Felt spied on at work and after two visits from security they are reimaging

Question

I work for a very large school district. I logged in at work on my Dell PC one morning and see Ultra VNC twice in my Start menu.

But let's go back to the night before I saw those eyeballs in my Start menu. The night before I logged on to my desktop email on my iMac ... it is provided by Time Warner cable. To my shock I saw all of my work email, both "new" and "sent" ... starting about mid-afternoon that day. I never sent those emails to my personal cable account email on my iMac at home.

So, I call the cable company tech support and they tell me what to look for and where to look for it at work. Lo and behold, I see the eyeball in the green square in the Start menu, twice. I never knew the district had it. I had never seen it on my start menu and after asking to the the Start menus of at least ten colleagues... "Hey, can I see your Start menu...". Well, the spy only had eyes for me.

I call district IT, the guy comes out. No virus. Then I called the District IT Security Director, and he sends an email to like... six people, all directors.

Four days later... as in today another tech comes out... a different guy this time... and he does a complete reimaging and reinstall. He doesn't tell me much. He doesn't check for a virus. He doesn't check for anything. The only thing I could get out of him was...

"Well, the bottom line here is either you opened it or someone sat here and opened it after an unsuccessful attempt to remote access your computer. Or they sat here and did something malicious and wanted to make it seem like it came from you. Or they put it on your computer thinking that would be how it works. Regardless, somebody got in and that's pretty tough because they would need to know your password, but there is no way we will be able to find out." ... Seriously?

Is there any hope that the Security Director is looking and found something wrong? Because in his email he tells those other people to do a system check, and if needed send a guy to reimage. They sent that guy today.

Do you have any thoughts?

Answer 1

Your district IT security may be worried about the recent reports of ransomware locking up the files of institutions such as hospitals. If one computer on the network becomes infected by ransomware, it can be used as part of a botnet to infect the other computers on the network and hold their maliciously encrypted files for a ransom payable in Bitcoins too.

To prevent this from happening the Security Director suggested reimaging the hard drive. Given the high cost of paying a ransom to unencrypt maliciously encrypted files and the resulting scandal, this doesn't seem unreasonable to me.

The spying activity may be a smoke screen created by hackers to disguise their true intentions, which may go beyond mere spying.