computer Configuration -> Windows Settings, Security Settings ->
Local Policies -> Audit Policy
setting: Audit process tracking

 

[KCB]

Does Windows 7 (or any version of Windows) save a history list of
programs run on the machine? I'm looking for a way to find out which
programs ran on my machine this past Saturday, and what time they were
executed.

[]
For documents that might have been modified, you can check the properties
to find out when the files were last marked as modified by checking the
properties in Explorer.

[]
... which might thus indicate what was used to modify them - if a .doc or
.docx file, for example, it was probably Word.

I presume you're trying to find what caused something on your machine on
Saturday - perhaps tell us more and we might be able to help more?

One of my email accounts got hacked, and I was thinking maybe some rogue
program on my computer. Hopefully, this is not the case, as my computer was
off at the time the emails were (apparently) sent. My employer was closed,
with no access to my work computer, so I don't think anything happened
there, either. It seems from the headers, if they can be believed, that the
originating computer was in Israel, and other than my name and email
address, there is nothing else in the source that points to anything related
to me. I'm still baffled how they did it.

 

[KCB]

Well, did you beforehand enable audit policies for process tracking?

gpedit.msc
node: Computer Configuration -> Windows Settings, Security Settings ->
Local Policies -> Audit Policy
setting: Audit process tracking

Thanks for this information. I did not have this enabled, but will surely
check these options to see what I can track.

 

[KCB]

Anything useful in Event Viewer?

Not anything that I could see at the time this occurred. Earlier and later
entries, from legitimate Win7 services, did have me studying those for quite
a while.

 

[J. P. Gilliver (John)]

In message <[email protected]>, KCB <[email protected]>
writes:
[]

One of my email accounts got hacked, and I was thinking maybe some
rogue program on my computer. Hopefully, this is not the case, as my
computer was off at the time the emails were (apparently) sent. My
employer was closed, with no access to my work computer, so I don't
think anything happened there, either. It seems from the headers, if
they can be believed, that the originating computer was in Israel, and
other than my name and email address, there is nothing else in the
source that points to anything related to me. I'm still baffled how
they did it.

When you say your account got hacked, and you mention headers - do you
just mean that someone sent an email that seemed to come from you (which
whoever received it subsequently told you about)? Or something more
serious, someone hacked into your account and read your emails
(presumably a web-based or similar type - maybe the hotmail you're
hiding - since your PC was off at the time)?

If it's just spoofed From: headers, don't worry - there's nothing you
can do about that and nothing you've done wrong (or carelessly) to cause
it.

 

[Nil]

Thanks for this information. I did not have this enabled, but
will surely check these options to see what I can track.

The Group Policy Editor is only included with Windows 7 Pro and
Ultimate, so you may not have it, depending on what version you run.

Enabling the auditing shown above will make a record in the Security
Long every time a program or process is started, and by what user
account. This can generate a lot of entries, so you might be careful
about when you turn it on, and you'll want to turn it off once your
sleuthing is done.

 

[Roy Smith]

The Group Policy Editor is only included with Windows 7 Pro and
Ultimate, so you may not have it, depending on what version you run.

Enabling the auditing shown above will make a record in the Security
Long every time a program or process is started, and by what user
account. This can generate a lot of entries, so you might be careful
about when you turn it on, and you'll want to turn it off once your
sleuthing is done.

Well not unless you want a rapidly expanding logfile on your system....

 

[KCB]

In message <[email protected]>, KCB <[email protected]>
writes:
[]

One of my email accounts got hacked, and I was thinking maybe some rogue
program on my computer. Hopefully, this is not the case, as my computer
was off at the time the emails were (apparently) sent. My employer was
closed, with no access to my work computer, so I don't think anything
happened there, either. It seems from the headers, if they can be
believed, that the originating computer was in Israel, and other than my
name and email address, there is nothing else in the source that points to
anything related to me. I'm still baffled how they did it.

When you say your account got hacked, and you mention headers - do you
just mean that someone sent an email that seemed to come from you (which
whoever received it subsequently told you about)? Or something more
serious, someone hacked into your account and read your emails (presumably
a web-based or similar type - maybe the hotmail you're hiding - since your
PC was off at the time)?

