Key Logger
Results 1 to 10 of 10

Thread: Key Logger

  1. #1
    Banned
    Join Date
    Sep 2002
    Posts
    33

    Key Logger

    Hello,

    I need some help, I'm an admin at a school and I have network reports of a key logger on the network. Now, I've narrowed it down to 12 nodes.

    Another aspect to take into consideration is that there is a specific user on the network who has the Key Logger installation program in his personal folder and says that he was hacked awhile back and this file was planted there. This user has been used in the past to find security holes and is extremely knowlegable on networks and security. Though, he claims he didnt plant the logger.

    My final question is---> How do we locate the user who DID plant this logger? Keep in mind that there are 12 nodes with keylogger data on them, NOT including the node that the user previously mentioned works on.

    PLEASE HELP
    SANDMAN

  2. #2
    Banned
    Join Date
    Sep 2002
    Posts
    33

    Key Logger

    Hello,

    I need some help, I'm an admin at a school and I have network reports of a key logger on the network. Now, I've narrowed it down to 12 nodes.

    Another aspect to take into consideration is that there is a specific user on the network who has the Key Logger installation program in his personal folder and says that he was hacked awhile back and this file was planted there. This user has been used in the past to find security holes and is extremely knowlegable on networks and security. Though, he claims he didnt plant the logger.

    My final question is---> How do we locate the user who DID plant this logger? Keep in mind that there are 12 nodes with keylogger data on them, NOT including the node that the user previously mentioned works on.

    PLEASE HELP
    SANDMAN

  3. #3
    Senior Member
    Join Date
    Apr 2002
    Posts
    634
    The keylogger probably sends its infos somewhere, so check with your logs where is this "somewhere" and trace who can view it or who accessed previously to it. It's more than probably the same person who planted it.
    If this "somewhere" is out of your network, it could become more difficult to trace the user but it's still possible.
    Life is boring. Play NetHack... --more--

  4. #4
    Senior Member
    Join Date
    Apr 2002
    Posts
    634
    The keylogger probably sends its infos somewhere, so check with your logs where is this "somewhere" and trace who can view it or who accessed previously to it. It's more than probably the same person who planted it.
    If this "somewhere" is out of your network, it could become more difficult to trace the user but it's still possible.
    Life is boring. Play NetHack... --more--

  5. #5
    Senior Member roswell1329's Avatar
    Join Date
    Jan 2002
    Posts
    670
    Yaya, KissCool is right. I would probably download a free port scanner, and watch the traffic moving across. If you find a particularly active node, you've probably found your culprit (or at least someone who's probably doing something they shouldn't ). That's how I'd do it.
    /* You are not expected to understand this. */

  6. #6
    Senior Member roswell1329's Avatar
    Join Date
    Jan 2002
    Posts
    670
    Yaya, KissCool is right. I would probably download a free port scanner, and watch the traffic moving across. If you find a particularly active node, you've probably found your culprit (or at least someone who's probably doing something they shouldn't ). That's how I'd do it.
    /* You are not expected to understand this. */

  7. #7
    Ive had experiences with keyloggers that log in a text file in the root directory of your startup drive. check there for incriminating words such as keylog.txt, keys.txt, klog.txt, klogger.txt and the like.
    THEprophetMOSES

  8. #8
    Ive had experiences with keyloggers that log in a text file in the root directory of your startup drive. check there for incriminating words such as keylog.txt, keys.txt, klog.txt, klogger.txt and the like.
    THEprophetMOSES

  9. #9
    The Lizard King SarinMage's Avatar
    Join Date
    Jan 2002
    Location
    California
    Posts
    561
    if individual users have there own directories, search all of their directories for any files that sound incriminating, IE prophets .txt file reccomendations, or any variant.....

  10. #10
    The Lizard King SarinMage's Avatar
    Join Date
    Jan 2002
    Location
    California
    Posts
    561
    if individual users have there own directories, search all of their directories for any files that sound incriminating, IE prophets .txt file reccomendations, or any variant.....

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •