Checking info on bad employee
Results 1 to 12 of 12

Thread: Checking info on bad employee

  1. #1
    Registered User Niclo Iste's Avatar
    Join Date
    Oct 2007
    Location
    Pgh, PA
    Posts
    2,051

    Checking info on bad employee

    So I've been put on a test at work. I am forced to share a desk with a slob, liar, and slacker. He's so far installed a bunch of programs and claimed I did it to try and get me reprimanded or fired. I need to know how I can prove who installed it, when and also after the fact that they've been uninstalled. Mind you not a wiped hard drive. The biggest problem is McAfee as it's a huge no no here to install antivirus that isn't authorized. I need to figure this out before monday.

    I also need to find a way to track his internet traffic as well. He wipes his history but I recall a way to track through the registry. Any ideas?
    Last edited by Niclo Iste; April 19th, 2011 at 10:00 AM.
    One Script to rule them all.
    One Script to find them.
    One Script to bring them all,
    and clean up after itself.

  2. #2
    Registered User Guts3d's Avatar
    Join Date
    Jan 2003
    Location
    Pittsburgh U.S.A.
    Posts
    2,328
    Punch him inna face. Then check both the system log and application logs. Then, verbally abuse him, making light of both his dubious ancestry and his offensive odors. I got your back.
    " I don't like the idea of getting shot in the hand" -Blackie in "Rustlers Rhapsody"

    " It is a proud and lonely thing, to be a Stainless Steel Rat." - Slippery Jim DiGriz

  3. #3
    Registered User Niclo Iste's Avatar
    Join Date
    Oct 2007
    Location
    Pgh, PA
    Posts
    2,051
    I already tried looking at the event viewer, only me removing it showed and nothing about it being installed showed at all.

    Believe me I will break his nose if I end up on the elevator with only him.
    One Script to rule them all.
    One Script to find them.
    One Script to bring them all,
    and clean up after itself.

  4. #4
    Registered User MobilePCPhysician's Avatar
    Join Date
    Jan 2002
    Location
    Cleveland, Oh
    Posts
    2,384
    Install a software keylogger.
    Sergeant WOTPP

  5. #5
    Registered User CeeBee's Avatar
    Join Date
    Nov 2002
    Location
    USA
    Posts
    2,494
    Unless he is an expert there will be traces left (temp files, installation files etc). Look at file attributes and see who the creator is. Hopefully you don't share the login...
    Side note: many programs leave traces in %appdata%\local\temp
    Last edited by CeeBee; April 19th, 2011 at 03:53 PM.
    Protected by Glock. Don't mess with me!

  6. #6
    Registered User Niclo Iste's Avatar
    Join Date
    Oct 2007
    Location
    Pgh, PA
    Posts
    2,051
    He may be using a scrubber program at the most. From what I have been told he's about as good at IT as a blindfolded monkey having a seizure.
    One Script to rule them all.
    One Script to find them.
    One Script to bring them all,
    and clean up after itself.

  7. #7
    Registered User slgrieb's Avatar
    Join Date
    Feb 2003
    Posts
    4,103
    Usually it's best to stay frosty, do your job competently, and let these guys hang themselves. As a manager, I always saw the backstabbers and whiners as people that had to be treated with a little caution, but ultimately gotten rid of. Even if they happen to be pretty skilled, they disrupt the team too much are are ultimately a liability. You want to be careful not to start sounding like him, but with less seniority.
    Last edited by slgrieb; April 19th, 2011 at 06:44 PM.

  8. #8
    Registered User Niclo Iste's Avatar
    Join Date
    Oct 2007
    Location
    Pgh, PA
    Posts
    2,051
    I just want the paperwork as my ace in the hole if somehow he does get me in some trouble.
    One Script to rule them all.
    One Script to find them.
    One Script to bring them all,
    and clean up after itself.

  9. #9
    Registered User nunob's Avatar
    Join Date
    Oct 2002
    Location
    Washington
    Posts
    597
    http://www.nirsoft.net/computer_forensic_software.html

    The IECacheview program is nice. I always run these things on the drive external not on the sytem live.

    You may also consider that he is using a USB drive to do this in which case I typically just disable in gpedit.
    Can't never did anything except whine about what he couldn't do.
    Do, or do not. There is no try.


    http://www.northernaurora.com/page/index.html
    http://www.northernaurora.com/page/chat.html Free Chat

  10. #10
    Registered User slgrieb's Avatar
    Join Date
    Feb 2003
    Posts
    4,103
    Quote Originally Posted by Niclo Iste View Post
    I just want the paperwork as my ace in the hole if somehow he does get me in some trouble.
    I understand the scenario, and many years ago I figured out that one of my bosses was stealing a bunch of merchandise. Whenever I sat down with him to track our shipping and receiving records, he always got "frustrated" and quit before we could reconcile the numbers. But this was when I counted boxes and read bills of lading to generate reports. Yes, I made copies of every receiving record and "put in service" order I did for merchandise, but that was a hole card I never wanted to play. In the digital age, it's too easy to fake much of the record keeping.

  11. #11
    Registered User Niclo Iste's Avatar
    Join Date
    Oct 2007
    Location
    Pgh, PA
    Posts
    2,051
    No more worrying about this anymore. I got given my own desk and now he has to share with someone who has more clout than him.
    One Script to rule them all.
    One Script to find them.
    One Script to bring them all,
    and clean up after itself.

  12. #12
    Registered User Guts3d's Avatar
    Join Date
    Jan 2003
    Location
    Pittsburgh U.S.A.
    Posts
    2,328
    I'll still come over and punch him inna face. I'll wear a derby so you will know it's me.
    " I don't like the idea of getting shot in the hand" -Blackie in "Rustlers Rhapsody"

    " It is a proud and lonely thing, to be a Stainless Steel Rat." - Slippery Jim DiGriz

Similar Threads

  1. I got bad ram : can it be hidden ?
    By elo.trans.ts in forum Windows NT/2000
    Replies: 1
    Last Post: October 18th, 2004, 07:30 AM
  2. how to tell if ntfs hd has bad sectors?
    By ngc4414 in forum Tech-To-Tech
    Replies: 12
    Last Post: July 29th, 2004, 07:17 PM
  3. i'm confused (political)
    By notorious_carl in forum Tech Lounge & Tales
    Replies: 11
    Last Post: July 15th, 2004, 03:34 PM
  4. Gazelle computer info
    By qei in forum Tech-To-Tech
    Replies: 6
    Last Post: September 10th, 2001, 09:39 AM
  5. bad floppy?
    By DANIMAL in forum Hard Drive/IDE/SCSI Drivers
    Replies: 12
    Last Post: July 1st, 2001, 04:38 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •