Unknown Remote User Found - How to know what they did?

Hello!

I came into my house this morning and discovered someone had gained remote access through my VNC server. I scanned the event log and found the ip address to someplace in Romainia. The Command Prompt and Services windows were opened up. This was part of the last command in the command prompt: bitsadmin /transfer script.bat

It had been executed, but I was able to interrupt it with Ctl-C.

How can I know if they changed anything / got into anything?

Here are my FRST Logs.

I have found the script file they were trying to use and can put that here if you think it would be helpful. They were trying to use something called a "miner." Is there anyway to tell if they were successful?

Your logs show you have software installed that would suggest that this computer is being used for business purposes. Can you please confirm that this is the case.

This is a personal / family home PC. The VPNs are only rarely used.

It's not the VPNs that made me ask.

The following line ...

() C:\CStone\NMSAccess.exe

.... indicates the presence of ... Cornerstone from IDEXX Computer Systems ... http://www.shouldiremoveit.com/Cornerst ... ogram.aspx

... and this is confirmed by the following entry in your Uninstall list ...

Cornerstone (HKLM-x32\...\{AC85F817-E377-402C-A1A7-F8FED5995508}) (Version: 8.6.12.10 - IDEXX Laboratories, Inc.)

Cornerstone is a program used by Veterinary practices ... https://www.idexx.com/en/veterinary/software-services/cornerstone-software/ ... there is no reason why such software should be found on a home computer.

As far as this forum is concerned, a Veterinary Practice is a business.

May I draw your attention to the topic: ALL USERS OF THIS FORUM MUST READ THIS FIRST, which you should have read before posting for help.

The section here explains why we do not offer help for business computers. Thank you for your understanding.

This topic is now closed.