Solved

need to sneak keylogger onto  XP home PC...

Posted on 2004-03-21
10
583 Views
Last Modified: 2013-12-04
I need to sneak a keylogger onto an XP home PC...

I'm working for a client who has a 17 yr old (minor) daughter. The daughter has an XP Home PC with NTFS and one account name which is the Administrator account. The daughter bought the PC so basically has control over it. The mother needs to surreptitiously monitor the daughter's email and chat. The situation involves a boy at another school making Columbine-like threats. The parents of other involved kids are communicating about it and each is monitoring their kid's involvement with this one child before they go to the police.

There is a password on the account so we can't get in without the daughter knowing it. I have NT Commander which will change the password, but we can't tip off the daughter. I did ghost the hard drive and then change the password on the copy, and installed it as master and booted off it. We looked at Internet History because the mom is also concerned about drug, alcohol and occult involvement, so we checked where she's been online. But what we really need now is to monitor her email and chat sessions to this boy.

She has a usb keyboard, so a hardware keylogger is out. I understand that they don't make them for usb keyboards. Is there such a thing as a "trojan"-like (not a virus) keylogger software that the parent could give to the kid with the pretext it was a gift and the kid would install it (maybe its a game or screensaver) and it also would contain a hidden keylogger that could save data that the guest account could access, or it would stealthily email info out?

Wondering how anyone else might have handled a similar situation.

Thanks in advance
0
Comment
Question by:DeptOneRick
  • 3
  • 2
  • 2
  • +2
10 Comments
 
LVL 12

Expert Comment

by:trywaredk
Comment Utility
No doubt about it - contact the police department

The can get a judge to give them a lawfull way of sneaking at your daugthers and the other involved kids, and the boy at another school.

I hope that they can stop it, before your clients daughter is getting hurt.

Many Regards
Jorgen Malmgren
IT-Supervisor
Denmark

:o) Your brain is like a parachute. It works best when it's open
0
 

Author Comment

by:DeptOneRick
Comment Utility
Hmmm. Okay. Well, I don't know that there is enough to go to the police yet, that is why my client contacted me, to try to help her do some looking. So, if anyone has some suggestions to this problem.. much appreciated
0
 
LVL 12

Expert Comment

by:trywaredk
Comment Utility
There was 2 reason that I adviced you to contact the police.
1. Read above
2. It's compromizing the rules for experts on this forum. So you and we has got a problem. We understand and would like to help, but we aren't allowed to advice on how to break security on windows systems. I trust you, but a hacker could anonymously write the same question...

According to Expert-Exchange Member Agreement - 3. Guidelines for Use - It's not allowed
http://www.experts-exchange.com/memberAgreement.jsp

Start with contacting the police, and hear what they say about it.
0
 
LVL 4

Expert Comment

by:zombieooo
Comment Utility
Here is a commercial product you may have a look at using.
http://www.omniquad.com/
I would, however contact an attorney to find out the legality in using this product in a home environment.

Joel
0
Free camera licenses with purchase of My Cloud NAS

Milestone Arcus software is compatible with thousands of industry-leading cameras for added flexibility. Upon installation on your My Cloud NAS, you will receive two (2) camera licenses already enabled in the software. And for a limited time, get additional camera licenses FREE.

 
LVL 38

Accepted Solution

by:
Rich Rumble earned 125 total points
Comment Utility
Sniffing the network is not aa invasive- and not easily detected... if the mom has her own computer... you could put ethereal (with libpcap) on it, and buy a hub to share the connection with the daughter. You can see all the plain-text that goes across the wire, as well as the destination of the email's...
or
You could dump the hash off the ghosted HD with a boot floppy (search for  "offline NT password & registry editor") (i don't recommend it on the original pc) you could put that hash into a cracker and crack it... or reset the pass (not before writing down the hash of the accounts on the box first- that floppy can tell you the current hash) thenyou could  reset it to what you'd like, and when your done, put the hash back in just as it was. If there is not antivirus software, then a keylogger of your choice...  ghost key logger... in theory
-rich
0
 

Author Comment

by:DeptOneRick
Comment Utility
Trywaredk: I don't see where it's compromising any rules. If you read my question carefully enough you'll see I'm not asking anyone to advise me on how to break security, either explicitly or implicitly. I simply asked if there was software out there that seemed like one thing to the recipient but had a hidden objective for the purpose of monitoring a minor. If the answer is no, then it's no. I appreciate your good intentions, but I think your admonitions are a little off base in this instance.

zombieooo: thanks. I took a quick look and didn't see how I could get that on the PC without the daughters password. I will look further though.

richrumble: two good ideas. The first is not practical for this situation, but good nonetheless. The second is a possibility. That is a very good suggestion. The only part I'm not familiar with is putting the hash back as it was. How is that done?
0
 
LVL 38

Expert Comment

by:Rich Rumble
Comment Utility
IF you serach for that phrase, in theory you'll find a floppy boot disk that can tell you what the current hash's are, let you reset them, and then place them back if you wrote them down- never disable syskey with a "theoritical" boot floppy, as that step is never necessary. Read instrctions carefully, and test on a machine you care nothing for so you get it right :) Instructions should be there on the top result from that search.
-rich
0
 
LVL 17

Expert Comment

by:Karen Falandays
Comment Utility
Wow, I can relate. I actually had some problems with my teenagers on IM and chat, so we finally told them that we are going to monitor them and their friends. We ALL get monitored at work, so it's no big deal. I don't care if she paid for the computer..she is still a minor and the parent still has responsibility to supervise all activity.

On that note, we use two different programs:
IM Grabber will keep logs of most instant messages, but the kids can turn it off too easily, and it craps out
http://www.bitsplash.com/imgrabber/

I love kiddefender, as it grabs chat, IM AND all web sites. Kids can not turn it off. In addition, you can install it on other computers (like at work) and monitor LIVE REAL TIME. Let's you block certain im'ers too
http://www.kiddefender.com/press/082003.html

Finally, I didn't have much luck with beAware, but you might
http://www.ascentive.com/run/click/@426340574732/

Good luck, and don't wimp out. It's a crazy place out there. Police cant do anything until there is blood or something concrete!
Karen
0
 

Author Comment

by:DeptOneRick
Comment Utility
I think these two posts fro richrumble are probably my solution, however I'm unable to try it out because the customer is satisfied with looking through the History on the browser. If I did have to go the next step, this is probably what I would've done. Thank you!:
=============
You could dump the hash off the ghosted HD with a boot floppy (search for  "offline NT password & registry editor") (i don't recommend it on the original pc) you could put that hash into a cracker and crack it... or reset the pass (not before writing down the hash of the accounts on the box first- that floppy can tell you the current hash) thenyou could  reset it to what you'd like, and when your done, put the hash back in just as it was. If there is not antivirus software, then a keylogger of your choice...  ghost key logger... in theory
-rich

IF you serach for that phrase, in theory you'll find a floppy boot disk that can tell you what the current hash's are, let you reset them, and then place them back if you wrote them down- never disable syskey with a "theoritical" boot floppy, as that step is never necessary. Read instrctions carefully, and test on a machine you care nothing for so you get it right :) Instructions should be there on the top result from that search.
-rich
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

As I write this article, I am finishing cleanup from the Qakbot virus variant found in the wild on April 18, 2011.  It was a messy beast that had varying levels of infection, speculated as being dependent on how long it resided on the infected syste…
Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now