Need your help mates...fast

Hi all....



I really need to know how to retreive cookies that were just cleared from internet options.

I'm suspecting someone of being a hacker who is trying to zombify one of the computers in my Internet Cafe. I allowed him to use a USB flash disk. I took screenshots of some of the screens he had opened because they were suspicious. He had an Explorer type softare which was showing him the details of the C drive...and on the other side it was showing his USB drive which in it had some programs a hacker would carry with him. I'll give more detail later on including screenshots.

Thnx for your help

Hi Cyber......

What OS are you running?

Why cookies :confused: I would have thought trojan/backdoor/keylogger given that they had physical access?

Also if the cookies are really gone, how can they be of any harm

The screenshots would be interesting

Cheers

IIRC windows stores cookies as text files, so an undelete utility might work.

If this is the case the less writes to the hard disk the greater the chance of recovering the files, so make sure the machine is switched off.

Take out the HDD and then use another machine to work with it.

Norton Disk Doctor could be your friend.

Hope this points you in the right direction.

Steve

runnign WinXP home ed.

Well he had a folder called BugBear Virus...

A little research on bugBear shows that its a mass mailing worm, which drops a backdoor on the infected computer and allows the hacker to get into the infected machine through a GUI.

The reason why I asked for the cookies is because he went and deleted them for some reason (Maybe he didnt want anyone to see where he went?) He did visit some websites though..that weren't suspiciouis at all (music and shows).

Attached is a screenshot of the program that he was using.


It could be nothing but Its a little bit odd seing a 60 year old man with Viruses in his USB drive. What business would he have screwing around with my computer?

http://www.theabsolute.net/sware/dskinv.html

or

http://www.pcinspector.de/file_recovery/UK/welcome.htm i have pc-inspector installed here and you can definitly restore cookies you can even restore them to another directory for inspecting or archiving

Quote:

---

It could be nothing but Its a little bit odd seing a 60 year old man with Viruses in his USB drive.

---

I have got to get a couple of those usb drives.
If you were to explore my backup CD's, you would find several folders that contain various virus's and trojans I have collected. Most of these I have been moving to floppies for increased security, but I collect some of them for future study (future because I don't feel I know enough to explore them yet).
And I am 57.
As for deleting cookies, if I were using someone elses machine, I would delete all cookies and history (including all offline content) as I cleared off their machine. Simple security (privacy) policy.

true that :)

Hey I bought 128MB ones for $20 dollars...:D

They had a huge sale one day...64MBs ones for 20 bucks...then a week later they put the 128MB ones for 20 bucks too YAY ME :D


Ok i'll just forget about the cookies. What i'm planning on doing is to install a PC-SPy program and monitor his activities next time he comes in. Anyone else got any other ideas?

may i ask? do you take screen shots on a regular schedule or did you do it becase you wanted to see what he was up to? if its the later youd be better off using slarty's gen control it uses rpc to start a vnc session without diplaying the systray icon. you could also install vnc on them all install the service and set it to manual start then psexec \\thebox net start winvnc. the server will start without diplaying the tray icon. periodic screen shots are a good idea only if you review them.

what are you useing for screencaps?

moxnix i thought you aroung that old by your name...nato, germany, circa 1970

If you are going to go to the trouble of monitoring activities, don't you need to display a sign or something saying 'You may be monitored for security reasons' or similar, otherwise couln't you be sued for invasion of privacy...

You could even be accused of stealing bank passwords etc.

HTH
Steve

anyone that would use a cc on a public computer should have it taken away by the cc company...theirs no patch for stupidity but ill betcha dollars to donuts the sign is already up.

just because theres a folder named bugbear does not mean it contains the virus. he could have been collecting info on it...maybe he or someone he knows caught it.

Could it be that he downloaded a fix/fixes for bugbear.......?..............I test a lot of software and usually put the download into a folder with its name.........also, why a folder.......it should be a single file?

I would have expected him to be a bit more subtle? Like give it a name such as "toolbox" or something?

Just a thought..............but you are right............it pays to be careful :D

Cheers

Hmm...Interesting points brought up here. I was thinking about the privacy issue, but if I give him a warning, then he wont try anything...and I want to catch him redhanded (Mainly for my own curiosity). I would not report him to the authorities or anything...i just want to make sure he's not screwing with my PCs.

Thank you all for all your help. I really appreciate it.

do you have a caching proxy on the gateway? if not you could install a personal fire wall on each machine. set it to allow everything and also to log everything then send the messages to a syslog deamon on your machine. you really should hang a sign that says "internet usage may be monitored" or "we reserve the right..."

HMM...I probably will do that :D

Cybrid:

1. You reserve the right..... But not the _duty_... Very important legally....
2. When he comes in.... Ethereal his box.... Simple.... We can help interpret the results.
3. Because someone has a folder called bugbear is no big deal. I create folders all the time with virus names whan I d/l the fix tool, (a point already made)
4. As far as his cookies are concerned.... What do you want... his surfing history? Cookies only show the sites he went to that give out cookies. If he 1337 then he won't be visiting places that send out cookies.... Kinda counter-productive really..... ;)

This suspicious old fart thinks you are being a tad paranoid at this point..... You run an I-cafe... you're gonna see some funny $h1t..... You either have to live with it and have your machines locked down or you allow and monitor to cover your own rear.... If you are going to get worried over every last little thing in your business then you will be stressed out before you know it.....

Quote:

---

Originally posted here by Cybr1d
Hi all....



I really need to know how to retreive cookies that were just cleared from internet options.

---

Unless he used software to delete the cookies index.dat file and then rebooted, you can still view your cookies. Here's a freeware program that you might be interested in http://www.exits.ro/index-dat-viewer.html.

I put notices on the wall saying "We reserve the right to monitor your online session at our discretion".

The reason why I wanted to dig deeper into this was mainly my own curiosity. I'm still new to the security world and I have a very long way to go. I've recently been getting myself involved more into Intrusion Detection and Network Forensics. I collected some data from this individual's online session...perhaps in my own head making a report and coming up with as much information with little resources. *Just challenging my brain :D*

LOL sorry I sounded a bit paranoid ealier...perhaps I was...Although I didn't think of the fact that he might have the cure to the virus in that folder :). I've learned a few lessons today...:)and sure am glad to. Thank you all for your productive answers. Now I remember why I come here 9-10 times a day LOL

I use a program called Clean Disk Security that has a feature that allows you to view and even restore erased files as long as they havent been writen over yet. It has proved to me that even Evidence Eliminator doesn't do as it says and is not very reliable.

Quote:

---

I put notices on the wall saying "We reserve the right to monitor your online session at our discretion".

---

Yes and that isn just exactly what you should do. Not every person, every time, but random checks or if someone trips your trigger.
Legally, you are covered by your sign, and yet have not made it your responsibility to monitor everyone.

And yes Tedob1.....NATO/Germany but 1965-1970.

bigger than stuttgart! thats circa! :-)