batch file to copy internet history 3

[mfulton]

Hi everyone. I hope someone can help me

I need to creat a batch file, to use in a scheduled task, that will copy either the History file or the Temporary Internet Files folder to another folder on C drive. I also want this task to run in the background so it won't be noticed by the user. I'm having trouble with actually copying anything out of either of these folders.

Thanks

 

[gargouille]

MOST people wanta' get rid of them.

The problem is caused by the fact that they look like folders, but are just doors to container applications
...try copying your own history and cache to another folder. Won't do.

Your problem would maybe be better resolved by restricting where someone may go...Win98 isn't very admin friendly is it?

Another way might be to move their cache OR tell IE not to delete the cache at shutdown...but a really savvy user would pick up on that.

Then there are keyboard snoops...but that'll make your job (I'm guessing) tedious going thru it.

From find elsewhere:

History Inspector & History Reader for Internet Explorer
Both programs are shareware - details and free trial download from:

http://ourworld.compuserve.com/homepages/w_baudisch/

I have another old hard drive with some such stuff on it...mebbe I can get it running to fetch it for you.


Can you just fire the person? (just kidding here)

 

[tviman]

First, check that some of these files aren't hidden. If so, you'll have address that issue by setting and resetting the file attributes. Second, many of the temp files are being used and therefore not available to copy. There's always a better way...

 

[mfulton]

I'm trying to figure out who is using a certain computer sometime after working hours to surf the net. If I can determine what time they tend to be here, someone can come here and see who it is. I'm running win2k server with win98se clients, but they don't have to log onto the network to gain access to the internet and I'm not running a proxy server so can't restrict access. This person is deleting temporary and history before shutting down so I wanted to run a scheduled task every 10 minutes from about 6pm to 6am (in the background) to copy the history or temporary internet files to another folder.

I know there's something weird about their attribs but can't figure out how to get around it. They aren't hidden though. I already tried copying stuff out of the folder and it just does nothing. What's really weird is that I copied a word file into the temporary internet files folder and the batch file I created copies it, but I can't see the file when I browse the folder?????

Money is an issue, we are a non-profit and the powers that be never want to spend any money so I have to figure out how to do these things for free. I'll look at the link, gargouille, and see what I find, thanks.

Any more ideas?????

 

[rockerfellerz]

You should read over the info on this page

http://www.remainsecure.com/whitepapers/hacking/mshidden.htm

This should help you find out what's going on.Apparently, just telling windows to delete the history doesn't really delete it at all as is explained in the article.
good luck.

 

[mfulton]

But I don't want to delete them. I want to save them to another folder that the user doesn't realize also contains a copy of their history or temp internet files.

 

[JLSigman]

Can you tell the Windows 2000 server to just deny access from 6pm to 6am? Jennifer Sigman
1/2 of the IT staff

 

[mfulton]

I don't think so. I've been trying to figure out how to do that for a while now and can't seem to come up with anything that doesn't include proxy software. Do you know how to do that?

 

[rockerfellerz]

I realise you don't want to delete them, but since a record remains even when the luser deletes them you should be able to see the records anyway by booting to dos and viewing the dat file in question with the dos edit command as explained in the article.

 

[mfulton]

Ok, I'm going to see what I can find that was left behind in any of the content.ie5 subfolders. Thanks.

 

[JLSigman]

My bad, I went back and re-read the note where you described the situation in detail... You're sure someone is doing this? I guess one thing you can do is unhook the hub (or whatever the cables come in to) at night and plug them back in the next morning. Or, depending on how savvy your users are, unplug something (the network cable or the power switch) in the back every night.

If the computer in question is not one that you think this person would normally use, you could also put a BIOS password on it. Jennifer Sigman
1/2 of the IT staff

 

[gargouille]

Occurs to me that there's an (don't have it right her under my fingers...) application written by seems like Jim Eshelman...one of the M$ MVP's...called "require authentication" that I've used to semi-secure Win98 machines...if I remember right (that one's a tossup!) LOL
it even precludes booting with a floppy. I'll search for it when I answer the 42 other messages in my Inbox. Unless this poisson is an expert hacker it should work.
If they are, even my system is at risk. These kids are very good...
Haven't tried the BIOS password thing...but my 1st feeling is that it would only lock access to the BIOS and has some inherent dangers > 'course I'm not right all the time!

