**Tech Support Detective Solved PC Crime by Looking in the Carpark**
On a typical night shift, a tech support detective stumbled upon a sticky situation in the candy factory.
Parker, our reader-submitted hero, had been tasked with fixing the PC of a floor manager responsible for production. The manager's computer was running Windows XP, and at just over a year old, it should have been performing decently. However, Parker soon discovered that the machine was crawling along like a snail on valium.
As he dug deeper, Parker found an array of malicious programs installed on the PC, as well as an unauthorized local account called "offtime." Given his relationship with the manager – whom he considered a friend and straight shooter – Parker couldn't imagine that he had anything to do with this mess.
Log files confirmed Parker's theory: the malicious software was installed between 8pm and 4am, well outside of the manager's regular working hours. Initially, Parker suspected a remote hack, but the firewall logs revealed nothing unusual connecting to the machine other than HTTP/HTTPS traffic.
Parker obtained the manager's permission to remove the unauthorized programs and install a monitoring tool that took screenshots of the PC every five minutes. Critically, he left the "offtime" account in place.
The next morning, Parker reviewed the stack of screenshots and discovered something astonishing: the "offtime" account was being used to visit a dating site, with some of the usernames including "RedVette." Parker's investigation revealed that RedVette was actually a mechanic on the midnight shift who owned a red Corvette.
Parker also found evidence that another mechanic on the night shift had accessed the PC using the "offtime" account and spent several hours browsing sites dedicated to guns and hunting. Parker knew these were the passions of this particular mechanic, further solidifying his suspicions.
Armed with this evidence, Parker shared it with the manager, whose face turned bright red with anger upon learning that two of his mechanics had been using their downtime to indulge in extracurricular activities on company time. The maintenance tasks were significantly behind schedule, and it looked like RedVette and his mate were the culprits.
The manager asked Parker to kill the "offtime" account, which he did, as well as lock down all office PCs to prevent creation of local accounts. However, Parker didn't stick around for the dramatic confrontation that likely ensued between the manager and the two mechanics. "I was not involved in the conversation between the manager and the night shift mechanics when they came in that evening," Parker told On Call. "But I suspect it was short, loud, and one-sided."
Unfortunately, Parker's actions had a sour post-script: his colleagues gave him the cold shoulder for several years after the incident, until he eventually left the company.
Have you ever busted your colleagues doing something they shouldn't be doing? Share your story with us by clicking here to send an email to On Call. We never rat out our contributors – their name and workplace are always kept confidential in On Call!
(Image credits: shutterstock)