If it's just spoofed From: headers, don't worry - there's nothing you can
do about that and nothing you've done wrong (or carelessly) to cause it.

It was the hotmail account, and they did access it online. I received many
bounces when I logged in, which clued me in to something wrong. Hotmail
subsequently locked the account after seeing the volume of outgoing mail,
and I've had to reset it. It was a spammer sending out links to what I'm
sure are sites you wouldn't want to visit. I alerted everybody through my
other email accounts, and after the reset, think I've regained control.

Hotmail limits passwords to 16 characters, which is rather short for my
tastes, but I think I've sufficiently randomized my new password so as not
to go through this again.

 

[Paul]

In message <[email protected]>, KCB <[email protected]>
writes:
[]

One of my email accounts got hacked, and I was thinking maybe some
rogue program on my computer. Hopefully, this is not the case, as my
computer was off at the time the emails were (apparently) sent. My
employer was closed, with no access to my work computer, so I don't
think anything happened there, either. It seems from the headers, if
they can be believed, that the originating computer was in Israel,
and other than my name and email address, there is nothing else in
the source that points to anything related to me. I'm still baffled
how they did it.

When you say your account got hacked, and you mention headers - do you
just mean that someone sent an email that seemed to come from you
(which whoever received it subsequently told you about)? Or something
more serious, someone hacked into your account and read your emails
(presumably a web-based or similar type - maybe the hotmail you're
hiding - since your PC was off at the time)?

If it's just spoofed From: headers, don't worry - there's nothing you
can do about that and nothing you've done wrong (or carelessly) to
cause it.

It was the hotmail account, and they did access it online. I received
many bounces when I logged in, which clued me in to something wrong.
Hotmail subsequently locked the account after seeing the volume of
outgoing mail, and I've had to reset it. It was a spammer sending out
links to what I'm sure are sites you wouldn't want to visit. I alerted
everybody through my other email accounts, and after the reset, think
I've regained control.

Hotmail limits passwords to 16 characters, which is rather short for my
tastes, but I think I've sufficiently randomized my new password so as
not to go through this again.

I'm not a Hotmail user, and have never tried to sign up for an account.

What would concern me, would be the "password recovery" process. When
you got control of your Hotmail account again, have you also changed
the details of the "password recovery" feature ? Otherwise, they
may have set it up, such that they can take control again.

http://www.ehow.com/way_6147697_hotmail-remote-password-recovery.html

Paul

 

[Rhonda Lea Kirk Fries]

In message <[email protected]>, KCB <[email protected]>
writes:
[]

One of my email accounts got hacked, and I was thinking maybe some rogue
program on my computer. Hopefully, this is not the case, as my computer
was off at the time the emails were (apparently) sent. My employer was
closed, with no access to my work computer, so I don't think anything
happened there, either. It seems from the headers, if they can be
believed, that the originating computer was in Israel, and other than my
name and email address, there is nothing else in the source that points
to anything related to me. I'm still baffled how they did it.

When you say your account got hacked, and you mention headers - do you
just mean that someone sent an email that seemed to come from you (which
whoever received it subsequently told you about)? Or something more
serious, someone hacked into your account and read your emails
(presumably a web-based or similar type - maybe the hotmail you're
hiding - since your PC was off at the time)?

If it's just spoofed From: headers, don't worry - there's nothing you can
do about that and nothing you've done wrong (or carelessly) to cause it.

It was the hotmail account, and they did access it online. I received
many bounces when I logged in, which clued me in to something wrong.
Hotmail subsequently locked the account after seeing the volume of
outgoing mail, and I've had to reset it. It was a spammer sending out
links to what I'm sure are sites you wouldn't want to visit. I alerted
everybody through my other email accounts, and after the reset, think I've
regained control.

Hotmail limits passwords to 16 characters, which is rather short for my
tastes, but I think I've sufficiently randomized my new password so as not
to go through this again.

The Hotmail hackers usually delete the mails after sending them. You can
recover those messages to see exactly who they spammed:

http://windowslivehelp.com/solution.aspx?Solutionid=1f8432d5-4f7b-4468-9c98-bdf3a469783a

As for the password issue...I have strong, random passwords on all of my
accounts--including Hotmail--and it did not prevent my account being hacked.
Luckily, I only use the account for mailing lists, so to me, at least,
little harm was done.

