Printable View
Recently a couple of users on my network were caught with inapropriate materials on their computers. Where there is one there are probably others, so we began digging through more user's machines and found even more. Go figure.
I am looking for a utility or something that I can use to scan my user's computers remotely for images and video. If it can be automated, then that is even better.
Has anyone else had to deal with this kind of problem before?
just do a file search for mpg's & stuff and jpg's & stuff. do it after hours so it doesn't bog down your server. if you use roaming profiles, you can also search for links and cookies to bad sites on the server.
over the years i have found some staff with this junk at work. warez as well. i just delete it automatically. i find that bringing it up with managers usually becomes a bigger hassle than it's worth. (i am in a unionized workplace. god help you if you get the union on your back!). you also sometimes get the 3rd dergee, "how much do you spy on staff!!"...blah blah... and if you have a policy - they will throw it back at you and accuse you of not doing a good enough job of promoting user awareness & policy awareness & stuff. all in all, causes big hassle.
anyways, not the kind of crap one wants to get into at work. there are too many other more important thing to do.
If your company's willing to drop some cash, I highly recommend EnCase Enterprise Edition.
Quote:
EnCase Enterprise Edition is a powerful network-enabled incident response system that provides immediate and thorough forensic analysis of volatile and static data on compromised servers and workstations anywhere on the network; without disrupting operations.
My experience is only with EnCase Forensic Edition (which I love) but EEE is highly regarded, and I've heard nothing but praise from my colleagues who use it. :D
Downfall: It's pricey. :rolleyes:
We have been mapping to the user's hard drives and doing searches that way but it is very time consuming and we have been short handed lately. Automation would greatly help in our case. We do not use roaming profiles here, profiles are restricted to the machines that the users log into.
I"m not too worried about unions here. The users all sign a network use policy and also complete a computer based trainign course regarding acceptable use. I got plenty of ammo.
Our boss is super PO'd about finding this crap on our network but due to the number of users involved, we just want to get the our machines (about 120) clean and start fresh. After this there will be no more chances or excuses heard.
Caf
If what you have been seeing is a large size of the hard drive being taken up we used a program called treesizepro What it does is allow you to locally or remotely scan the hard drive for the largest folders/files.... the best part is it will search all formats including hidden files and folder. This worked great for us because it will list everything and you dont really have to login to the comptuer.
Grab a sniffer. As just a start alone... I would be filtering out based on certian keywords, block access to sites with a certian number of images/links this would of course in turn kill off almost any porn gallery worth browsing, they all put 'em up in mass quantities but just in case im sure you could even filter out based on the size of the images & of course movies wouldn't be office documentation :p.
If your anti-porno thing is so important then why don't you just talk to someone who is most likely a good 80% of your problem... and probably should have been doing what some of your policies and agreements talk about in the first place, and thats watching out what goes on in the network... and by that, I am reffering to your lan-man.
Just to update. We have no control over the firewalls and filtering. That is already taken care of by another group of folks. I am the lan-man for the local network in our building. I have been tasked to implement a scanning policy just to keep an eye on things. So we will be scanning a couple of comps per week. Just to keep them on their toes and to let the users know that "the Man" is watching.
Surprisingly, this was never an issue before, or at least since I've been here.
Caf
You might also try Content Watch (free scanner for porn)
http://www.contentwatch.com/audit/index.php?pid=580-103
Quote:
ContentAudit is a free online tool that safely checks your PC for explicit or other unwanted content picked up from the Internet.
Greetings:
Hrm... I bet if I clicked on that link my computer would unintentionally cause a denial-of-service attack against their system.Quote:
Originally posted here by CXGJarrod
You might also try Content Watch (free scanner for porn)
http://www.contentwatch.com/audit/index.php?pid=580-103
:rolleyes:
CXG: ContentWatch sounds awfully familiar. Doesn't that have malware deep inside of it? I could have sworn I heard that it contains a form of spyware/adware.
Never heard of any malware. As far as I know it just scans your computer. I have used it on some of my more religious customers.Quote:
Originally posted here by Spyder32
CXG: ContentWatch sounds awfully familiar. Doesn't that have malware deep inside of it? I could have sworn I heard that it contains a form of spyware/adware.
LOL @ religious customers. Heh, oh well.. coulda sworn I heard it mentioned before in a list of products containing malware. I'll look into it though just because I like to get a "catalog" of sorts of product's/applications containing malware.
I think www.cexx.org has a list of spy/malwares and the applications that they infect.
Caf
Ehh, I dunno about clicking that link based on the name but.. :D Anyways, thanks regardless. Like I said, I'm currently compiling a big ass list of programs/software/products that contain malware.
i use treesize. i like it works good. i can't use the advanced features. i am not MS shop.Quote:
Originally posted here by Spyrus
If what you have been seeing is a large size of the hard drive being taken up we used a program called treesizepro What it does is allow you to locally or remotely scan the hard drive for the largest folders/files.... the best part is it will search all formats including hidden files and folder. This worked great for us because it will list everything and you dont really have to login to the comptuer.
