On Jan 23, 2008 5:54 AM, Michael Ross <[EMAIL PROTECTED]> wrote: > anyone know a way to view a remote pc's current user key? i want to see what > stand alone apps a user is runing. i know he is using a torrent app, and i > need to find it stealhily.
How sophisticated is this user? As suggested, pslist (or tasklist, the native XP utility) can be run periodically. You could put together a batch file that searches the drive for the listed tasks that aren't known (svchost.exe, lsass.exe, explorer.exe, etc.), and which then creates a list of those files and an MD5 hash of each (md5sum is part of the package at http://gnuwin32.sf.net), or perhaps even copying the executable to a hidden directory. Also, think about using the Local Security Setting to turn up process tracking under audit - this may be sufficient to show what's happening. You can pull the event log remotely when he gets back into the office, and do some analysis of that Kurt ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