 

[Gene E. Bloch]

In message <[email protected]>, KCB <[email protected]>
writes:
[]
One of my email accounts got hacked, and I was thinking maybe some rogue
program on my computer. Hopefully, this is not the case, as my computer
was off at the time the emails were (apparently) sent. My employer was
closed, with no access to my work computer, so I don't think anything
happened there, either. It seems from the headers, if they can be
believed, that the originating computer was in Israel, and other than my
name and email address, there is nothing else in the source that points
to anything related to me. I'm still baffled how they did it.

When you say your account got hacked, and you mention headers - do you
just mean that someone sent an email that seemed to come from you (which
whoever received it subsequently told you about)? Or something more
serious, someone hacked into your account and read your emails (presumably
a web-based or similar type - maybe the hotmail you're hiding - since your
PC was off at the time)?

If it's just spoofed From: headers, don't worry - there's nothing you can
do about that and nothing you've done wrong (or carelessly) to cause it.

It was the hotmail account, and they did access it online. I received many
bounces when I logged in, which clued me in to something wrong. Hotmail
subsequently locked the account after seeing the volume of outgoing mail,
and I've had to reset it. It was a spammer sending out links to what I'm
sure are sites you wouldn't want to visit. I alerted everybody through my
other email accounts, and after the reset, think I've regained control.

Hotmail limits passwords to 16 characters, which is rather short for my
tastes, but I think I've sufficiently randomized my new password so as not
to go through this again.

I'm not a Hotmail user, and have never tried to sign up for an account.

What would concern me, would be the "password recovery" process. When
you got control of your Hotmail account again, have you also changed
the details of the "password recovery" feature ? Otherwise, they
may have set it up, such that they can take control again.

Paul

Interesting...

I never would've thought of that.

Mulţumesc (= thanks).

 

[KCB]

In message <[email protected]>, KCB <[email protected]>
writes:
[]
One of my email accounts got hacked, and I was thinking maybe some
rogue program on my computer. Hopefully, this is not the case, as my
computer was off at the time the emails were (apparently) sent. My
employer was closed, with no access to my work computer, so I don't
think anything happened there, either. It seems from the headers, if
they can be believed, that the originating computer was in Israel, and
other than my name and email address, there is nothing else in the
source that points to anything related to me. I'm still baffled how
they did it.

When you say your account got hacked, and you mention headers - do you
just mean that someone sent an email that seemed to come from you (which
whoever received it subsequently told you about)? Or something more
serious, someone hacked into your account and read your emails
(presumably a web-based or similar type - maybe the hotmail you're
hiding - since your PC was off at the time)?

If it's just spoofed From: headers, don't worry - there's nothing you
can do about that and nothing you've done wrong (or carelessly) to cause
it.

It was the hotmail account, and they did access it online. I received
many bounces when I logged in, which clued me in to something wrong.
Hotmail subsequently locked the account after seeing the volume of
outgoing mail, and I've had to reset it. It was a spammer sending out
links to what I'm sure are sites you wouldn't want to visit. I alerted
everybody through my other email accounts, and after the reset, think
I've regained control.

Hotmail limits passwords to 16 characters, which is rather short for my
tastes, but I think I've sufficiently randomized my new password so as
not to go through this again.

I'm not a Hotmail user, and have never tried to sign up for an account.

What would concern me, would be the "password recovery" process. When
you got control of your Hotmail account again, have you also changed
the details of the "password recovery" feature ? Otherwise, they
may have set it up, such that they can take control again.

http://www.ehow.com/way_6147697_hotmail-remote-password-recovery.html

Paul

I thought about that, but the hacker never changed the password.
Notifications about any change in the account go to my phone, and another
email address. There weren't any changes in the account to let me know,
only the bounces from some old addresses, that I saw when I logged-in.

 

[janstetka]

Does Windows 7 (or any version of Windows) save a history list of programs
run on the machine? I'm looking for a way to find out which programs ran on
my machine this past Saturday, and what time they were executed.

Check out http://process-history.co.uk/ does exactly what you require.

 

[janstetka]

Process History now at http://code.google.com/p/processhistory