 

[BeenThereDoneThat]

mfulton:

Click on the link below, scroll to the bottom of the page and read what it says about Winlogger. It may help.

http://aigarsoft.yo.lv/downloaden.html

 

[MiggyD]

Suggest you try stoping them at the server.

Open Active Directory,
locate Users,
right click everyone/guest, select properties
(since no one has to logon I'll presume GUEST)
move through the tabs till you find the time restrictions and fill/unfill in the blocks.

If you have a problem locating it, post back. I'm currently at a 98 station but have access to W2k Svr. and can give more specifics.

--MiggyD

 

[mfulton]

I've had bad experiences with BIOS passwords so don't want to go that way. I don't want to lock someone out of this particular computer. I need to see who is using the computer. If they can't get on this computer, they'll just use another one and then I'd have to lock them all. I can't disconnect the network at night because there might be some valid need for work at night and I leave work before most users anyway.

What is happening is that this person is getting on this computer after hours (presumably), going to bad websites and saving these sites in the favorites. The person whose computer this is doesn't like it and want's it to stop. It is a stupid, childish thing to do (I haven't ruled out an employee's child doing it) and we need to know who is doing this. Soooooooooo, I want a serruptitious way of discovering who it is ;-)

I hope I've explained it a little better. I was trying not to make my post too long.

 

[MiggyD]

1) how are you going to find out if users don't have to logon to the system? Are they (all 98s) acting as domains?

2) have you checked the 98 machine/windows directory and looked for PWL files?

If not check out the SYSTEM.INI file (mostly near the end of the file) this will give you a list of USERS that are supposed to have access to that particular computer. If there is only one listed then the purp KNOWS the innocent's password. Have him/her change it.

Click control panel/passwords to change the user's psdw and remove all others/non-essential persons (hopefully it's not one of them.) When the purp tries and fails at the password (HOPEFULLY) they try their own instead of clicking 'cancel' then you'll be able to see the newly created PWL file with a timestamp.

If this is the case then (again HOPEFULLY) there is a Sign-in sheet or punch clock ticket that you can try to narrow down the perpetrator(s).


Again the really good way to secure the system is to create accounts for each user and place them in account groups and restrict access through the server. I'd suggest you go to the W2k forum on this site and ask there for security measures.

--MiggyD

 

[gargouille]

Came back again with my Sherlock cap and pipe, my dear, and am sorry to infourm you LOL that even if you copy the history and cache...where will you find this fiend's fingerprints?
Lemme take this darned hat off so I can see...what I'm saying is that even with the information you're trying to glean...ANYONE could have done it and you'll be none the wiser with the files you've collected.
Unless I'm missing something...sometimes I do.
Occurs to me you may already be able to see WHEN the shortcuts were created...which would also help you nail down WHO was around then...it's a 98 machine...do a search for the favorites folder and open it...it'll have the date they were created...if you choose details. (I hope, he sez, looking into his WinXP screen)

 

[DucatiST2]

You could check the time the PC's were turned on by adding a couple of lines in the autoexec.bat
eg:

@echo @prompt $d - $t > %temp%\{Temp}.bat
%comspec% /e:2048 /c %temp%\{Temp}.bat >> %temp%\logit.txt
del %temp%.\{Temp}.*
cls

This would create/add the date and time to logit.txt in your temp folder, then you would know at what time they are using the machines.

 

[mfulton]

I have checked the .pwl files and determined the user must be cancelling through the logon. Before I started snooping, they started deteting history and temp files and not saving in the favorites anymore. The reason I want to know when they are getting on, which seems to be a daily thing, is so someone can come up here and catch them. Even though they aren't leaving the trash on the computer anymore, it's a principal thing now.

I'm going to try adding the syntax to the autoexec.bat file, which seems the easiest, and check out any remnants left in the content.ie5 folders through dos, and try the winlogging program.

Thanks to all for your suggestions

 

[mfulton]

I couldn't find any information going through DOS to the content folders or index files.

I did get the lines added to the autoexec.bat file and that works perfectly, creating a file that shows the date and time that the computer is turned on. It seems like the easiest approach.

Thanks, again, to everyone for your help. I'll have to remember to post when we catch the "perp" ;-)