Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Keylog detector.

Posted on 2011-09-29
3
Medium Priority
?
332 Views
Last Modified: 2012-05-12
I'm doing the usual Google search for programs, does anyone have experience with a program that they would recommend?

We have acquired a client that has a disgruntled admin that has left, just doing do diligence best we can.
0
Comment
Question by:LanMan6401
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 83

Accepted Solution

by:
David Johnson, CD, MVP earned 2000 total points
ID: 36893196
keyloggers by design are stealthy. check cables for any additonal items. Check the keyboard(s) to see if they have been tampered with.  You want to do a full forensic trace? I hope this customer has a lot of money to support this piece of mind.

other than changing all admin passwords NOW if not done already .. remove that users account or disable it (remove it) and running sysinternals rootkit revealer and malware bytes on every server.

malware bytes will only find known keyloggers .. if this admin is smart he compiled his own.. check the autostarts on each server (sysinternals autoruns) and disable any suspicious items. If you find anything notify the authorities
0
 
LVL 64

Expert Comment

by:btan
ID: 36900990
Can check out rootkit razor which primarily surfaced stealthy trojan and backdoor
 Which allow callback to remote control the infected machine.
 http://www.tizersecure.com/tizer_rootkit_remover_features.php

We are looking at potential insider threat where remanent of doing can bring big impact. If the staff was having privilege to server and critical appl admin, suggest to revoke all associated right, credentials. detect for anomaly in network security log like brute forcing login or admin machine slowing down, making silent listening ports, etc.

Importantly, have mobile storage used by staff or within the critical server t ok be checked and if possible, formatted on the safe side. Better safe than sorry.
0
 
LVL 1

Author Closing Comment

by:LanMan6401
ID: 36926613
Thanks!
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Security measures require Windows be logged in using Standard User login (not Administrator).  Yet, sometimes an application has to be run “As Administrator” from a Standard User login.  This paper describes how to create a shortcut icon to launch a…
An introduction to the wonderful sport of Scam Baiting.  Learn how to help fight scammers by beating them at their own game. This great pass time helps the world, while providing an endless source of entertainment. Enjoy!
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question