All treesize does is find the largest folders/files? Heh.. could be useful on a network of a much larger nature IMO.
lockdown:
I have a recurring reminder in my Outlook that reminds me to send out the AUP to all users every three months. I also have a folder called "Sent AUP's" that I copy every one I send to. This way every user, even new ones that don't read what they are given when they start, get a copy of the AUP in the inbox every three months to the day.Quote:
they will throw it back at you and accuse you of not doing a good enough job of promoting user awareness & policy awareness & stuff. all in all, causes big hassle.
In addition, and in case they want to mess with it, the policy includes a statement saying that my company "has the right but not the duty". The benefit of that phrase is that if you miss something you can't be accused of doing the job improperly - if it was the _duty_ then things should not be missed and monitoring and checking the logs thoroughly and regularly mut take place and we all know that this isn't feasible. The "right" portion says that you _can_ but coupled with the "not the duty" means that you don't _have_ to. allowing you to monitor in specific cases should you so desire.
Caffiene: Are you able to put a hub at the choke point of your network? If you are a nice little Snort box could help you track the little buggers down since the "group of folks" is clearly dropping the ball on this......
I have had the same type of concern. I ran across a software program called LanSpider. I set it up to look for .avi, .mpg, ect......It nailed several systems. Hope this helps.
here's a cheap way out. unpack the files in the attached zip into their own directory and run start.bat. this will start a tftp server in that directory, copy and run mpeg.bat onto every (nt based) computer listed with net view. this will search the whole c drive of these computers for whatever file extentions you include (i've included only mp3 and mpg) and redirect the results into a text file with the computer name as it's name then tftp it to the directory you ran start.bat in on your computer. you should wind up with one text file for ever computer.
you must replace <yourcomputer> with your computer's ip addy or network name...as if you didn't know and have admin rights on the network.
start.bat
-----------------------
start tftpd
net view >lan.txt
for /F "tokens=1 skip=3" %%X in (lan.txt) do psexec %%X -c mpeg.bat
----------------------
mpeg.bat
----------------------
cd \
call dir /S *.mp3 >%computername%.txt
call dir /S *.mpg >>%computername%.txt
call %windir%\system32\tftp <yourcomputer> put %computername%.txt
----------------------
like i said it's a cheap way out and will take a very long time to complete it's run depending on the number of computers on your network. or you could change it to do one or a small group of computers at a time.
i've only tried it on one computer searching only for .avi files and it worked fine and see no reason why it shouldn't work on all of them. here's the text file returned to me by tftp:
Volume in drive C is Local Disk
Volume Serial Number is 54AC-656D
Directory of C:\Program Files\RoboHELP Office\RoboHELP\Template
08/08/1996 07:30p 58,094 blank.avi
1 File(s) 58,094 bytes
Directory of C:\Program Files\RoboHELP Office\VideoCam
11/01/1996 05:56p 441,806 CLOKDEMO.AVI
1 File(s) 441,806 bytes
Directory of C:\Program Files\RoboHELP Office\VideoCam\Sample16
12/01/1994 05:40p 577,552 TUTOR.AVI
1 File(s) 577,552 bytes
Directory of C:\Program Files\RoboHELP Office\VideoCam\Sample32
12/01/1994 04:40p 577,552 TUTOR.AVI
1 File(s) 577,552 bytes
Directory of C:\WINNT
05/08/2001 08:00a 82,944 CLOCK.AVI
1 File(s) 82,944 bytes
Total Files Listed:
5 File(s) 1,737,948 bytes
0 Dir(s) 13,157,864,448 bytes free
Tiger-Shark
The firewall shop seems to be on top of things. They run SmartFilter which is locked down pretty tight. The material that we are concerned about seems to be with laptop users who connect to outside networks (free hotel broadband, wireless access points) while on business trips and such. There is not much that we can do to stop that.
We're looking at locking the machines down harder to force them to only use dial-in to our network and then access the net via our proxy if this continues. If worse comes to worse I can clip out the contacts in the LAN ports with some wire snippers. In the end, the users will determine how we have to go.
Tedob1
Your stuff looks interesting, I'll get with some coworkers and play with it. Thanks.
Caf
Do you use logon scripts? If so, incorporate tedob1's idea with the logon script.
When the user logs in, have this automatically execute from some network drive that has already been mapped. You may have some public share drive that everyone can access? Then log it to some network drive and examine at your leisure.
They'll hate it.... but who cares.... ;)
Ever thought of some parental control proggie, or a keylogger that keys on certain content and sends you an email..... Just a couple of thoughts.....
You can also use 'sequoiaview' on shared drives as it will show the files with bigger size on a treemap.
http://www.win.tue.nl/sequoiaview/
Bad idea. The logon scripts will take forever to run, users will complain and see the search run.Quote:
Originally posted here by phishphreek80
Do you use logon scripts? If so, incorporate tedob1's idea with the logon script.