Re: Need Help Security issue

From: Leythos (void@nowhere.com)
Date: 03/28/03 

From: Leythos <void@nowhere.com>
Date: Fri, 28 Mar 2003 00:24:26 GMT

In article <guMga.17707$ns6.842332@news2.east.cox.net>, "Steve"
<sklives@(remove)cox.net> says...
> The OS is Win ME
>
> Thanks.......................Steve
>
>
> "Steve" <sklives@(remove)cox.net> wrote in message
> news:lKpga.10268$ns6.555751@news2.east.cox.net...
> > Are there any traces left on a computer of the time and date websites were
> > visited, other than the time stamp left by the local machine.
> >
> >
> >
> > I know this is confusing so let me explain.
> >
> >
> >
> > If someone changed the clock on a computer to a time and date when
> another
> > employee was using the computer. Then the person accesses pornographic
> > material leaving hundreds of temporary internet files and cookies on the
> > computer for the boss to see. I need to know if there is any way to tell
> if
> > the clock was changed while those porn sites were accessed. Will someone
> > please help because a good man's career and family is at stake here!

Does the company in question have a firewall? If they have a firewall
they can look at the logs and determine when that computer was accessing
the questionable material - the firewall clock can't be reset by a
standard user (unless they are also the firewall admin).

There is going to be little anyone can do if they changed the time on
the computer on a Win ME system - there is no security on ME.

There might be an eventlog entry about changing the time, but I don't
think that ME logs that info. 

-- 
--
Leythos999@columbus.rr.com
(Remove 999 to reply to me)

Relevant Pages

  • Re: Strange WAN Activity
    ... > firewall logs for a possible TCP FIN scan that keeps ... > company's intranet server IP and its port 80 across our ... > My firewall is a Sonicwall Pro 200 and I'm running W2K ... It's difficult to be sure without inspecting the web server for signs of ...
    (microsoft.public.win2000.security)
  • Re: Winvnc hack! [25 KB]
    ... came in from a service such as IIS that logs IP address. ... Check your IIS ... Some firewall software such as ... You can also use the NETSTAT -A command that comes with Windows to look at ...
    (microsoft.public.win2000.security)
  • RE: [fw-wiz] Log checking?
    ... tend to evaluate where and what logging is important in a different light. ... I've been happy to analyze a year's worth of firewall denied logs, ... have denied firewall traffic logs or denied logs with any relevant data. ...
    (Firewall-Wizards)
  • Re: false portscan alarm
    ... What is the reason of that treffic? ... and the browser and/or the "personal firewall" had decided to close those ... which each have a local source port above 1024 opened outgoing to port 80 ... I've had a dig through my own PIX logs, and while there is nothing for today ...
    (comp.security.firewalls)
  • Re: SOHO firewall dropping incoming 443 connections - incorrect state
    ... I take it this sample snip of your logs is from a single session? ... client host connecting to the firewall was a single host. ... because of the nature of HTTPS requests it uses a different ephemeral ...
    (comp.security.firewalls)