SOLVED Wake up P/W Bypass

[Starbuck]

Last Tuesday 04-22-14, MS issued it's Windows update. I found my computer, at 5AM 04-23 running, with the update flag showing. The computer was put to sleep (verified in Events Viewer) correctly but now the screen was showing as the computer running! Supposedly, this is impossible with P/W required, but here it is.

I've checked as much as I can. All the usual wakeup devices, like USB Root, have the wakeup for this device disabled. Yet, Events viewer for this particular wakeup showed USB root as the wakeup call. Mouse wakeup is enabled as is keyboard and perhaps my cat hit the mouse (cat and mouse game?) inadvertently, but expecting the cat to have entered the P/W is highly improbable given the complexity.

So, I am in a quandary. I run Win 7 Ultimate, MS Security Essentials and Malware bytes. No problems showing up.

I use Comcast modem/router which has Wi-Fi but it is unused. I only run the cable connection.

Where do I go from here?

 

[TrainableMan]

Check your Scheduler or Windows Media Center, there are likely updates scheduled for 5am.

And requiring a password only inhibits keyboard input, it won't keep programs from running.

 

[Shintaro]

Welcome to the W7Forums.

That is pretty interesting. I know you said that you have scanned your computer, but could you also scan your computer with the following and post a screen shot of the complete scans:

1. Download and run TDSSKiller.
2. Please download and run Windows Defender Offline. It will create a CD / DVD / USB and will boot and scan your hard drive offline.

 

[Starbuck]

Check your Scheduler or Windows Media Center, there are likely updates scheduled for 5am.

And requiring a password only inhibits keyboard input, it won't keep programs from running.

I'll be trying Shintaro's links. It doesn't make sense, however, to allow key and mouse control as a result of running a download while in Sleep (S3) and presumably Log-off, which I would assume to be separate from a program. Rather cavalier, IMO, of MS. Before disabling USB Root and LAN from running while S3 has been invoked, I noticed by seeing the red HDD light flashing that something was running, neverthless, I still had to log in. I've never seen Awake invoked by MS Update before either.

 

[TrainableMan]

It never hurts to run a virus scan but I really doubt it's anything to be alarmed about.

A program has no need for manual input to read/write the hard drive or access the internet to download updates, so having CPU and hard drive usage at 5a.m. is not surprising; that is when many programs are scheduled to update automatically. And for most people Windows updates do download automatically over night, so seeing an update flag in the morning is not unusual.

The part where your screen came on, I suspect would be a possible bump to the desk (I suggest you disable wake on mouse).

And as for it being up w/o a password screen, go to Control Panel > Personalization, Screensaver, and make sure "On Resume, Display Logon Screen" is checked. And also Control Panel > Power Options ... Advanced Power Settings and make sure "Require a Password on Wakeup" is set to Yes.

 

[Starbuck]

Welcome to the W7Forums.

That is pretty interesting. I know you said that you have scanned your computer, but could you also scan your computer with the following and post a screen shot of the complete scans:

1. Download and run TDSSKiller.
2. Please download and run Windows Defender Offline. It will create a CD / DVD / USB and will boot and scan your hard drive offline.

I ran both and both came up clean.

 

[TrainableMan]

Scanned clean for root kits and viruses, that's great.

I just noticed this part where you indicated you had to log in:

neverthless [sic], I still had to log in.

So now I'm confused, did it bypass your password or didn't it?

If you came back to the machine and it was awake and logged on but you did NOT have to enter a password then I would suspect at least one of two switches I mentioned needed enabled (Screensaver's "On Resume, Display Logon Screen" and Power Option's Advanced Power Setting "Require a Password on Wakeup").

But if you came back and it was NOT logged on, then that would not be considered bypassing your password. If it had installed updates and then simply rebooted and you were sitting at the logon screen where you DID have to enter your password then everything is normal. Some automatic updates require a reboot to complete the installation, so it could install and then force your computer to restart so that installations or the monthly malware scan can complete.

It sounds like what may be concerning you is that Windows Update can install updates and reboot your computer without your input and yes, by default it can do that and it would not be considered bypassing your password. There are several different settings possible to prevent such actions. You can set Windows Updates to never check, to check & notify you but not download or install automatically, to download but then notify you so you can specify when to install. The only option that doesn't require your input is the default, which is to download and install:

And there are also a couple Registry tweaks you can make:

To prevent Windows Update from Rebooting when a user is logged on:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAutoRebootWithLoggedOnUsers"=dword:00000001

and to stop Windows Update from Hijacking the Sleep/Shutdown Button allowing you to choose "install updates" on the shutdown menu or not:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAUAsDefaultShutdownOption"=dword:00000001

If you do not wish to manually update the values in your Registry, you can download the attached file, unzip it, and run the contents. It will warn you that updating the registry is dangerous and ask if you want to proceed...

 

[Starbuck]

Thanks much for your feedback, Train. Sorry for the confusion.

There are two occasions where I noticed that, in spite of being in S3, the computer was running something. The first time the HDD led was flickering, but when I jiggled the mouse for wake-up, I did have to log in. To fix that, I disabled both USB root and LAN from waking the computer. Control Panel > Power Options ... Advanced Power "Require a Password on Wakeup" had already been set to Yes. The indication of HDD action stopped. Log in required. That never changed until Tuesday.

The second time, Tuesday, is what and why I posted here, namely, everything was running, with the MS Update flag waiting for me to install what had been already downloaded. (Option 2 of the 4 options for Updates). I did not need to log in.Which brings me here.

I know about the Screen Saver option and it was not set to Require P/W. I didn't think I needed it and had it been set, I probably would not know I have a potential problem.

Your final paragraph makes the most sense and I will look into the Registry Tweaks. I'm used to it and will back it up first.

Thank you!

 

[TrainableMan]

Well hopefully you are now armed with all the possibilities to resolve your concerns.

 

[Starbuck]

Problem has resolved. The Registry entries especially did the trick. I had an update notice from MS that did not wake the computer, nor any other intrusions.

A software friend with 30+ years experience mentioned that Win 8 is even worse, so it appears I'm not alone. I hope this thread helps others and thanks to all that helped here.

 

[TrainableMan]

I'm glad you got it worked out.