Understanding TeamViewer Log

[allanc]

Another unusual request from one of my new clients ...
This is a new manager who uses a XP Home sp3 computer.
The person who previously used this computer is no longer available to discuss anything about the PC.

TeamViewer is always in the notification area.
The new manager has noticed unusual things about this computer and asked me to investigate.
I found a TeamView Log that is about 800Kb.
However, I have never tried to dissect one of the logs before.
I spent some time looking at the log but I was not able to glean any information.
Basically, what I would like to know is if/when someone connected into this computer, their IP address and the same for disconnects.
Any other interesting markers would also be appreciated.

Thank you very much in advance.

 

[allanc]

Another unusual request from one of my new clients ...
This is a new manager who uses a XP Home sp3 computer.
The person who previously used this computer is no longer available to discuss anything about the PC.

TeamViewer is always in the notification area.
The new manager has noticed unusual things about this computer and asked me to investigate.
I found a TeamView Log that is about 800Kb.
However, I have never tried to dissect one of the logs before.
I spent some time looking at the log but I was not able to glean any information.
Basically, what I would like to know is if/when someone connected into this computer, their IP address and the same for disconnects.
Any other interesting markers would also be appreciated.

Thank you very much in advance.

Does anyone have any knowledge of this log file .... please?

 

[bytes]

If you post the log maybe someone will help.

 

[allanc]

If you post the log maybe someone will help.

Good point.
Thanks.

A shortened log file is attached.

 

[bytes]

I looked over your log file. I am no expert with the TV log file...but, nothing really jumped out at me. I saw some IP addresses that just went to TV..and the local machines IP. I'm not sure you will get the info you need from that log. I suggest you contact TV and get some questions answered there. Otherwise, wait and see if someone chimes in.

 

[Knightsman]

Nothing stands out to me either, what is the computer in question doing that he wants to dig for?

 

[allanc]

I looked over your log file. I am no expert with the TV log file...but, nothing really jumped out at me. I saw some IP addresses that just went to TV..and the local machines IP. I'm not sure you will get the info you need from that log. I suggest you contact TV and get some questions answered there. Otherwise, wait and see if someone chimes in.

I posted something on the TV Web site with no responses.
Are you saying that there are remote connections coming in?
If so, that is exactly what I am looking for.

 

[allanc]

Nothing stands out to me either, what is the computer in question doing that he wants to dig for?

There has been a change of staff and the previous people cannot be reached.
The new staff has legitimate concerns (I cannot go into details) about the integrity of the previous group.
The new manager is very concerned that the prior staff may have connected remotely when they should not have.
Any remote connection raises a red flag.
I need to be able to determine which IP connected, when and for how long.
If someone can point out what specifically I should be looking for ... it would be immensely appreciated.

 

[kale76]

is there a file calling "Connections_incoming.txt" in that directory?

it would be located in the "C:\Program Files\TeamViewer\Version6" directory?

 

[allanc]

is there a file calling "Connections_incoming.txt" in that directory?

it would be located in the "C:\Program Files\TeamViewer\Version6" directory?

Not that I noticed.
The new manager asked me to remove the Team Viewer software and directory.

 

[Knightsman]

The only thing that concerns me is this number

453032142

which looks like a team viewer ID. ym question is what does the L=* stand for, is the length of time..??


its possible that machine is 453032142 and the remote machine is 279221225.
I would say yes, there was a connection from this line:

From=279221225 To=453032142 L=4

another
270611610

 

[allanc]

The only thing that concerns me is this number

453032142

which looks like a team viewer ID. ym question is what does the L=* stand for, is the length of time..??


its possible that machine is 453032142 and the remote machine is 279221225.
I would say yes, there was a connection from this line:

From=279221225 To=453032142 L=4

another
270611610

The complete log is > 800Kb.
The IP address in that smaller portion of the log is on other parts at interesting times such as 3 am.
Hmmmmmmmmmmmm.

Does anyone have a list that describes the various messages?
I just know that the client is going to ask me to provide details, details, details.

 

[Knightsman]

The complete log is > 800Kb.
The IP address in that smaller portion of the log is on other parts at interesting times such as 3 am.
Hmmmmmmmmmmmm.

Does anyone have a list that describes the various messages?
I just know that the client is going to ask me to provide details, details, details.

I could remote in and look at some logs, and see what I think. also look in preferences and see if it is check next to unattended support. change the password also for it. That will kill any opportunity they have to connect again.

 

[allanc]

I could remote in and look at some logs, and see what I think. also look in preferences and see if it is check next to unattended support. change the password also for it. That will kill any opportunity they have to connect again.

As mentioned above, I have removed the software.
If I tell them that at a certain date/time someone from IP xxx connected, they are going to ask me for details of other sessions, etc.
I think that the main task for me at this point is to obtain a list somewhere of what the various entries in the log are (line by line) so that I can talk intelligently to the new manager about the contents of the log.
There must be a ton of repetition in the huge log in terms of the same 'keywords' over and over again.
Would you happen to have a list of these keywords/phrases, etc that you could PM to me?
Both myself and the client would really appreciate it.
Thank you in advance.

 

[Knightsman]

I don't have any of that, once I get to the office ill do some connections and watch my log to see what I see.

 

[BryanVest]

Looks like the IP address/port to me:
2011/03/02 10:27:47.296 656 2396 S0 CCT.Connect.68.148.147.250:5938

Looks like the persons user ID
CT.Send.CMD_BUDDY From=453032142 To=270611610 L=137

 

[Fixedathome.com]

I posted something on the TV Web site with no responses.
Are you saying that there are remote connections coming in?
If so, that is exactly what I am looking for.

Why don't you email TV support instead of the forums? If you post them a snippet of the log then hopefully they will explain it to you.

 

[allanc]

Why don't you email TV support instead of the forums? If you post them a snippet of the log then hopefully they will explain it to you.

That is a good idea.
However, the reason that I did not is because, according to the log, it is a 'free for personal use' version.
I did not think that they would provide this type of support for a non-commercial version.

Edit:
'With several million users we are only able to offer personal technical support to license owners or users in the purchase decision process. Thank you for your understanding! '

 

[Fixedathome.com]

That is a good idea.
However, the reason that I did not is because, according to the log, it is a 'free for personal use' version.
I did not think that they would provide this type of support for a non-commercial version.

Edit:
'With several million users we are only able to offer personal technical support to license owners or users in the purchase decision process. Thank you for your understanding! '

Maybe one of the Kind TV owners on this forum could ask on your behalf

 

[allanc]

Maybe one of the Kind TV owners on this forum could ask on your behalf

Are you kind and a TV owner?