Why does single user Windows XP machine say "Other users are logged in" at shutdown?

Question

My mother runs Windows XP on her computer. Apparently randomly, on shutdown the machine will report that other users are logged on and proceeding may cause them to lose data. As a non-expert, this makes her think that someone on the internet is hacking into her computer. As a partial expert, I do not think that's happening. Windows Firewall is enabled, her internet connection is via NAT, and I am fairly certain that the DHCP IP address she receives is not publicly routable.

I suspect there is some rogue software on her machine that logs on using another account. I'm at a loss for how to identify and kill it.

Assuming my guess is right; how can I identify software that's logging on using another account? I looked in Task Manager's process list; I don't see any surprising accounts in there.

If my guess is wrong; what might be causing it?

I'm a programmer. I'm happy to talk technical, although my system admin skills are much lower than my programming skills.

Answer 1

There is a possibility that the PC has been hacked, but barring that this is where you should start.

1. Are there shares on the computer? Remote users or devices could be accessing those shares and working with files. Shutting down could cause a loss of data for them. Hence the message. You may also see shares like $IPC or C$, those are administrative shares and are there by default.

2. Close all applications that you are running. Choose Start -> Run. In the window that pops up, type cmd then hit enter. type this in to the command line. netstat -an This will show you all of the active connections to that PC. Do you recognize them all?

3. Is remote desktop turned on? Click Start -> Control Panel. Then click System in Control Panel. On the Remote tab, clear the Allow users to connect remotely to your computer check box, and then click OK.

Answer 2

The application Process Explorer from Microsoft/Sysinternals (http://technet.microsoft.com/en-us/sysinternals/default.aspx) will show all user and system processes in all sessions, when run as administrator. If there is indeed an "other user" logged on, there will presumably be processes logged in a different user session.