URGENT: How to retrieve Screen Sharing History

[zero hectic]

Sorry for the cross post, but need help. Believe I caught someone using screen sharing to spy on my computer. Attempted to grab the ip address from the Screen Sharing icon in the menu but they disconnected before I could get anything more than the first two numbers. Was hoping to find out if someone knew how I could retrieve the history of what IP addresses have connected to my computer.

Thanks!

[ELMNT925]

OK, the only way someone could share your screen is if you accepted a dialogue box giving them permission. And really, what could they of done besides caused you slight irritations?

[zero hectic]

Nope, they VNCd in and were rifling through my web browser and my Paypal account when I caught it. Noticed the mouse moving and they Screen Sharing icon in the menu bar. When I tried to write down the IP they disconnected. Spent the last few hours changing all my passwords. Would love to pull the intruder's IP and hand it off to the police.

[chown33]

If your computer is connected through a router, maybe the router itself has that feature. It could be named many different things, depending on exactly which router you have.


Or try this. Copy and paste this exact command-line into a Terminal windows:

arp -a

It may or may not show anything useful. It's a time-dependent cache, so if too much time has elapsed, it won't show anything useful.

Even if you identify an IP address, there's no guarantee it's of any use. For example, see this thread:
http://forums.macrumors.com/showthread.php?t=1472546

[hfg]

If you look in SystemPreferences/Sharing, is "Screen Sharing" checked? If so, you might want to uncheck it.

[snberk103]

Go to Preferences > Sharing

What is the status of "Screen Sharing"? If it's turned on, do you need it on? [hfg beat me to this one]

Change the User passwords, especially the ones that give you Admin privileges.

Make sure that you have set the computer to ask for a password whenever you use your computer. It also possible that someone you know has had physical access to your computer when you aren't around.